diff --git a/CLAUDE.md b/CLAUDE.md
index 4b76509..fa79279 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,28 +13,39 @@ Hard rule from the user: the loop may receive **facts only, never heuristics or
 the limits, tiers, policy, noise bands, corpus version the referee measures against). Nothing derived from the
 records (counts, best measured, claims vs evidence) goes to the agent; that is `for_researcher.activity`.
 The task (`lab/task.py`, `--task task.toml`: goal, objective regimes, constraints) is stated in full in the brief,
-and a submit returns its `score` under that task: the win condition is known, never inferred.
+and a submit returns its `score` under that task: the win condition is known, never inferred. The system prompt is
+generated per session (`session.system_prompt`: template `lab/prompts/system.md` filled from the target spec and the
+ToolSpec descriptions, which state what each tool does, returns and costs, never when to use it). The brief is the
+task, budget, referee, a BASELINE (the base commit under bench's defaults, measured once per run, `baseline` ledger
+kind; `RunConfig.baseline=False` skips it) and only the run's last `session` record.
 
 ## Layout
 Top-level packages, run from the repo root (no install step; `pyproject.toml` lists optional extras and holds the
 pytest/ruff config). Each folder with commands has its own `python -m`.
 - `targets/<name>.toml` + `lab/target.py` — **the target spec** (since 2026-10-06): model + chat kwargs, engine
   (repo, python, launch command with `{port}`, health path, env, logprobs `api` vllm|sglang|none, write surface,
-  add-only globs, test and lint commands), reference server + its outputs dir, MLPerf latency limits, correctness
+  add-only globs, test and lint commands, optional `[engine.telemetry] env` with `{dir}`), reference server + its outputs dir, MLPerf latency limits, correctness
   tasks and policy, corpus dir. Selected by `LAB_TARGET` or `--target`; `target.load()` raises `NoTarget` otherwise.
   Nothing defaults to the user's engine or to Qwen3; `targets/inference-server.toml` is the committed example and
   what `tests/conftest.py` points at. Surfaces, grader commands, `lab/engine.py`, and the `correctness`,
   `regimes`, `validity` CLIs all read it.
 - `lab/` — moved from inference-server 2026-10-06 (`lab/README.md`). `session.py` (the loop over a dollar budget),
   `agent.py` (the one place a model is called; the agent's jailed shell gets the engine's python on PATH),
-  `tools.py` (metered tools: test, profile, ledger, budget, restore, note) + `evaltools.py` (bench → `regimes` on
+  `tools.py` (metered tools: test, profile, ledger, budget, restore, note; every record's `cost` has wall seconds, and
+  GPU tools charge them at `LAB_GPU_USD_PER_HOUR` / the target's `[cost] gpu_usd_per_hour` to the run's budget) +
+  `proftools.py` (trace = nsys, kernel = ncu, hostprof = py-spy, each wrapping lab.profile's workload in the jail
+  with validated args) + `evaltools.py` (bench → `regimes` on
   the seen split; equiv → `correctness` candidate vs the target's reference; submit → held-out full tier vs the
   base commit, one aggregate per regime through the Thresholdout guard; all three serve the pristine tree via
-  `serve.py`, jailed with local binding allowed), `workspace.py` (exported engine copy + snapshots), `ledger.py`
+  `serve.py`, jailed with local binding allowed; every serve also keeps its passive data, `artifacts.py`: device
+  samples via `gpu.DeviceSampler` (DCGM if `dcgmi`, else nvidia-smi), engine telemetry files from `{dir}`, all
+  client rows, the serve log; bench/equiv as ledger blobs under `result.artifacts`, submit only in
+  `<run>/heldout-private/`, never in the ledger; `artifacts.joined` joins client rows to engine rows by trace id),
+  `workspace.py` (exported engine copy + snapshots), `ledger.py`
   (append-only JSONL, `lab/ledger/` gitignored), `budget.py`, `engine.py` (where the engine repo and its python
   are), `safety/` (write surfaces, srt jail, grader: lint/tests run with the engine's python in the jail),
-  `profile.py` + `bundle.py` + `gpu.py` (profiler harness, staged into the pristine tree under `_harness/` so the
-  jail never opens this repo, which holds `.env` and the ledger), `canary.py` (honest regressions patched into
+  `profile.py` (`--profiler torch|cuda-range|pyspy`) + `bundle.py` + `gpu.py` (profiler harness, staged into the pristine tree under `_harness/` so the
+  jail never opens this repo, which holds `.env` and the ledger; the tool samples its seen-split corpus workload out here, `corpus.sample`, and stages it as `_harness/workload.json`; window-only memory peaks and scheduler counters, warmup sized to the window, op/kernel tables), `canary.py` (honest regressions patched into
   the engine's process), `vm.py` + `providers/` + `vm-setup.sh` (one GPU VM on Verda/Nebius/Crusoe; pushes both
   trees, engine to `LAB_VM_DIR`, this repo to `LAB_VM_ENV_DIR`; `run --env` runs here; `run` stops the VM when done
   unless `--keep`, and every session is capped by `LAB_VM_MAX_MINUTES` via `timeout` + a local watchdog + in-VM
@@ -46,6 +57,12 @@ pytest/ruff config). Each folder with commands has its own `python -m`.
   measures each regime's run-to-run band from repeated reference runs into `knowledge/noise/<regime>.json` (which
   `submit` reads). Exit 0 only if both hold. Needs a GPU for a real target; tested on fakes. `lab/LEDGER.md` is the
   record-format spec: the environment's public interface.
+- `lab/TRACE.md` + `lab/trace_contract.py` — the request-trace contract: per-request engine rows (trace_id = the
+  client's `X-Trace-Id`, `arrival_ts` epoch s, `*_s` monotonic durations, TPOT = (E2E − TTFT)/(n − 1)) in a dir of
+  `*.sqlite` (`requests` + `meta`) or `*.jsonl` + `<stem>.meta.json`, with schema version and drop counts;
+  `python -m lab.trace_contract DIR`. Diagnostics only, never scored. inference-server's `TELEMETRY_DIR` conforms
+  natively (schema 1, inference-server#102); the target names its env vars in `[engine.telemetry] env` (`{dir}`); serve collects
+  the files after every bench/equiv/submit and the contract check's report is stored beside them. vLLM OTel span mapping is in the spec, not implemented.
 - `corpus/` — frozen workload traces (BurstGPT timing, WildChat text), seen/heldout, hashed, `manifest.json`;
   `build_corpus.py` / `fetch_traces.py` rebuild it; any change is a new `corpus_version`.
 - `knowledge/` — measured findings (one JSON each) + `evidence/`; seeded into the ledger as `finding` records.
diff --git a/correctness/client.py b/correctness/client.py
index 872aaef..9739528 100644
--- a/correctness/client.py
+++ b/correctness/client.py
@@ -35,8 +35,9 @@ class NoLogprobs(RuntimeError):
 DEFAULT = Api()
 
 
-def _post(url: str, body: dict, timeout: float = 600) -> dict:
-    req = urllib.request.Request(url, data=json.dumps(body).encode(), headers={"Content-Type": "application/json"})
+def _post(url: str, body: dict, timeout: float = 600, trace_id: str | None = None) -> dict:
+    headers = {"Content-Type": "application/json", **({"X-Trace-Id": trace_id} if trace_id else {})}
+    req = urllib.request.Request(url, data=json.dumps(body).encode(), headers=headers)
     with urllib.request.urlopen(req, timeout=timeout) as r:
         return json.loads(r.read())
 
@@ -48,9 +49,11 @@ def _chat_body(api: Api, model: str, messages: list[dict], max_tokens: int) -> d
     return body
 
 
-def generate(base_url: str, model: str, messages: list[dict], max_tokens: int = 2048, api: Api = DEFAULT) -> dict:
-    """Greedy. Returns {"text", "completion_tokens", "finish_reason"}."""
-    out = _post(f"{base_url.rstrip('/')}/v1/chat/completions", _chat_body(api, model, messages, max_tokens))
+def generate(base_url: str, model: str, messages: list[dict], max_tokens: int = 2048, api: Api = DEFAULT,
+             trace_id: str | None = None) -> dict:
+    """Greedy. Returns {"text", "completion_tokens", "finish_reason"}. `trace_id` rides as X-Trace-Id."""
+    out = _post(f"{base_url.rstrip('/')}/v1/chat/completions", _chat_body(api, model, messages, max_tokens),
+                trace_id=trace_id)
     ch = out["choices"][0]
     return {"text": ch["message"]["content"] or "", "completion_tokens": (out.get("usage") or {}).get("completion_tokens"),
             "finish_reason": ch.get("finish_reason")}
diff --git a/correctness/run.py b/correctness/run.py
index 3622695..9c9333d 100644
--- a/correctness/run.py
+++ b/correctness/run.py
@@ -50,6 +50,7 @@ def _jsonl_read(path: Path) -> list[dict]:
     return [json.loads(l) for l in Path(path).read_text().splitlines() if l.strip()] if Path(path).exists() else []
 
 
+TRACE_PREFIX = "eq"          # X-Trace-Id of a gate request: eq-<item id>, so equiv rows join engine telemetry
 RETRIES = 6                 # a 429/503 (the server shedding under the gate's load) is retried with backoff
 
 
@@ -75,7 +76,8 @@ def collect(url: str, model: str, items: list[dict], out: Path, concurrency: int
 
     def one(it):
         try:
-            g = _retrying(client.generate, url, model, it["messages"], it.get("max_tokens", 2048), api)
+            g = _retrying(client.generate, url, model, it["messages"], it.get("max_tokens", 2048), api,
+                          trace_id=f"{TRACE_PREFIX}-{it['id']}")
         except Exception as e:                      # a failed request is a recorded fact, not a crash
             g = {"text": "", "completion_tokens": None, "finish_reason": None, "error": f"{type(e).__name__}: {e}"[:200]}
         return {"id": it["id"], **g}
diff --git a/feedback/lab_verdict.py b/feedback/lab_verdict.py
index 3624ff1..fd7a7c9 100644
--- a/feedback/lab_verdict.py
+++ b/feedback/lab_verdict.py
@@ -17,7 +17,7 @@
 from collections import Counter
 from pathlib import Path
 
-KINDS = {"test", "equiv", "bench", "profile", "submit", "finding", "session", "note"}
+KINDS = {"test", "equiv", "bench", "profile", "submit", "finding", "session", "note", "baseline"}
 TOOL_KINDS = ("test", "equiv", "bench", "profile", "submit")
 
 
diff --git a/lab/LEDGER.md b/lab/LEDGER.md
index 3b53022..2a95a0d 100644
--- a/lab/LEDGER.md
+++ b/lab/LEDGER.md
@@ -3,7 +3,8 @@
 Any loop that writes these records gets a verdict and facts back (`python -m feedback <ledger dir>`); the lab's
 tools are one writer. Append-only JSONL, one record per line, `lab/ledger/ledger.jsonl`; `lab/ledger.py` validates
 on write. Every record: `id`, `at`, `schema` (set by the writer), `kind`, `run`, `session`, `snapshot`
-(content hash of the agent's workspace), `snapshot_blob`, `patch`, `cost: {usd}`. Tool records add `tool`, `args`,
+(content hash of the agent's workspace), `snapshot_blob`, `patch`, `cost: {usd}`. Tool records' `cost` also has
+`seconds` (wall time of the call); GPU tools add `gpu_seconds`, `usd_per_hour` and `rate_known`. Tool records add `tool`, `args`,
 `result`. The agent's own words live only under `claim` and never decide anything.
 
 | kind | written by | `result` (or shape) |
@@ -11,9 +12,11 @@ on write. Every record: `id`, `at`, `schema` (set by the writer), `kind`, `run`,
 | `session` | the loop | provider, model, turns, seconds, status (`stop`/`continue`), error, `violation`, `claim.note` |
 | `test` | `test` | `lint`, `tests` (bools), returncode, output tails, `changed`, `scratch_left_out` |
 | `profile` | `profile` | `bundle` (ledger blob of the profiler output), `workspace_copy`, seconds |
-| `bench` | `bench` | `config: {split: seen, tier}`; `verdict: ok`, `metrics: {regime: {objective, value, better, valid, invalid_reasons}}`, `regimes` (full per-regime results), `ready_s` |
-| `equiv` | `equiv` | `config: {split: seen, tier}`; `verdict: pass\|fail\|inconclusive`, `passed`, `reasons`, `gates`, `metrics` (accuracy with CI, length, consistency, divergence, per-task flips, unanswered), `thresholds` |
+| `profile` | `trace`, `kernel`, `hostprof` | `bundle` (blob of the instrument's output dir), `workspace_copy`, `instrument` (resolved binary), `argv` (every command run), returncode, seconds, output tail |
+| `bench` | `bench` | `config: {split: seen, tier}`; `verdict: ok`, `metrics: {regime: {objective, value, better, valid, invalid_reasons}}`, `regimes` (full per-regime results), `ready_s`, `artifacts` |
+| `equiv` | `equiv` | `config: {split: seen, tier}`; `verdict: pass\|fail\|inconclusive`, `passed`, `reasons`, `gates`, `metrics` (accuracy with CI, length, consistency, divergence, per-task flips, unanswered), `thresholds`, `artifacts` |
 | `submit` | `submit` | **held-out shape**: no `result`; top-level `config: {split: heldout, tier: full}` and `metrics: {regime: {base, new, delta_pct, band_pct, verdict}}`, scalars only. The ledger refuses anything else that mentions the held-out split. |
+| `baseline` | the loop, once per run before the first session | `config: {split: seen, tier: short, commit}`; `verdict: ok` with `metrics` shaped like `bench` (the base commit under bench's default regimes, from the cache submit compares against), or `verdict: error`, `reason` |
 | `finding` | `lab.ledger seed` | a `knowledge/` entry, whole, as `claim`; `source`, `content_sha` |
 | `note` | `note`, `restore`, refusals | free text, or `{verdict: refused, reason}` |
 
@@ -21,3 +24,26 @@ A tool that could not run writes `{verdict: refused | error, reason}` and the ag
 crashes the session. The integrity verdict (`feedback/lab_verdict.py`) reads only these records: a run is valid
 iff a completed `submit` exists whose snapshot also has a completed seen-split `bench`, a passing `test`, a
 passing `equiv` (tier full) and no failing `equiv`, and no record reports a write-surface violation.
+
+## Passive data (`artifacts`)
+
+Every bench and equiv (including one that errored after serving) keeps the cheap data from the same served run as
+ledger blobs, referenced from `result.artifacts: {device, telemetry, client_rows, serve_log}` (blob paths under the
+ledger root, `telemetry` None when the target has no `[engine.telemetry]` or the engine wrote nothing). The tool's
+reply to the agent never includes them. `lab/artifacts.py` loads them back (`load`) and joins client rows to engine
+rows by trace id (`joined`: client `X-Trace-Id` is `bg-<row id>`).
+
+- `device/`: `meta.json` (`available`; when true `source` dcgm|nvidia-smi, `coarse` (nvidia-smi utilization is
+  coarse, DCGM profiling fields are not), `fields`, `interval_ms`, `exited` if the sampler died) and `samples.csv`,
+  each raw tool line prefixed with epoch seconds. Covers the whole served window, launch to teardown.
+- `telemetry/`: whatever the engine wrote into `{dir}` (inference-server: `<run>.sqlite` with a `requests` table,
+  `events.jsonl`).
+- `client_rows`: JSONL, one per measured request, without generated text. Bench: the regimes' rows with `regime`,
+  `call` (which run_open/run_closed call), `call_started_at` (epoch) and run-clock times; warmups are not kept.
+  Equiv: one per gate item (`id`, `completion_tokens`, `finish_reason`, `error`).
+- `serve_log`: this run's part of the serve log.
+
+**Submit keeps none of this in the ledger.** Its held-out record stays in the strict held-out shape above, with no
+field pointing at passive data, and no blob is written for it. The same data for the held-out serve goes to
+`<run dir>/heldout-private/<snapshot>-<time>/` (same layout, `client_rows.jsonl`), outside the ledger and outside
+every jail: operator-only. The base-commit measurements submit makes keep no passive data.
diff --git a/lab/README.md b/lab/README.md
index 57df716..4b00468 100644
--- a/lab/README.md
+++ b/lab/README.md
@@ -28,22 +28,44 @@ copy it, change the engine section (and the reference if the model changes), and
 - White-box tools (profile) build the backend and scheduler in process, because torch.profiler
   has to live in the process it traces. Profiling never gates anything.
 - Engine instrumentation the lab reads: `TIMELINE_DIR` turns on the event timeline
-  (`src/inference_server/timeline.py`), `TELEMETRY_DIR` the per-request rows.
+  (`src/inference_server/timeline.py`), `TELEMETRY_DIR` the per-request rows. The target names them in
+  `[engine.telemetry] env` with `{dir}`; serve points them at `lab-telemetry/` in the served tree and collects what
+  appeared there after teardown. Optional: without the section nothing is collected. The rows follow the
+  engine-agnostic request-trace contract in `lab/TRACE.md` (a dir of `*.sqlite` or `*.jsonl` + meta, keyed by
+  `X-Trace-Id`); check a dir with `python -m lab.trace_contract DIR`.
 
 ## Tools
 
-    python -m lab.profile --backend custom-mps --requests 8 --max-tokens 32 --out lab/runs
+    python -m lab.profile --backend custom-mps --corpus-class steady_interactive --requests 8 --max-tokens 32 --out lab/runs
 
 The engine configuration comes from the same env vars the server reads (`MAX_BATCH_SIZE`,
 `PREFILL_MODE`, ...), so a profile measures what is served; `--backend` and `--model` override
-`BACKEND` and `MODEL_NAME`. Writes one bundle directory per run, raw files only:
+`BACKEND` and `MODEL_NAME`. The workload is explicit, one of: `--corpus-class NAME` (`--split`, `--seed`,
+`--requests`: sampled through the verified loader, chat-templated with the engine's tokenizer, thinking off
+unless `--enable-thinking`), `--workload FILE` (the same, pre-sampled by `lab.corpus.sample`; the `profile`
+tool uses it because the jail holds no corpus), `--prompts FILE` or `--synthetic` (random ids of `--prompt-len`).
+Output length is `--max-tokens` for every request. Before the window, `--warmup` requests (default: as many as
+the window) at the window's prompt lengths with random ids are fired together, so compiles and graph captures for
+the window's batch sizes happen outside it. Writes one bundle directory per run, raw files only:
 
     events.jsonl   engine event timeline: scheduler decisions and phases, per step
     trace.json     torch.profiler chrome trace; phase ranges carry the step id
-    memory.json    device allocator stats and peak host RSS
-    gpu.csv        nvidia-smi samples at 100 ms (CUDA hosts only)
-    stats.json     the scheduler's own counters at the end of the run
-    meta.json      git sha, torch, device, clock state, engine settings, workload hash, window
+    ops.json       prof.key_averages() by self device then self CPU time: top 200 and totals (us)
+    kernels.json   CUDA kernels by name: count, total, mean, max (us); only when there was CUDA activity
+    memory.json    window peak (reset at window start) and lifetime peak (CUDA), allocator snapshots at window
+                   start and end, peak host RSS (lifetime)
+    gpu.csv        nvidia-smi samples at 100 ms with an `epoch_s` column, throttle reasons when the driver has them (CUDA hosts only)
+    stats.json     the scheduler's counters at window start and end, and their difference
+    meta.json      git sha, torch, device, engine settings, workload source and hash, window, warmup, profiler config
+                   (`profiler_on`: every number was taken under the profiler), GPU clock state and throttle reasons at
+                   window start and end, timeline events written/dropped, per-request outcomes and token counts
+
+`--profiler` picks what wraps the measured window: `torch` (default, `trace.json`), `cuda-range`
+(cudaProfilerStart/Stop around it, no torch trace, for an outer `nsys --capture-range=cudaProfilerApi` or
+`ncu --profile-from-start off`), or `pyspy` (`--pyspy-bin`, `--seconds`, `--rate`: the workload repeats for
+`--seconds` while py-spy samples this process without stopping it; adds `pyspy.speedscope.json`, `pyspy-dump.txt`
+taken halfway, `pyspy-record.log`). For `pyspy` the process lets its own children ptrace it
+(`PR_SET_PTRACER_ANY`), since Yama's default only lets ancestors.
 
 ## Ledger
 
@@ -70,8 +92,12 @@ A held-out record (`config.split == "heldout"`) carries no `raw` and one aggrega
     python -m lab.session --task task.toml --budget 20      # or --goal "free text" with no objective
     # task.toml: [task] goal; [objective] regimes = [...], combine = "min"|"mean"; [constraints] <regime> = { max_regression_pct }
 
-One loop: while dollars remain, a fresh agent session gets the goal, the budget left, the last
-ledger records and the tools, and is free. Its shell and file tools run inside the srt jail on an
+One loop: once per run, before the first session, the base commit is measured under `bench`'s default regimes
+(seen split, short tier; the same cache `submit` compares against) and recorded as a `baseline` record
+(`RunConfig.baseline=False` skips it). Then, while dollars remain, a fresh agent session gets a system prompt
+generated from the target spec and the tool specs (`lab/prompts/system.md` is its template: target, write surface,
+each tool with what it does, returns and costs, budget mechanics, how a session ends), the brief, and the tools,
+and is free. Its shell and file tools run inside the srt jail on an
 exported copy of the engine (no git history, held-out data removed); it may write
 `src/inference_server/` and add `tests/test_*.py`, nothing else. The lab's own tools run out here
 with the referee's rights, snapshot the workspace and write the ledger on every call:
@@ -79,7 +105,10 @@ with the referee's rights, snapshot the workspace and write the ledger on every
 | tool | does |
 |---|---|
 | `test` | lint and the fast suite on a pristine two-commit copy of the workspace, jailed |
-| `profile` | `lab.profile` on the pristine copy, jailed; the bundle goes into the ledger as a blob |
+| `profile` | `lab.profile` on the pristine copy, jailed, on `args.corpus_class` (default `steady_interactive`, seen split, `args.seed`) or `args.synthetic`; the bundle goes into the ledger as a blob |
+| `trace` | `nsys profile` around `lab.profile --profiler cuda-range` (window only), then `nsys stats` (kernel, CUDA API, memcpy, NVTX tables as CSV), both jailed; `.nsys-rep` + CSVs as a blob |
+| `kernel` | `ncu --kernel-name regex:<kernel_regex> --launch-skip N --launch-count N --set basic\|full` around the same workload, then `ncu --import --csv --page raw`; `.ncu-rep` + `metrics.csv` as a blob |
+| `hostprof` | `lab.profile --profiler pyspy`: py-spy record (speedscope) for `seconds` under the repeated workload plus one `py-spy dump`; the bundle as a blob |
 | `ledger` | read records (this run and earlier ones) |
 | `budget` | dollars left |
 | `restore` | workspace back to a snapshot id (`base` resets) |
@@ -88,9 +117,42 @@ with the referee's rights, snapshot the workspace and write the ledger on every
 | `equiv` | serve it and run the correctness gate (`correctness/`) against the target's reference outputs; pass, fail or inconclusive with every metric; `tier=full` uses `<reference.dir>-full` |
 | `submit` | the only thing that can produce a win. Needs a passing full-tier equiv and a seen bench on this snapshot. Measures the held-out split at the full tier, measures the base commit the same way (once per run, cached outside the jail), and records one aggregate per regime (base, new, delta %, noise band %, verdict improved/regressed/within_band/unknown_band) through the Thresholdout guard (`validity/holdout.py`, state in `lab/ledger/holdout_state.json`, seed `LAB_HOLDOUT_SEED`): the held-out numbers themselves never reach the ledger. Noise bands come from `knowledge/noise/<regime>.json` when measured |
 
+`trace`, `kernel` and `hostprof` take integers in fixed ranges (`requests` 1-256, `prompt_len` 1-32768,
+`max_tokens` 1-4096, `launch_count` 1-64, `launch_skip` 0-100000, `seconds` 1-300, `rate` 1-1000), `set` from
+basic/full, and a `kernel_regex` of at most 200 regex characters (no spaces, quotes, `;`, `&`, backticks, `/` or
+`$(`); nothing else reaches the command line, which is an argv list, never a shell. The instrument is resolved on the
+referee's PATH (refused, and recorded as a refusal, when absent) and its directory is added to the jail's read list.
+The workload is lab.profile's in-process scheduler and backend, so these tools see the engine's kernels and host
+code but not the HTTP front end.
+
+### Cost
+
+Every tool record's `cost` has `seconds`, the wall time of the call. Tools that occupy the GPU also charge those
+seconds at the venue's rate to the run's budget (`budget.charge`), so `budget` and the next session's cap reflect
+them, and record `gpu_seconds`, `usd_per_hour` and `rate_known`. The rate is `LAB_GPU_USD_PER_HOUR`, else the
+target's `[cost] gpu_usd_per_hour`, else 0 with `rate_known: false` (no provider module knows a price offline; Verda's
+`python -m lab.vm status` shows the live `$/h`). A GPU tool is refused once the budget is spent and a rate is set.
+Only tool time is charged: the VM also bills while the model thinks between calls, which the budget does not see.
+
+| tool | GPU | charged | typical wall time per call (estimates until measured on the H200) |
+|---|---|---|---|
+| `test` | no | $0 | CPU lint and suite |
+| `ledger`, `budget` | no | $0 (pure reads, write no record) | milliseconds |
+| `restore`, `note` | no | $0 | under a second |
+| `profile` | yes | seconds × rate | 2-5 min: engine start plus the workload |
+| `trace` | yes | seconds × rate | 3-6 min: engine start, workload, report export, `nsys stats` |
+| `kernel` | yes | seconds × rate | 5-20 min: each profiled launch is replayed once per metric pass (`full` has the most) |
+| `hostprof` | yes | seconds × rate | 2-4 min plus `seconds` |
+| `bench` | yes | seconds × rate | 5-10 min per regime at tier short, 15-25 at full, plus ~2 min engine start |
+| `equiv` | yes | seconds × rate | ~10 min at tier dev, 30-60 at full |
+| `submit` | yes | seconds × rate | 15-25 min per regime (held-out, full tier), plus the base commit measured once per run |
+
+The same estimates are in each tool's description, stated as facts about cost, with the configured rate.
+
 Every session opens with the task in full, the referee's verdict on the run so far (integrity, with the evidence
 behind each broken rule) and the harness facts the agent cannot read off its ledger (latency limits, tiers,
-correctness policy, noise bands, corpus version, held-out queries left), then the last records. Nothing in it is
+correctness policy, noise bands, corpus version, held-out queries left), then the baseline's headline numbers (or
+why the base could not be measured) and only the last `session` record of the run. Nothing in it is
 derived from the agent's own records and nothing is advice; the `ledger` tool has every record, unfiltered.
 
 A session ends when the agent says `stop`, its per-session cap is spent, or it times out. The
@@ -122,7 +184,7 @@ commands either way:
     python -m lab.vm start                  # create (first time) or start, wait for ssh
     python -m lab.vm setup                  # lab/vm-setup.sh: venv, CUDA torch, Nsight, counter and clock checks
     python -m lab.vm run --env --fetch lab/runs -- \
-        env BACKEND=custom-cuda python -m lab.profile --requests 8      # --env: run in this repo's tree
+        env BACKEND=custom-cuda python -m lab.profile --corpus-class steady_interactive --requests 8      # --env: run in this repo's tree
     python -m lab.vm run -- python scripts/gpu_tests/checks.py         # default: run in the engine's tree
     python -m lab.vm stop                   # ends all billing (Verda: deletes the VM and its disk)
 
diff --git a/lab/TRACE.md b/lab/TRACE.md
new file mode 100644
index 0000000..e2dea76
--- /dev/null
+++ b/lab/TRACE.md
@@ -0,0 +1,99 @@
+# Request traces: what an engine reports per request
+
+The engine's own account of each request: one row per request, keyed by the trace id the client sent. The
+environment's client rows (`regimes/client.py`) are still the measurement, and the referee never scores these
+rows. They exist so the researcher can join "what the client saw" with "where the engine spent the time". An
+engine that writes nothing still gets judged. Checked by `lab/trace_contract.py`
+(`python -m lab.trace_contract DIR`).
+
+## How an engine exposes it
+
+The target names the engine's environment variables in `[engine.telemetry] env`, with `{dir}` where the directory goes (for inference-server, `TELEMETRY_DIR` and `TIMELINE_DIR`).
+The lab sets that variable to a fresh, empty directory for each launch. When the engine exits, the lab collects
+every file in it. The directory holds only trace files, one or more (one per engine process), in either format:
+
+- **SQLite** `*.sqlite`: a table `requests` with one column per field below, and a table `meta (key TEXT PRIMARY
+  KEY, value)`.
+- **JSONL** `*.jsonl`: one JSON object per row, plus `<stem>.meta.json`, one object with the meta keys.
+
+The meta keys are all required:
+
+| key | type | meaning |
+|---|---|---|
+| `schema_version` | int | the contract version the file follows (now `1`) |
+| `rows_written` | int | rows in this file |
+| `rows_dropped` | int | rows the engine produced but could not write (queue full, write error, after shutdown) |
+| `closed` | int 0/1 | 1 once the engine shut down cleanly, so the counts are final |
+
+Drops are never silent. A file without `rows_dropped` fails the check. A closed file whose `rows_written` differs
+from its row count also fails.
+
+## Clocks and units
+
+- One absolute time per row: `arrival_ts`, **epoch seconds** (wall clock, float). Epoch milliseconds or
+  nanoseconds and monotonic readings (seconds since boot or since the process started) are rejected.
+- Every field ending in `_s` is a **duration in seconds**, measured on a monotonic clock. A duration is never the
+  difference of two wall-clock readings, and never of a wall reading and a monotonic one.
+- **Arrival** is when the engine received the HTTP request, before tokenizing. The wall-clock `arrival_ts` and the
+  monotonic origin of the durations must be one instant: read both clocks together, or back-date one from the other.
+- Token counts use the engine's own tokenizer. The client recounts with the reference tokenizer, so the two may
+  differ.
+
+## Required fields
+
+| field | type | rule |
+|---|---|---|
+| `schema_version` | int | `1` |
+| `trace_id` | str | the client's `X-Trace-Id`, verbatim; non-empty. A retry may reuse it, so duplicates are allowed |
+| `arrival_ts` | float | epoch seconds at arrival |
+| `terminal_state` | str | one of `ok`, `rejected_429`, `rejected_400`, `expired`, `preempted`, `error`, `cancelled` (the client went away), `aborted` (the engine shut down with the request unfinished) |
+| `prompt_tokens` | int | ≥ 0 |
+| `tokens_out` | int | ≥ 0, real tokens only (no EOS) |
+| `total_s` | float | arrival to the request's end (last token, rejection or abort), ≥ 0 |
+| `ttft_s` | float or null | arrival to the first real token. Set exactly when `tokens_out ≥ 1`, and ≤ `total_s` |
+| `tpot_s` | float or null | `(total_s − ttft_s) / (tokens_out − 1)` when `tokens_out ≥ 2`, else null. The environment's definition, checked to 0.1% |
+
+## Optional fields
+
+Typed if present. Null means "not measured". Any other column is allowed and ignored.
+
+| field | type | meaning |
+|---|---|---|
+| `session_id`, `config_id`, `prefill_mode` | str | client session; applied config; how the prompt was prefilled |
+| `turn_index` | int | position in the session |
+| `queue_wait_s`, `prefill_s`, `decode_s` | float | spans. `queue_wait_s + prefill_s ≤ ttft_s` |
+| `replica_age_s` | float | seconds since the engine started serving |
+| `pending_depth`, `active_size`, `max_batch_size`, `concurrent_sessions` | int | load at arrival |
+| `kv_free_blocks` | int | KV-cache blocks free at arrival |
+| `kv_free_frac` | float | the same as a fraction in [0, 1] |
+| `cache_hit_tokens` | int | prompt tokens served from a prefix cache, ≤ `prompt_tokens`. Null when unknown, never a stand-in 0 |
+| `decode_steps`, `decode_batch_width_max`, `preempted` | int | forward passes after prefill; widest batch it decoded in; preemptions |
+| `decode_batch_width_mean` | float | mean batch width over its own decode steps |
+
+## inference-server
+
+`TELEMETRY_DIR` makes the engine write `<run_id>.sqlite`, in the SQLite layout above with the same column names
+(`src/inference_server/telemetry.py`, schema 1 since inference-server#102), so no adapter is needed. Its
+`TIMELINE_DIR` event log (`events.jsonl`: `ts` epoch seconds, `step`, `kind`, `trace_id` on request events) is
+engine-specific and outside this contract. It joins to the rows on `trace_id`.
+
+## vLLM (mapping only, not implemented)
+
+vLLM's Prometheus metrics (`vllm:time_to_first_token_seconds`, `vllm:e2e_request_latency_seconds`, ...) are
+histograms, which can't be split back into rows. Its OpenTelemetry request spans (`--otlp-traces-endpoint`) are
+per request and could map like this. The attribute names below are from the `gen_ai.*` semantic conventions; check
+them against the vLLM version in use.
+
+- `trace_id` ← the request id. The client also sends `X-Request-Id` (honoured with `--enable-request-id-headers`),
+  or the span's W3C trace id when the client sends `traceparent`.
+- `arrival_ts` ← the span start time (ns since epoch, divided by 1e9).
+- `ttft_s` ← `gen_ai.latency.time_to_first_token`. `total_s` ← `gen_ai.latency.e2e`.
+- `queue_wait_s` / `prefill_s` / `decode_s` ← `gen_ai.latency.time_in_queue` / `time_in_model_prefill` /
+  `time_in_model_decode`.
+- `prompt_tokens` / `tokens_out` ← `gen_ai.usage.prompt_tokens` / `completion_tokens`. `tpot_s` is derived.
+- `terminal_state` ← `finish_reason` (`stop`/`length` → `ok`, `abort` → `cancelled`).
+- Requests rejected before scheduling emit no span. Their rows are missing, so `rows_dropped` can't count them.
+- vLLM measures from its own engine arrival, which can come after tokenizing.
+
+An OTLP collector's file exporter writes the spans as JSON. A small adapter would turn them into the JSONL
+layout above.
diff --git a/lab/artifacts.py b/lab/artifacts.py
new file mode 100644
index 0000000..6ef4b79
--- /dev/null
+++ b/lab/artifacts.py
@@ -0,0 +1,78 @@
+"""Passive data from one served run (device samples, engine telemetry, client rows, serve log): stored as ledger blobs
+referenced from a bench/equiv record's `result.artifacts`, and loaded back with client rows joined to engine rows."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import sqlite3
+from pathlib import Path
+
+from lab import ledger
+
+ROWS = "client_rows.jsonl"
+
+
+def write_rows(work: Path, rows: list[dict]) -> None:
+    """The client's per-request rows (no generated text) into `work`, one JSON object per line."""
+    Path(work).mkdir(parents=True, exist_ok=True)
+    (Path(work) / ROWS).write_text("".join(json.dumps(r) + "\n" for r in rows))
+
+
+def store(work: Path, root: Path) -> dict:
+    """`work`'s passive data as ledger blobs, {device, telemetry, client_rows, serve_log} (None when absent); `work`
+    is removed."""
+    def blob(name: str, suffix: str = "") -> str | None:
+        p = Path(work) / name
+        return ledger.put_blob(p, root, suffix) if p.exists() else None
+    tel = Path(work) / "telemetry"
+    if tel.is_dir() and any(tel.iterdir()):       # the request-trace contract check travels with the data (lab/TRACE.md)
+        from lab.trace_contract import validate
+        rep = validate(tel)
+        (tel / "contract.json").write_text(json.dumps({"valid": rep.valid, "errors": rep.errors[:50],
+                                                       "rows": len(rep.rows), "files": rep.files}, default=str))
+    out = {"device": blob("device"), "telemetry": blob("telemetry"), "client_rows": blob(ROWS, ".jsonl"),
+           "serve_log": blob("serve.log", ".log")}
+    shutil.rmtree(work, ignore_errors=True)
+    return out
+
+
+def telemetry_rows(d: Path | None) -> list[dict]:
+    """Every engine row with a trace_id: the `requests` table of each *.sqlite, and *.jsonl lines that carry one."""
+    if d is None:
+        return []
+    rows = []
+    for p in sorted(Path(d).glob("*.sqlite")):          # top level only: the timeline lives in timeline/
+        con = sqlite3.connect(f"file:{p}?mode=ro", uri=True)
+        con.row_factory = sqlite3.Row
+        try:
+            rows += [dict(r) for r in con.execute("SELECT * FROM requests")]
+        except sqlite3.OperationalError:          # no requests table: not per-request rows
+            pass
+        finally:
+            con.close()
+    for p in sorted(Path(d).glob("*.jsonl")):
+        rows += [r for r in map(json.loads, p.read_text().splitlines()) if isinstance(r, dict) and "trace_id" in r]
+    return rows
+
+
+def load(record: dict, root: Path) -> dict:
+    """A record's artifacts back: device meta, telemetry dir (or None), client rows, serve log text."""
+    a = (record.get("result") or {}).get("artifacts") or {}
+
+    def path(k: str) -> Path | None:
+        return Path(root) / a[k] if a.get(k) else None
+    dev, rows, log = path("device"), path("client_rows"), path("serve_log")
+    return {"device": json.loads((dev / "meta.json").read_text()) if dev else None,
+            "device_samples": dev / "samples.csv" if dev and (dev / "samples.csv").exists() else None,
+            "telemetry": path("telemetry"),
+            "client_rows": [json.loads(x) for x in rows.read_text().splitlines()] if rows else [],
+            "serve_log": log.read_text(errors="replace") if log else None}
+
+
+def joined(record: dict, root: Path, prefix: str = "bg") -> list[dict]:
+    """Each client row with `engine`: the telemetry row whose trace_id is `<prefix>-<row id>` (the client's
+    X-Trace-Id), or None."""
+    a = load(record, root)
+    by_trace = {r["trace_id"]: r for r in telemetry_rows(a["telemetry"])}
+    return [{**r, "engine": by_trace.get(f"{prefix}-{r['id']}")} for r in a["client_rows"]]
diff --git a/lab/budget.py b/lab/budget.py
index e2d4350..af769b0 100644
--- a/lab/budget.py
+++ b/lab/budget.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import os
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -38,3 +39,17 @@ def charge(self, usd: float, what: str) -> None:
     @staticmethod
     def gpu_usd(seconds: float, price_per_hour: float) -> float:
         return seconds / 3600.0 * price_per_hour
+
+
+def gpu_rate() -> tuple[float, bool]:
+    """(USD per GPU-hour, known): LAB_GPU_USD_PER_HOUR, else the target's [cost] gpu_usd_per_hour, else (0, False)."""
+    raw = os.environ.get("LAB_GPU_USD_PER_HOUR")
+    if raw is None:
+        from lab import target
+        raw = (target.load().raw.get("cost") or {}).get("gpu_usd_per_hour")
+    if raw is None:
+        return 0.0, False
+    rate = float(raw)
+    if rate < 0:
+        raise ValueError("the GPU rate is never negative")
+    return rate, True
diff --git a/lab/bundle.py b/lab/bundle.py
index 28b36b1..bf6cae4 100644
--- a/lab/bundle.py
+++ b/lab/bundle.py
@@ -16,10 +16,9 @@
 from typing import Any
 
 import torch
+from torch.autograd import DeviceType
 
-from lab import gpu
-
-FILES = ("events.jsonl", "trace.json", "memory.json", "stats.json", "meta.json")
+FILES = ("events.jsonl", "trace.json", "ops.json", "memory.json", "stats.json", "meta.json")
 
 
 def new_dir(root: str | Path) -> Path:
@@ -61,11 +60,49 @@ def device_memory(device: str) -> dict:
     return out
 
 
+def device_peaks(device: str) -> dict | None:
+    """Allocator high-water marks since the last reset; CUDA only (MPS keeps no peak)."""
+    if not (device.startswith("cuda") and torch.cuda.is_available()):
+        return None
+    s = torch.cuda.memory_stats()
+    return {"allocated_bytes": s.get("allocated_bytes.all.peak", 0), "reserved_bytes": s.get("reserved_bytes.all.peak", 0)}
+
+
+def reset_peaks(device: str) -> None:
+    if device.startswith("cuda") and torch.cuda.is_available():
+        torch.cuda.reset_peak_memory_stats()
+
+
+def ops_table(prof: Any, top: int = 200) -> dict:
+    """prof.key_averages() as rows (times in us), sorted by self device time then self CPU time; top N plus totals."""
+    rows = [{"name": a.key, "count": a.count, "self_cpu_us": a.self_cpu_time_total, "cpu_us": a.cpu_time_total,
+             "self_device_us": a.self_device_time_total, "device_us": a.device_time_total}
+            for a in prof.key_averages()]
+    rows.sort(key=lambda r: (r["self_device_us"], r["self_cpu_us"]), reverse=True)
+    return {"sort": "self_device_us, self_cpu_us", "ops_total": len(rows), "top": rows[:top],
+            "totals": {"self_cpu_us": sum(r["self_cpu_us"] for r in rows),
+                       "self_device_us": sum(r["self_device_us"] for r in rows)}}
+
+
+def kernels_table(events: Any) -> dict | None:
+    """CUDA kernels aggregated by name (times in us), by total time; None when the trace has no CUDA activity."""
+    agg: dict[str, list[float]] = {}
+    for e in events:
+        if e.device_type == DeviceType.CUDA:
+            agg.setdefault(e.name, []).append(e.time_range.elapsed_us())
+    if not agg:
+        return None
+    rows = [{"name": k, "count": len(v), "total_us": sum(v), "mean_us": sum(v) / len(v), "max_us": max(v)}
+            for k, v in agg.items()]
+    rows.sort(key=lambda r: r["total_us"], reverse=True)
+    return {"kernels": rows, "total_us": sum(r["total_us"] for r in rows), "launches": sum(r["count"] for r in rows)}
+
+
 def meta(device: str, settings: Any, prompts: list[list[int]], max_tokens: int, t0: float,
          t1: float, **extra: Any) -> dict:
     """A number is a fact about a config, so the engine settings travel with every bundle."""
     return {"git_sha": git_sha(), "torch": torch.__version__, "python": sys.version.split()[0],
-            "platform": platform.platform(), "device": device, "gpu": gpu.query(),
+            "platform": platform.platform(), "device": device,
             "settings": asdict(settings),
             "workload_hash": workload_hash(prompts, max_tokens), "requests": len(prompts),
             "max_tokens": max_tokens, "window": {"start": t0, "end": t1, "wall_s": t1 - t0},
diff --git a/lab/corpus.py b/lab/corpus.py
index 0f3c207..33196e5 100644
--- a/lab/corpus.py
+++ b/lab/corpus.py
@@ -13,6 +13,7 @@
 
 import hashlib
 import json
+import random
 from dataclasses import asdict, dataclass, field
 from pathlib import Path
 from typing import Any
@@ -186,3 +187,12 @@ def load_trace(class_name: str, split: str,
     if class_name not in m.classes:
         raise CorpusError(f"unknown workload class {class_name!r}; have {sorted(m.classes)}")
     return m, read_trace(corpus_dir / m.classes[class_name].trace_file(split))
+
+
+def sample(class_name: str, split: str, seed: int, n: int, corpus_dir: Path = CORPUS_DIR) -> dict[str, Any]:
+    """`n` requests of one (class, split) drawn without replacement by `seed`: chat messages plus their provenance."""
+    m, reqs = load_trace(class_name, split, corpus_dir)
+    lines = random.Random(seed).sample(range(len(reqs)), n)
+    return {"source": {"kind": "corpus", "class": class_name, "split": split, "seed": seed,
+                       "corpus_version": m.corpus_version, "lines": lines},
+            "messages": [reqs[i].chat_messages() for i in lines]}
diff --git a/lab/evaltools.py b/lab/evaltools.py
index 8db8b41..bf1c44f 100644
--- a/lab/evaltools.py
+++ b/lab/evaltools.py
@@ -7,16 +7,22 @@
            snapshot, measures the held-out split at the full tier, compares with the base commit measured the same
            way, and records one aggregate per metric through the Thresholdout guard (the held-out numbers
            themselves never reach the ledger). Verdict per metric: improved | regressed | within_band | unknown_band.
+
+Each also keeps the run's passive data (lab/artifacts.py): bench and equiv as ledger blobs under `result.artifacts`,
+submit only under `<run>/heldout-private/`, outside the ledger and the jail.
+`baseline` is not a tool: the run measures its base commit under bench's defaults once, before the first session,
+in the same cache submit compares against.
 """
 
 from __future__ import annotations
 
 import json
 import os
+import tempfile
 import time
 from pathlib import Path
 
-from lab import ledger, serve, target
+from lab import artifacts, ledger, serve, target
 from validity.holdout import HoldoutGuard, Refused
 
 HOLDOUT_BUDGET, HOLDOUT_THRESHOLD_PCT, HOLDOUT_SIGMA_PCT = 100, 2.0, 0.5
@@ -34,10 +40,18 @@ def _regimes(args: dict, default: tuple[str, ...]) -> list[str]:
     return list(want)
 
 
-def run_regimes(url: str, t: target.Target, names: list[str], split: str, tier: str, seed: int) -> list[dict]:
+def run_regimes(url: str, t: target.Target, names: list[str], split: str, tier: str, seed: int,
+                rows: list | None = None) -> list[dict]:
+    """Each regime's result; with `rows`, every measured client row is appended to it, tagged with its regime."""
     from regimes import suite
-    ctx = suite.Ctx.from_target(t, url, split=split, tier=tier, seed=seed)
-    return [suite.REGIMES[n](ctx) for n in names]
+    ctx = suite.Ctx.from_target(t, url, split=split, tier=tier, seed=seed, rows=rows)
+    out = []
+    for n in names:
+        k = len(rows) if rows is not None else 0
+        out.append(suite.REGIMES[n](ctx))
+        for r in (rows or [])[k:]:
+            r["regime"] = n
+    return out
 
 
 def headline(results: list[dict]) -> dict:
@@ -99,6 +113,14 @@ def harness_facts(t: target.Target, ledger_root: Path | None = None) -> dict:
     return facts
 
 
+def equiv_rows(out: Path) -> list[dict]:
+    """The gate's per-item client rows (id, completion_tokens, finish_reason, error), without generated text."""
+    p = out.with_suffix(".outputs.jsonl")
+    if not p.exists():
+        return []
+    return [{k: v for k, v in json.loads(x).items() if k != "text"} for x in p.read_text().splitlines() if x.strip()]
+
+
 def _why(e: BaseException) -> str:
     if isinstance(e, serve.NotReady):
         return f"engine did not start: {e}"
@@ -117,16 +139,18 @@ def bench(self, args: dict) -> str:
         tier = args.get("tier") or "short"
         tree = self._pristine()
         t0 = time.monotonic()
+        work, rows = self._work("bench"), []
         try:
             with serve.Served(tree, t.engine, log=self.s.run_dir / "serve-bench.log",
-                              jailed=self.serve_jailed) as srv:
-                results = run_regimes(srv.url, t, names, "seen", tier, self.seed)
+                              jailed=self.serve_jailed, artifacts=work) as srv:
+                results = run_regimes(srv.url, t, names, "seen", tier, self.seed, rows)
         except Exception as e:                      # a tool never crashes the session: the failure is the record
-            result = {"verdict": "error", "reason": _why(e), "seconds": time.monotonic() - t0}
+            result = {"verdict": "error", "reason": _why(e), "seconds": time.monotonic() - t0,
+                      "artifacts": self._store(work, rows)}
             self._record("bench", "bench", args, result, snap, config={"split": "seen", "tier": tier})
             return f"bench failed: {result['reason']}"
         result = {"verdict": "ok", "metrics": headline(results), "regimes": results, "tier": tier,
-                  "seconds": time.monotonic() - t0, "ready_s": srv.ready_s}
+                  "seconds": time.monotonic() - t0, "ready_s": srv.ready_s, "artifacts": self._store(work, rows)}
         self._record("bench", "bench", args, result, snap, config={"split": "seen", "tier": tier})
         return json.dumps({"snapshot": snap.id, "split": "seen", "tier": tier, "metrics": result["metrics"]}, indent=1)
 
@@ -144,18 +168,23 @@ def equiv(self, args: dict) -> str:
         from correctness.gate import Thresholds
         tree = self._pristine()
         out = self.s.run_dir / "equiv" / f"{snap.id}-{tier}.json"
+        work = self._work("equiv")
         try:
-            with serve.Served(tree, t.engine, log=self.s.run_dir / "serve-equiv.log", jailed=self.serve_jailed) as srv:
+            with serve.Served(tree, t.engine, log=self.s.run_dir / "serve-equiv.log", jailed=self.serve_jailed,
+                              artifacts=work) as srv:
                 res = crun.candidate(ref, srv.url, t.model, out, self.encoder(t),
                                      Thresholds(min_score_ratio=t.min_score_ratio, min_length_ratio=t.min_length_ratio),
                                      concurrency=self.equiv_concurrency, api=client.Api(t.engine.api, t.chat_kwargs),
                                      config={"tier": tier})
         except Exception as e:
-            self._record("equiv", "equiv", args, {"verdict": "error", "reason": _why(e)}, snap, config={"split": "seen", "tier": tier})
+            self._record("equiv", "equiv", args, {"verdict": "error", "reason": _why(e),
+                                                  "artifacts": self._store(work, equiv_rows(out))},
+                         snap, config={"split": "seen", "tier": tier})
             return f"equiv failed: {_why(e)}"
         passed = {"pass": True, "fail": False}.get(res["verdict"])     # inconclusive is None: neither passing nor failing
         record = {"verdict": res["verdict"], "passed": passed, "reasons": res["reasons"], "gates": res["gates"],
-                  "metrics": res["metrics"], "thresholds": res["thresholds"], "tier": tier}
+                  "metrics": res["metrics"], "thresholds": res["thresholds"], "tier": tier,
+                  "artifacts": self._store(work, equiv_rows(out))}
         self._record("equiv", "equiv", args, record, snap, config={"split": "seen", "tier": tier})
         return json.dumps({"snapshot": snap.id, "tier": tier, "verdict": res["verdict"], "reasons": res["reasons"],
                            "metrics": res["metrics"]}, indent=1, default=str)
@@ -184,8 +213,14 @@ def submit(self, args: dict) -> str:
             base_seen = self.base_seen(t, names)
             guard = self.holdout_guard()
             tree = self._pristine()
-            with serve.Served(tree, t.engine, log=self.s.run_dir / "serve-submit.log", jailed=self.serve_jailed) as srv:
-                results = run_regimes(srv.url, t, names, "heldout", "full", self.seed)
+            # held-out passive data stays operator-only: never a blob, never in the record, never inside the jail
+            private, rows = self.s.run_dir / "heldout-private" / f"{snap.id}-{time.strftime('%Y%m%dT%H%M%S')}", []
+            try:
+                with serve.Served(tree, t.engine, log=self.s.run_dir / "serve-submit.log", jailed=self.serve_jailed,
+                                  artifacts=private) as srv:
+                    results = run_regimes(srv.url, t, names, "heldout", "full", self.seed, rows)
+            finally:
+                artifacts.write_rows(private, rows)
             new = headline(results)
             metrics, better = {}, {}
             for n in names:
@@ -219,6 +254,14 @@ def encoder(self, t: target.Target):
         from correctness.run import HFEncoder
         return getattr(self.s, "encoder", None) or HFEncoder(t.model, t.chat_kwargs)
 
+    def _work(self, tool: str) -> Path:
+        """A scratch dir outside the jail for one served run's passive data; emptied into blobs by `_store`."""
+        return Path(tempfile.mkdtemp(prefix=f"passive-{tool}-", dir=self.s.run_dir))
+
+    def _store(self, work: Path, rows: list[dict]) -> dict:
+        artifacts.write_rows(work, rows)
+        return artifacts.store(work, self.s.ledger_root)
+
     def holdout_guard(self) -> HoldoutGuard:
         seed = os.environ.get("LAB_HOLDOUT_SEED") or f"{self.s.ledger_root}"
         return HoldoutGuard(self.s.ledger_root / "holdout_state.json", HOLDOUT_BUDGET, HOLDOUT_THRESHOLD_PCT,
@@ -238,6 +281,22 @@ def _base_measure(self, t: target.Target, names: list[str], split: str, tier: st
             cache.write_text(json.dumps(have, indent=1))
         return have
 
+    def baseline(self, commit: str) -> dict:
+        """The base commit under bench's defaults (seen split, short tier), once per run: a `baseline` record."""
+        have = next(ledger.records(self.s.ledger_root, run=self.s.run_id, kind="baseline"), None)
+        if have:
+            return have
+        names = list(self.bench_default_regimes)
+        self._t0 = time.monotonic()
+        try:
+            seen = self.base_seen(target.load(), names)
+            result = {"verdict": "ok", "metrics": {n: seen[n] for n in names}}
+        except Exception as e:                      # no GPU or a base that will not serve is itself the fact
+            result = {"verdict": "error", "reason": _why(e)}
+        return ledger.append({"kind": "baseline", "run": self.s.run_id, "session": self.s.session_id,
+                              "config": {"split": "seen", "tier": BENCH_TIER, "commit": commit},
+                              "result": result, "cost": self._cost("baseline")}, self.s.ledger_root)
+
     def base_heldout(self, t, names):
         return self._base_measure(t, names, "heldout", "full")
 
diff --git a/lab/gpu.py b/lab/gpu.py
index 7871979..577c188 100644
--- a/lab/gpu.py
+++ b/lab/gpu.py
@@ -1,9 +1,16 @@
-"""NVIDIA GPU state and samples through nvidia-smi. Everything here returns None where there is no nvidia-smi."""
+"""NVIDIA GPU state and samples through nvidia-smi (or DCGM). Everything here returns None where there is no nvidia-smi."""
 
 from __future__ import annotations
 
+import csv
+import functools
+import io
+import json
 import shutil
 import subprocess
+import threading
+import time
+from datetime import datetime
 from pathlib import Path
 
 QUERY = ("name", "driver_version", "clocks.sm", "clocks.mem", "clocks.max.sm", "clocks.max.mem",
@@ -11,36 +18,83 @@
          "memory.used", "memory.total")
 SAMPLE = ("timestamp", "utilization.gpu", "utilization.memory", "clocks.sm", "clocks.mem",
           "power.draw", "temperature.gpu", "memory.used")
+REASONS = ("clocks_event_reasons.active", "clocks_throttle_reasons.active")   # the field's name on newer, older drivers
+APP_CLOCKS = ("clocks.applications.graphics", "clocks.applications.memory")   # locked clocks are not queryable here
+MISSING = ("[N/A]", "[Not Supported]", "N/A")
+# DCGM field ids -> names: profiling counters (not coarse), then power, clocks and throttle reasons.
+DCGM_FIELDS = {1002: "sm_active", 1003: "sm_occupancy", 1004: "tensor_active", 1005: "dram_active",
+               1009: "pcie_tx_bytes", 1010: "pcie_rx_bytes", 155: "power_w", 100: "sm_clock_mhz",
+               101: "mem_clock_mhz", 112: "throttle_reasons"}
 
 
 def available() -> bool:
     return shutil.which("nvidia-smi") is not None
 
 
+def _smi(fields: tuple[str, ...]) -> str | None:
+    out = subprocess.run(["nvidia-smi", f"--query-gpu={','.join(fields)}", "--format=csv,noheader,nounits",
+                          "-i", "0"], capture_output=True, text=True)
+    return out.stdout if out.returncode == 0 else None
+
+
+@functools.lru_cache(maxsize=None)
+def supported(field: str) -> bool:
+    """Whether this driver accepts `field`: one unknown field fails the whole query."""
+    return available() and _smi((field,)) is not None
+
+
+def reasons_field() -> str | None:
+    return next((f for f in REASONS if supported(f)), None)
+
+
 def query() -> dict | None:
-    """One snapshot of the first GPU: identity, clocks and limits. The clock state that travels with a number."""
+    """One snapshot of the first GPU: identity, clocks, limits, throttle reasons; None for what the driver lacks."""
     if not available():
         return None
-    out = subprocess.run(["nvidia-smi", f"--query-gpu={','.join(QUERY)}", "--format=csv,noheader,nounits",
-                          "-i", "0"], capture_output=True, text=True)
-    if out.returncode != 0:
+    reasons = reasons_field()
+    extra = tuple(f for f in ((reasons,) if reasons else ()) + APP_CLOCKS if supported(f))
+    out = _smi(QUERY + extra)
+    if out is None:
         return None
-    return dict(zip(QUERY, [v.strip() for v in out.stdout.strip().split(",")]))
+    got = {k: (None if v in MISSING else v)
+           for k, v in zip(QUERY + extra, [v.strip() for v in out.strip().split(",")])}
+    snap = {k: got.get(k) for k in QUERY + APP_CLOCKS}
+    snap[REASONS[0]] = got.get(reasons) if reasons else None
+    return snap
+
+
+def add_epoch(raw: str) -> str:
+    """nvidia-smi's local-time `timestamp` column, prefixed with `epoch_s` so samples line up with timeline events."""
+    buf = io.StringIO()
+    w = csv.writer(buf, lineterminator="\n")
+    for i, row in enumerate(r for r in csv.reader(io.StringIO(raw), skipinitialspace=True) if r):
+        if i == 0:
+            w.writerow(["epoch_s", *row])
+            continue
+        try:
+            epoch = f"{datetime.strptime(row[0], '%Y/%m/%d %H:%M:%S.%f').timestamp():.3f}"
+        except ValueError:
+            epoch = ""
+        w.writerow([epoch, *row])
+    return buf.getvalue()
 
 
 class Sampler:
-    """nvidia-smi sampling into a CSV at `interval_ms`, as a subprocess so it costs the engine nothing."""
+    """nvidia-smi sampling at `interval_ms`, as a subprocess so it costs the engine nothing; `epoch_s` added on stop."""
 
     def __init__(self, path: Path, interval_ms: int = 100):
         self.path, self.interval_ms, self._proc = Path(path), interval_ms, None
+        self._raw = self.path.with_suffix(".smi.csv")
 
     def start(self) -> bool:
         if not available():
             return False
-        self._file = open(self.path, "w")
+        reasons = reasons_field()
+        self._file = open(self._raw, "w")
         self._proc = subprocess.Popen(
-            ["nvidia-smi", f"--query-gpu={','.join(SAMPLE)}", "--format=csv,nounits",
-             "-lms", str(self.interval_ms), "-i", "0"], stdout=self._file, stderr=subprocess.DEVNULL)
+            ["nvidia-smi", f"--query-gpu={','.join(SAMPLE + ((reasons,) if reasons else ()))}",
+             "--format=csv,nounits", "-lms", str(self.interval_ms), "-i", "0"],
+            stdout=self._file, stderr=subprocess.DEVNULL)
         return True
 
     def stop(self) -> None:
@@ -56,3 +110,54 @@ def stop(self) -> None:
         finally:
             self._file.close()
             self._proc = None
+        self.path.write_text(add_epoch(self._raw.read_text()))
+        self._raw.unlink()
+
+
+class DeviceSampler(Sampler):
+    """Samples for a whole served window into `dir`: `samples.csv` (each tool line prefixed `<epoch_s>,`) and
+    `meta.json` (source, fields, coarse). DCGM profiling fields when `dcgmi` is on PATH, else nvidia-smi with
+    throttle reasons; `{"available": false}` with neither."""
+
+    def __init__(self, dir: Path, interval_ms: int = 100):
+        super().__init__(Path(dir) / "samples.csv", interval_ms)
+        self.source = "dcgm" if shutil.which("dcgmi") else "nvidia-smi" if available() else None
+        self.fields = (list(DCGM_FIELDS.values()) if self.source == "dcgm"
+                       else [*SAMPLE, *([reasons_field()] if reasons_field() else [])] if self.source else [])
+
+    def start(self) -> bool:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        if self.source is None:
+            return False
+        argv = (["dcgmi", "dmon", "-i", "0", "-d", str(self.interval_ms), "-e", ",".join(map(str, DCGM_FIELDS))]
+                if self.source == "dcgm" else
+                ["nvidia-smi", f"--query-gpu={','.join(self.fields)}", "--format=csv,nounits",
+                 "-lms", str(self.interval_ms), "-i", "0"])
+        self._file = open(self.path, "w")
+        self._proc = subprocess.Popen(argv, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True)
+        self._reader = threading.Thread(target=self._stamp, args=(self._proc, self._file), daemon=True)
+        self._reader.start()
+        return True
+
+    @staticmethod
+    def _stamp(proc, out) -> None:
+        for line in proc.stdout:
+            out.write(f"{time.time():.3f},{line.rstrip()}\n")
+
+    def stop(self) -> None:
+        meta = {"available": self.source is not None}
+        if self.source:
+            meta.update(source=self.source, coarse=self.source == "nvidia-smi", fields=self.fields,
+                        interval_ms=self.interval_ms, line="<epoch_s>,<raw tool output line>")
+            if self._proc is not None and self._proc.poll() is not None:
+                meta["exited"] = self._proc.returncode       # the tool died mid-window (e.g. no DCGM host engine)
+            if self._proc is not None:
+                self._proc.terminate()
+                try:
+                    self._proc.wait(timeout=5)
+                except subprocess.TimeoutExpired:
+                    self._proc.kill(); self._proc.wait()
+                self._reader.join(timeout=5)            # drain before closing the file it writes
+                self._file.close()
+                self._proc = None
+        (self.path.parent / "meta.json").write_text(json.dumps(meta, indent=1))
diff --git a/lab/ledger.py b/lab/ledger.py
index 8308a7f..ac43837 100644
--- a/lab/ledger.py
+++ b/lab/ledger.py
@@ -17,7 +17,7 @@
 
 SCHEMA = 1
 ROOT = Path(__file__).resolve().parents[1] / "lab" / "ledger"
-KINDS = {"test", "equiv", "bench", "profile", "submit", "finding", "session", "note"}
+KINDS = {"test", "equiv", "bench", "profile", "submit", "finding", "session", "note", "baseline"}
 WRITER_FIELDS = {"id", "at", "schema"}
 # A held-out record is one aggregate per metric and nothing else: these fields, scalar values.
 HELDOUT_FIELDS = {"kind", "config", "metrics", "run", "session", "snapshot", "snapshot_blob", "patch",
diff --git a/lab/profile.py b/lab/profile.py
index baedf49..d458f5d 100644
--- a/lab/profile.py
+++ b/lab/profile.py
@@ -4,10 +4,14 @@
 
 import argparse
 import asyncio
+import contextlib
 import dataclasses
 import json
 import logging
+import os
 import random
+import subprocess
+import sys
 import time
 from pathlib import Path
 
@@ -24,24 +28,83 @@
 logger = logging.getLogger(__name__)
 
 
+COUNTERS = ("total_admitted", "total_completed", "total_rejected", "total_preempted", "total_expired",
+            "total_iteration_errors", "decode_steps", "kv_admit_blocked", "prefill_chunks_processed")
+
+
 def synthetic_prompts(n: int, length: int, vocab: int = 1000, seed: int = 0) -> list[list[int]]:
     rng = random.Random(seed)
     return [[rng.randrange(1, vocab) for _ in range(length)] for _ in range(n)]
 
 
-def _profiler(device: str) -> torch.profiler.profile:
+def warmup_prompts(prompts: list[list[int]], n: int, vocab: int = 1000, seed: int = 1) -> list[list[int]]:
+    """Random ids at the window's prompt lengths: the same shapes get compiled, nothing lands in the prefix cache."""
+    rng = random.Random(seed)
+    return [[rng.randrange(1, vocab) for _ in prompts[i % len(prompts)]] for i in range(n)]
+
+
+def _profiler(device: str) -> tuple[torch.profiler.profile, dict]:
     """All threads: by default the profiler records only the thread that opened it, and the scheduler has its own."""
     acts = [ProfilerActivity.CPU]
     if device.startswith("cuda"):
         acts.append(ProfilerActivity.CUDA)
+    config = {"activities": [a.name for a in acts], "all_threads": True}
     try:
         from torch._C._profiler import _ExperimentalConfig
-        config = _ExperimentalConfig(profile_all_threads=True)
+        exp = _ExperimentalConfig(profile_all_threads=True)
     except (ImportError, TypeError):   # older torch: the trace will miss the scheduler thread
         logger.warning("torch %s cannot profile all threads; trace covers the main thread only",
                        torch.__version__)
-        return torch.profiler.profile(activities=acts)
-    return torch.profiler.profile(activities=acts, experimental_config=config)
+        return torch.profiler.profile(activities=acts), {**config, "all_threads": False}
+    return torch.profiler.profile(activities=acts, experimental_config=exp), config
+
+
+@contextlib.contextmanager
+def _cuda_range(device: str):
+    """cudaProfilerStart/Stop around the window: nsys --capture-range=cudaProfilerApi and ncu --profile-from-start off
+    record only inside it."""
+    on = device.startswith("cuda")
+    if on:
+        torch.cuda.profiler.start()
+    try:
+        yield None
+    finally:
+        if on:
+            torch.cuda.synchronize()
+            torch.cuda.profiler.stop()
+
+
+def _allow_ptrace() -> None:
+    """Let any process of ours read this one: under Yama ptrace_scope 1 only ancestors may, and py-spy is a child."""
+    if sys.platform.startswith("linux"):
+        import ctypes
+        ctypes.CDLL(None).prctl(0x59616D61, ctypes.c_ulong(-1), 0, 0, 0)    # PR_SET_PTRACER, PR_SET_PTRACER_ANY
+
+
+async def _sampled(sched: ContinuousBatchScheduler, prompts: list[list[int]], max_tokens: int, out: Path,
+                   pyspy: tuple[str, float, int]) -> tuple[list, int]:
+    """Repeat the workload for `seconds` while py-spy samples this process; one stack dump halfway. (results, rounds)"""
+    exe, seconds, rate = pyspy
+    _allow_ptrace()
+    pid = str(os.getpid())
+    with open(out / "pyspy-record.log", "w") as log:
+        rec = subprocess.Popen([exe, "record", "--pid", pid, "--duration", str(int(seconds)), "--rate", str(rate),
+                                "--format", "speedscope", "--output", str(out / "pyspy.speedscope.json"),
+                                "--nonblocking"], stdout=log, stderr=log)
+
+    async def dump():
+        await asyncio.sleep(seconds / 2)
+        d = await asyncio.to_thread(subprocess.run, [exe, "dump", "--pid", pid, "--nonblocking"],
+                                    capture_output=True, text=True)
+        (out / "pyspy-dump.txt").write_text(d.stdout + d.stderr)
+    dumper = asyncio.create_task(dump())
+    results, rounds, end = [], 0, time.monotonic() + seconds
+    while time.monotonic() < end:
+        results += await _fire(sched, prompts, max_tokens, f"profile{rounds}")
+        rounds += 1
+    await dumper
+    await asyncio.to_thread(rec.wait, seconds + 60)
+    return results, rounds
 
 
 async def _fire(sched: ContinuousBatchScheduler, prompts: list[list[int]], max_tokens: int,
@@ -52,34 +115,84 @@ async def _fire(sched: ContinuousBatchScheduler, prompts: list[list[int]], max_t
     return await asyncio.gather(*(sched.submit(r) for r in reqs), return_exceptions=True)
 
 
+def stats_delta(start: dict, end: dict) -> dict:
+    """What the window itself did: counter differences, wave sizes included."""
+    d = {k: end[k] - start[k] for k in COUNTERS if k in start and k in end}
+    waves = {k: v - start.get("wave_sizes", {}).get(k, 0) for k, v in end.get("wave_sizes", {}).items()}
+    d["wave_sizes"] = {k: v for k, v in waves.items() if v}
+    return d
+
+
+def outcomes(results: list, max_tokens: int) -> dict:
+    """Per-request outcome counts and output lengths; `short` stopped before max_tokens (EOS or cut: not recorded)."""
+    toks = [len(r) for r in results if not isinstance(r, BaseException)]
+    return {"errors": len(results) - len(toks), "empty": toks.count(0),
+            "short": sum(0 < n < max_tokens for n in toks), "full": toks.count(max_tokens),
+            "tokens_out": ({"total": sum(toks), "min": min(toks), "mean": sum(toks) / len(toks), "max": max(toks)}
+                           if toks else None)}
+
+
 async def run(backend: InferenceBackend, settings: Settings, prompts: list[list[int]],
-              max_tokens: int, out: Path, warmup: int = 1) -> Path:
-    """Profile `prompts` through the served scheduler config on `backend`; return the bundle directory."""
+              max_tokens: int, out: Path, warmup: int | None = None, source: dict | None = None,
+              profiler: str = "torch", pyspy: tuple[str, float, int] | None = None) -> Path:
+    """Profile `prompts` through the served scheduler config on `backend`; return the bundle directory.
+    `warmup` requests (default: as many as the window) are fired together first, outside the window.
+    `profiler`: torch (torch.profiler trace), cuda-range (window marked for nsys/ncu), pyspy (`pyspy` = exe, s, Hz)."""
     out = bundle.new_dir(out)
     device = backend.device_str
+    warmup = len(prompts) if warmup is None else warmup
     timeline = Timeline(out)
     sched = build_scheduler(backend, settings, timeline=timeline)
     sched.start()
     sampler = gpu.Sampler(out / "gpu.csv")
+    prof, prof_config = _profiler(device)
     try:
+        w0 = time.time()
         if warmup:
-            await _fire(sched, prompts[:warmup], max_tokens, "warmup")
+            await _fire(sched, warmup_prompts(prompts, warmup), max_tokens, "warmup")
+        w1 = time.time()
+        peak_before = bundle.device_peaks(device)
+        bundle.reset_peaks(device)
+        mem0, stats0, gpu0 = bundle.device_memory(device), sched.stats(), gpu.query()
         timeline.event("profile_window", state="begin")
         sampler.start()
-        t0 = time.time()
-        with _profiler(device) as prof:
-            results = await _fire(sched, prompts, max_tokens, "profile")
+        t0, rounds = time.time(), 1
+        if profiler == "pyspy":
+            results, rounds = await _sampled(sched, prompts, max_tokens, out, pyspy)
+        elif profiler == "torch":
+            with prof:
+                results = await _fire(sched, prompts, max_tokens, "profile")
+        else:
+            with _cuda_range(device):
+                results = await _fire(sched, prompts, max_tokens, "profile")
         t1 = time.time()
         timeline.event("profile_window", state="end")
+        mem1, stats1, gpu1 = bundle.device_memory(device), sched.stats(), gpu.query()
+        peak_window = bundle.device_peaks(device)
     finally:
         sampler.stop()
         await sched.stop()
-    prof.export_chrome_trace(str(out / "trace.json"))
-    bundle.write_json(out / "memory.json", bundle.device_memory(device))
-    bundle.write_json(out / "stats.json", sched.stats())
-    failed = sum(isinstance(r, BaseException) for r in results)
-    bundle.write_json(out / "meta.json", bundle.meta(device, settings, prompts, max_tokens, t0, t1,
-                                                     failed=failed, warmup=warmup))
+    if profiler == "torch":
+        prof.export_chrome_trace(str(out / "trace.json"))
+        bundle.write_json(out / "ops.json", bundle.ops_table(prof))
+        kernels = bundle.kernels_table(prof.events())
+        if kernels is not None:
+            bundle.write_json(out / "kernels.json", kernels)
+    lifetime = (None if peak_window is None else
+                {k: max(v, (peak_before or {}).get(k, 0)) for k, v in peak_window.items()})
+    bundle.write_json(out / "memory.json", {
+        "device": device, "window_peak": peak_window, "lifetime_peak": lifetime,
+        "host_rss_peak_lifetime_bytes": mem1["peak_host_rss_bytes"],
+        "at_window_start": mem0, "at_window_end": mem1})
+    bundle.write_json(out / "stats.json", {"window_start": stats0, "window_end": stats1,
+                                           "window_delta": stats_delta(stats0, stats1)})
+    done = outcomes(results, max_tokens)
+    bundle.write_json(out / "meta.json", bundle.meta(
+        device, settings, prompts, max_tokens, t0, t1, failed=done["errors"] + done["empty"], outcomes=done,
+        warmup={"requests": warmup, "concurrent": True, "prompts": "random ids at the window's prompt lengths",
+                "max_tokens": max_tokens, "wall_s": w1 - w0},
+        profiler_on=profiler == "torch", profiler={"kind": profiler, **(prof_config if profiler == "torch" else {})},
+        rounds=rounds, gpu={"window_start": gpu0, "window_end": gpu1}, timeline=timeline.stats(), workload=source))
     return out
 
 
@@ -87,12 +200,25 @@ def main(argv: list[str] | None = None) -> int:
     ap = argparse.ArgumentParser(description=__doc__.split("(")[0])
     ap.add_argument("--backend", help="override BACKEND, e.g. custom-mps")
     ap.add_argument("--model", help="override MODEL_NAME")
-    ap.add_argument("--prompts", help="JSON list of prompt strings; synthetic token ids when absent")
+    src = ap.add_mutually_exclusive_group(required=True)
+    src.add_argument("--corpus-class", help="prompts drawn from this corpus class (verified loader)")
+    src.add_argument("--workload", help="JSON from lab.corpus.sample, for a tree without the corpus (the profile tool)")
+    src.add_argument("--prompts", help="JSON list of prompt strings")
+    src.add_argument("--synthetic", action="store_true", help="random token ids of --prompt-len")
+    ap.add_argument("--split", default="seen", choices=("seen", "heldout"))
+    ap.add_argument("--corpus-dir", help="default: this repo's corpus/")
+    ap.add_argument("--enable-thinking", action="store_true", help="chat template thinking on, for corpus prompts")
+    ap.add_argument("--seed", type=int, default=0)
     ap.add_argument("--requests", type=int, default=8)
     ap.add_argument("--prompt-len", type=int, default=64)
     ap.add_argument("--max-tokens", type=int, default=32)
-    ap.add_argument("--warmup", type=int, default=1)
+    ap.add_argument("--warmup", type=int, help="warmup requests, fired together; default: as many as the window")
     ap.add_argument("--out", default="lab/runs")
+    ap.add_argument("--profiler", choices=("torch", "cuda-range", "pyspy"), default="torch",
+                    help="torch: torch.profiler trace; cuda-range: mark the window for nsys/ncu; pyspy: sample with py-spy")
+    ap.add_argument("--seconds", type=float, default=20.0, help="pyspy: how long to sample under load")
+    ap.add_argument("--rate", type=int, default=100, help="pyspy: samples per second")
+    ap.add_argument("--pyspy-bin", default="py-spy")
     args = ap.parse_args(argv)
 
     # The served configuration, from the same env the server reads; only the workload is ours.
@@ -100,14 +226,26 @@ def main(argv: list[str] | None = None) -> int:
     overrides = {k: v for k, v in (("backend_name", args.backend), ("model_name", args.model)) if v}
     settings = dataclasses.replace(settings, **overrides)
     backend, _ = build_backend(settings)
-    if args.prompts:
+    if args.synthetic:
+        prompts = synthetic_prompts(args.requests, args.prompt_len, seed=args.seed)
+        source = {"kind": "synthetic", "prompt_len": args.prompt_len, "seed": args.seed}
+    else:
         from inference_server.tokenizer import Tokenizer
         tok = Tokenizer(settings.model_name, settings.context_window)
-        prompts = [tok.encode_chat(t) for t in json.loads(Path(args.prompts).read_text())]
-    else:
-        prompts = synthetic_prompts(args.requests, args.prompt_len)
-    out = asyncio.run(run(backend, settings, prompts, args.max_tokens, Path(args.out),
-                          warmup=args.warmup))
+        if args.prompts:
+            prompts = [tok.encode_chat(t) for t in json.loads(Path(args.prompts).read_text())]
+            source = {"kind": "prompts", "file": args.prompts}
+        else:
+            if args.workload:
+                w = json.loads(Path(args.workload).read_text())
+            else:
+                from lab import corpus
+                w = corpus.sample(args.corpus_class, args.split, args.seed, args.requests,
+                                  Path(args.corpus_dir) if args.corpus_dir else corpus.CORPUS_DIR)
+            prompts = [tok.encode_messages(m, thinking=args.enable_thinking) for m in w["messages"]]
+            source = {**w["source"], "thinking": args.enable_thinking}
+    out = asyncio.run(run(backend, settings, prompts, args.max_tokens, Path(args.out), warmup=args.warmup,
+                          source=source, profiler=args.profiler, pyspy=(args.pyspy_bin, args.seconds, args.rate)))
     print(out)
     return 0
 
diff --git a/lab/proftools.py b/lab/proftools.py
new file mode 100644
index 0000000..d58a058
--- /dev/null
+++ b/lab/proftools.py
@@ -0,0 +1,160 @@
+"""Instrumented runs of the agent's pristine tree, one tool per instrument. Each wraps lab.profile's workload inside
+the jail with fixed, validated arguments, keeps the raw output as a ledger blob and returns a short raw summary.
+
+  trace     Nsight Systems: timeline of the measured window (.nsys-rep) plus `nsys stats` CSV tables
+  kernel    Nsight Compute: kernels whose name matches a regex (.ncu-rep) plus `ncu --import --csv --page raw`
+  hostprof  py-spy: the engine process sampled for D seconds under a sustained workload (speedscope) plus one dump
+"""
+
+from __future__ import annotations
+
+import re
+import shutil
+import time
+from pathlib import Path
+
+from lab import engine
+from lab.agent import ToolSpec
+
+OUT = "_instr"                      # in the pristine tree: writable in the jail, rebuilt on every call
+NSYS_REPORTS = "cuda_gpu_kern_sum,cuda_api_sum,cuda_gpu_mem_time_sum,nvtx_sum"
+NCU_SETS = ("basic", "full")
+KERNEL_RE = re.compile(r"[\w.*+?|()\[\]{}^$\\:,<>~-]{1,200}")    # regex syntax only: no spaces, quotes, ; & ` or /
+SUMMARY_CHARS = 2000
+WORKLOAD = {"requests": (8, 1, 256), "prompt_len": (64, 1, 32768), "max_tokens": (32, 1, 4096)}
+
+
+def _int(args: dict, name: str, default: int, lo: int, hi: int) -> int:
+    v = args.get(name, default)
+    if isinstance(v, bool) or not isinstance(v, int) or not lo <= v <= hi:
+        raise ValueError(f"{name} must be an integer in [{lo}, {hi}]")
+    return v
+
+
+def workload(args: dict) -> list[str]:
+    """lab.profile's workload flags from validated integers."""
+    return [w for k, (d, lo, hi) in WORKLOAD.items() for w in (f"--{k.replace('_', '-')}", str(_int(args, k, d, lo, hi)))]
+
+
+def kernel_regex(value) -> str:
+    if not isinstance(value, str) or not KERNEL_RE.fullmatch(value) or "$(" in value:
+        raise ValueError("kernel_regex must be 1-200 characters: letters, digits and _.*+?|()[]{}^$\\:,<>~-")
+    try:
+        re.compile(value)
+    except re.error as e:
+        raise ValueError(f"kernel_regex is not a regex: {e}") from None
+    return value
+
+
+def _schema(**extra) -> dict:
+    props = {k: {"type": "integer", "minimum": lo, "maximum": hi, "default": d} for k, (d, lo, hi) in WORKLOAD.items()}
+    props.update(corpus_class={"type": "string"}, seed={"type": "integer"}, synthetic={"type": "boolean"})
+    return {"type": "object", "properties": {**props, **extra}}
+
+
+def _head(path: Path | None) -> str:
+    return path.read_text(errors="replace")[:SUMMARY_CHARS] if path and path.is_file() and not path.is_symlink() else ""
+
+
+class ProfTools:
+    """Mixin for lab.tools.Toolbox: needs self._audited, self._pristine, self._record, self._keep."""
+
+    def trace(self, args: dict) -> str:
+        wl = workload(args)
+        wrap = lambda exe, out: [exe, "profile", "--output", str(out / "trace"), "--force-overwrite", "true",
+                                 "--trace", "cuda,nvtx,osrt", "--capture-range", "cudaProfilerApi",
+                                 "--capture-range-end", "stop", "--stats", "false"]
+        post = lambda exe, out: ([exe, "stats", "--report", NSYS_REPORTS, "--format", "csv", "--output",
+                                  str(out / "stats"), str(out / "trace.nsys-rep")], None)
+        return self._instrumented("trace", args, "nsys", wrap, wl + ["--profiler", "cuda-range"], post,
+                                  "stats_cuda_gpu_kern_sum.csv")
+
+    def kernel(self, args: dict) -> str:
+        rx = kernel_regex(args.get("kernel_regex"))
+        skip, count = _int(args, "launch_skip", 0, 0, 100000), _int(args, "launch_count", 8, 1, 64)
+        kset = args.get("set", "basic")
+        if kset not in NCU_SETS:
+            raise ValueError(f"set must be one of {NCU_SETS}")
+        wl = workload(args)
+        wrap = lambda exe, out: [exe, "--export", str(out / "kernel"), "--force-overwrite", "--kernel-name",
+                                 f"regex:{rx}", "--launch-skip", str(skip), "--launch-count", str(count), "--set", kset,
+                                 "--profile-from-start", "off", "--target-processes", "all"]
+        post = lambda exe, out: ([exe, "--import", str(out / "kernel.ncu-rep"), "--csv", "--page", "raw"],
+                                 out / "metrics.csv")
+        return self._instrumented("kernel", args, "ncu", wrap, wl + ["--profiler", "cuda-range"], post, "metrics.csv")
+
+    def hostprof(self, args: dict) -> str:
+        wl = workload(args)
+        seconds, rate = _int(args, "seconds", 20, 1, 300), _int(args, "rate", 100, 1, 1000)
+        extra = lambda exe: ["--profiler", "pyspy", "--seconds", str(seconds), "--rate", str(rate), "--pyspy-bin", exe]
+        return self._instrumented("hostprof", args, "py-spy", lambda exe, out: [], wl, None,
+                                  "bundle/*/pyspy-dump.txt", extra)
+
+    def _instrumented(self, tool: str, args: dict, binary: str, wrap, flags: list[str], post, summary: str,
+                      extra=lambda exe: []) -> str:
+        """`wrap(exe, out)` + lab.profile `flags`, jailed with the instrument readable; then `post`, jailed too
+        (the report was written by agent code). Kept as one blob; the head of `summary` is returned."""
+        from lab import tools as T
+        snap = self._audited(tool, args)
+        exe = shutil.which(binary)
+        if not exe:
+            reason = f"{binary} is not on PATH on this host"
+            self._record("note", tool, args, {"verdict": "refused", "reason": reason}, snap)
+            return f"{tool} refused: {reason}"
+        exe = str(Path(exe).resolve())
+        tree = self._pristine()
+        out = tree / OUT
+        out.mkdir()
+        harness = T.stage_harness(tree)
+        read = [Path(exe).parent]
+        src = T.workload_flags(args, harness, _int(args, "requests", *WORKLOAD["requests"]))
+        argv = [*wrap(exe, out), engine.python(), "-m", "lab.profile", *flags, *src, *extra(exe), "--out", str(out / "bundle")]
+        t0 = time.monotonic()
+        proc = T.default_profile_runner(tree, argv, read=read)
+        log = proc.stdout + proc.stderr
+        commands = [argv]
+        T._drop_links(out)
+        if post and proc.returncode == 0:
+            pargv, dest = post(exe, out)
+            commands.append(pargv)
+            p = T.default_profile_runner(tree, pargv, read=read)
+            if dest:
+                dest.write_text(p.stdout)
+            log += p.stderr if dest else p.stdout + p.stderr
+            proc = p if p.returncode else proc
+            T._drop_links(out)
+        found = sorted(out.glob(summary))
+        head = _head(found[-1] if found else None)
+        blob, visible = self._keep(out) if any(p.is_file() for p in out.rglob("*")) else ("", "")
+        result = {"returncode": proc.returncode, "bundle": blob, "workspace_copy": visible, "instrument": exe,
+                  "argv": commands, "seconds": time.monotonic() - t0, "output": log[-3000:]}
+        self._record("profile", tool, args, result, snap)
+        if proc.returncode != 0 or not head:
+            return f"{tool} failed ({proc.returncode}):\n{result['output']}"
+        return f"{tool} output at {visible} (in your workspace; left out of your change)\n{head}"
+
+    def prof_specs(self, gpu) -> list[ToolSpec]:
+        """`gpu(time)` renders the cost fact for a description."""
+        return [
+            ToolSpec("trace", "Run the profile workload of your current workspace under Nsight Systems (nsys), "
+                     "capturing the measured window only. Stores the .nsys-rep and `nsys stats` CSV tables (GPU "
+                     "kernels, CUDA API, memory copies, NVTX) in the ledger; returns the head of the kernel table. "
+                     "Refused where nsys is not installed." + gpu("3-6 min (engine start, workload, report export)"),
+                     _schema(), self.trace),
+            ToolSpec("kernel", "Run the profile workload under Nsight Compute (ncu) on the kernels whose name "
+                     "matches `kernel_regex`: skips `launch_skip` matching launches, then profiles `launch_count` "
+                     "with metric set `set`. Stores the .ncu-rep and its raw metrics CSV in the ledger; returns the "
+                     "head of the CSV. Refused where ncu is not installed."
+                     + gpu("5-20 min (every profiled launch is replayed once per metric pass; set=full has the most)"),
+                     _schema(kernel_regex={"type": "string", "maxLength": 200},
+                             launch_skip={"type": "integer", "minimum": 0, "maximum": 100000, "default": 0},
+                             launch_count={"type": "integer", "minimum": 1, "maximum": 64, "default": 8},
+                             set={"type": "string", "enum": list(NCU_SETS), "default": "basic"})
+                     | {"required": ["kernel_regex"]}, self.kernel),
+            ToolSpec("hostprof", "Sample the engine process with py-spy for `seconds` while the profile workload "
+                     "repeats (scheduler and backend in process, warmup excluded). Stores a speedscope profile and one "
+                     "stack dump taken halfway in the ledger; returns the head of the dump. Refused where py-spy is "
+                     "not installed." + gpu("2-4 min plus `seconds`"),
+                     _schema(seconds={"type": "integer", "minimum": 1, "maximum": 300, "default": 20},
+                             rate={"type": "integer", "minimum": 1, "maximum": 1000, "default": 100}), self.hostprof),
+        ]
diff --git a/lab/prompts/system.md b/lab/prompts/system.md
index ea47e89..59394a5 100644
--- a/lab/prompts/system.md
+++ b/lab/prompts/system.md
@@ -1,19 +1,29 @@
-You are working inside a lab whose goal is to make an LLM inference engine faster. You have free
-rein over how you work. The engine is the repository you are in: `src/inference_server/`. You may
-read all of it, run it, and change it. You may add new test files under `tests/`. Writes anywhere
-else are refused, and a workspace that strays outside that surface ends the run.
+This lab measures changes to an LLM inference engine.
 
-What the referee measures is yours to call through tools: `test` (lint and the suite, on a clean
-copy of your workspace), `profile` (the engine under a profiler, raw trace returned), `ledger`
-(every record of every attempt so far, yours and earlier runs'), `budget`, `restore`, `note`,
-and `submit`, the only action that can turn a change into a win. `bench`, `equiv` and `submit`
-are not connected yet in this version of the lab; they will tell you so.
+Target ({target})
+- Model: `{model}`.
+- Engine: the repository `{engine}` at the run's base commit. Your working directory is an exported copy of it (no git history).
+- The referee serves the engine with `{launch}`, env {env}.
 
-Everything you do through a tool is recorded with a snapshot of your workspace. Your own
-measurements help you work; they are not evidence. The ledger is memory across sessions: read it
-before repeating something.
+Write surface
+- Add, modify or delete: {write}.
+- Add, never change: {add_only}.
+- Refused even inside those globs: {deny}.
+- Any other write is refused. A workspace holding a write outside this surface ends the run.
 
-Advice, not rules: a number is a fact about a config and a machine; a delta inside the noise is
-not a result; the cheapest check that could falsify an idea is the one to run first. When you
-are done with this run, or have nothing left worth the budget, end with status `stop` and say
-why in `note`.
+Lab tools. Each runs outside your sandbox, snapshots your workspace, and writes a ledger record.
+{tools}
+
+Budget
+- The run has a dollar cap. Dollars are charged for model usage, from the provider's accounting, when a session ends, and for each lab tool's GPU time at the configured rate when the call ends; every record's `cost` holds that call's seconds and dollars.
+- This session is capped at ${session_usd:.2f}, {max_turns} turns and {timeout_s:.0f} s of wall-clock time; lab tool time counts toward the wall clock.
+- No new session starts with less than ${min_session_usd:.2f} left in the run.
+- Each regime a `submit` measures draws up to one query from a held-out query budget of {holdout} shared by every run on this ledger.
+
+Win
+- The task in the brief defines the objective, the constraints and what counts as a win. Only `submit` produces a result that can count.
+- The referee rules a run valid iff a completed `submit` exists whose snapshot also has a completed seen-split `bench`, a passing `test`, a passing full-tier `equiv` and no failing `equiv`, and no record reports a write-surface violation.
+
+Sessions
+- Each session starts with a fresh context and a brief: the task, the budget, the referee's verdict on this run so far, the baseline (the base commit measured by the default `bench`), and the last session record of this run. Every other record is readable with `ledger`.
+- A session ends with a reply of `status` and `note`. `status` is `continue` (another session starts if budget remains) or `stop` (the run ends). `note` is free text for the human; it is recorded and decides nothing.
diff --git a/lab/safety/grader.py b/lab/safety/grader.py
index 9c60ed6..c316d17 100644
--- a/lab/safety/grader.py
+++ b/lab/safety/grader.py
@@ -186,7 +186,7 @@ def run_lint(tree: Path) -> Run:
 
 
 def _jail_argv(tree: Path, argv: list[str], env_extra: dict | None, domains, local_binding: bool = False,
-               tag: str = "") -> tuple[list[str], dict, Path]:
+               tag: str = "", read: list[Path] = ()) -> tuple[list[str], dict, Path]:
     """The wrapped argv, env and private tmp for running `argv` in `tree` as agent code: wiped env, jail around the
     tree and the tmp, weights read-only."""
     tmp = Path(tempfile.mkdtemp(prefix="jail-")).resolve()   # short: srt's sockets live here
@@ -196,7 +196,7 @@ def _jail_argv(tree: Path, argv: list[str], env_extra: dict | None, domains, loc
            "HF_HOME": str(tmp / "hf-home"), "HF_HUB_CACHE": str(HF_HUB), "HF_HUB_OFFLINE": "1",
            **(env_extra or {})}
     config = jail.settings([tree.resolve(), tmp], engine.venv(), list(domains),
-                           readonly=[HF_HUB] if HF_HUB.exists() else [], python=engine.python(),
+                           readonly=([HF_HUB] if HF_HUB.exists() else []) + list(read), python=engine.python(),
                            local_binding=local_binding)
     return jail.wrap(config, tree.with_suffix(f"{tag}.srt.json"), argv), env, tmp
 
@@ -210,9 +210,10 @@ def jailed_popen(tree: Path, argv: list[str], *, env_extra: dict | None = None,
 
 
 def jailed(tree: Path, argv: list[str], *, timeout_s: float, env_extra: dict | None = None,
-           domains: list[str] = ()) -> subprocess.CompletedProcess:
-    """Run `argv` in `tree` as agent code: wiped env, jail around the tree and a private tmp, weights read-only."""
-    wrapped, env, tmp = _jail_argv(tree, argv, env_extra, domains)
+           domains: list[str] = (), read: list[Path] = ()) -> subprocess.CompletedProcess:
+    """Run `argv` in `tree` as agent code: wiped env, jail around the tree and a private tmp, weights and `read`
+    read-only."""
+    wrapped, env, tmp = _jail_argv(tree, argv, env_extra, domains, read=read)
     try:
         return subprocess.run(wrapped, cwd=tree, env=env, capture_output=True, text=True, timeout=timeout_s)
     except subprocess.TimeoutExpired as e:     # a hung suite is a failed run, recorded like any other
diff --git a/lab/serve.py b/lab/serve.py
index c8a296c..9d7bf22 100644
--- a/lab/serve.py
+++ b/lab/serve.py
@@ -1,6 +1,8 @@
 """Serve an engine tree the way the agent cannot tamper with: launched from the pristine copy, inside the jail, on a
 free localhost port, with the target's env; ready when its health path answers 200; torn down with its whole
-process group. `with Served(tree, spec) as s: ... s.url`."""
+process group. `with Served(tree, spec) as s: ... s.url`. With `artifacts`, the run's passive data lands in that dir:
+`device/` (samples for the whole served window), `telemetry/` (files the engine wrote, when the target asks for them)
+and `serve.log` (this run's part of the log)."""
 
 from __future__ import annotations
 
@@ -15,9 +17,11 @@
 import urllib.request
 from pathlib import Path
 
-from lab import engine, target
+from lab import engine, gpu, target
 from lab.safety import grader
 
+TELEMETRY_SUBDIR = "lab-telemetry"        # inside the served tree, the one place a jailed engine may write
+
 
 def free_port() -> int:
     s = socket.socket(); s.bind(("127.0.0.1", 0)); port = s.getsockname()[1]; s.close()
@@ -38,7 +42,8 @@ class NotReady(RuntimeError):
 
 class Served:
     def __init__(self, tree: Path, server: target.Server, log: Path | None = None, port: int | None = None,
-                 timeout_s: float | None = None, env_extra: dict | None = None, jailed: bool = True):
+                 timeout_s: float | None = None, env_extra: dict | None = None, jailed: bool = True,
+                 artifacts: Path | None = None):
         self.tree, self.server = Path(tree), server
         self.port = port or free_port()
         self.url = f"http://127.0.0.1:{self.port}"
@@ -46,6 +51,12 @@ def __init__(self, tree: Path, server: target.Server, log: Path | None = None, p
         self.timeout_s = timeout_s if timeout_s is not None else server.startup_timeout_s
         self.env_extra = {**server.env, **(env_extra or {})}
         self.jailed = jailed
+        self.artifacts = Path(artifacts) if artifacts else None
+        self.telemetry_dir = self.tree.resolve() / TELEMETRY_SUBDIR if self.artifacts and server.telemetry_env else None
+        if self.telemetry_dir:
+            self.env_extra.update({k: v.replace("{dir}", str(self.telemetry_dir)) for k, v in server.telemetry_env.items()})
+        self.sampler: gpu.DeviceSampler | None = None
+        self.log_offset = 0
         self.proc: subprocess.Popen | None = None
         self.tmp: Path | None = None
         self.started_at: float | None = None
@@ -53,6 +64,13 @@ def __init__(self, tree: Path, server: target.Server, log: Path | None = None, p
 
     def __enter__(self) -> "Served":
         argv = argv_for(self.server, self.port)
+        self.log_offset = self.log.stat().st_size if self.log and self.log.exists() else 0
+        if self.artifacts:
+            self.sampler = gpu.DeviceSampler(self.artifacts / "device")
+            self.sampler.start()
+        if self.telemetry_dir:
+            shutil.rmtree(self.telemetry_dir, ignore_errors=True)
+            self.telemetry_dir.mkdir(parents=True)
         out = open(self.log, "ab") if self.log else subprocess.DEVNULL
         self.started_at = time.monotonic()
         if self.jailed:
@@ -97,3 +115,20 @@ def __exit__(self, *exc) -> None:
                     pass
         if self.tmp:
             shutil.rmtree(self.tmp, ignore_errors=True)
+        if self.artifacts:
+            self._collect()
+
+    def _collect(self) -> None:
+        """Device samples closed, telemetry moved out of the tree (empty means none), this run's log copied."""
+        if self.sampler is not None:
+            self.sampler.stop()
+            self.sampler = None
+        if self.telemetry_dir and self.telemetry_dir.is_dir():
+            if any(self.telemetry_dir.iterdir()):
+                shutil.move(self.telemetry_dir, self.artifacts / "telemetry")
+            else:
+                self.telemetry_dir.rmdir()
+        if self.log and self.log.exists():
+            with open(self.log, "rb") as f:
+                f.seek(self.log_offset)
+                (self.artifacts / "serve.log").write_bytes(f.read())
diff --git a/lab/session.py b/lab/session.py
index 49c38e3..d63eb2f 100644
--- a/lab/session.py
+++ b/lab/session.py
@@ -1,4 +1,5 @@
-"""The one loop: while budget remains, start a session with the goal, the ledger and the tools, and record what it did."""
+"""The one loop: measure the base once, then while budget remains, start a session with the task, the baseline and the
+tools, and record what it did."""
 
 from __future__ import annotations
 
@@ -17,7 +18,7 @@
 from lab.tools import Toolbox, clean_pristine
 from lab.workspace import Workspace
 
-SYSTEM = (Path(__file__).parent / "prompts" / "system.md").read_text()
+SYSTEM = (Path(__file__).parent / "prompts" / "system.md").read_text()      # a template, filled by system_prompt
 MIN_SESSION_USD = 0.25
 
 
@@ -48,6 +49,7 @@ class RunConfig:
     max_turns: int = 200
     session_usd: float = 5.0              # per-session cap handed to the provider
     provider: str | None = None
+    baseline: bool = True                 # measure the base commit once per run before the first session
     extra: dict = field(default_factory=dict)
 
 
@@ -64,15 +66,42 @@ def referee(s: Session) -> dict:
     return lab_feedback(recs, s.run_id, str(s.ledger_root), facts)["for_agent"]
 
 
+def system_prompt(t: target.Target, spec: agent.AgentSpec) -> str:
+    """The system prompt from the target spec and the tool specs: what is there and what it costs, nothing advised."""
+    from lab.evaltools import HOLDOUT_BUDGET
+    from lab.safety.surfaces import ALWAYS_DENY
+
+    def globs(g):
+        return ", ".join(f"`{x}`" for x in g) or "nothing"
+    return SYSTEM.format(
+        target=t.name, model=t.model, engine=t.engine_repo.name, launch=t.engine.launch,
+        env=json.dumps(t.engine.env), write=globs(t.write), add_only=globs(t.add_only), deny=globs(ALWAYS_DENY),
+        tools="\n".join(f"- `{x.name}`: {x.description}" for x in spec.tools),
+        session_usd=spec.max_budget_usd, max_turns=spec.max_turns, timeout_s=spec.timeout_s,
+        min_session_usd=MIN_SESSION_USD, holdout=HOLDOUT_BUDGET)
+
+
+def _baseline(s: Session) -> str:
+    b = next(ledger.records(s.ledger_root, run=s.run_id, kind="baseline"), None)
+    if b is None:
+        return "Baseline: not measured in this run."
+    c, r = b["config"], b["result"]
+    head = f"Baseline (base commit {c['commit']}, {c['split']} split, {c['tier']} tier, record {b['id']})"
+    if r["verdict"] != "ok":
+        return f"{head}: not measured; {r['reason']}"
+    return f"{head}:\n{json.dumps(r['metrics'])}"
+
+
 def brief(cfg: RunConfig, s: Session, snapshot_id: str, n: int) -> str:
-    tail = list(ledger.records(s.ledger_root, run=s.run_id))[-30:]
+    last = [r for r in ledger.records(s.ledger_root, run=s.run_id, kind="session")][-1:]
     head = cfg.task.brief() if cfg.task else f"Goal: {cfg.goal}"
     return (f"{head}\n\n"
             f"Run {s.run_id}, session {n}. Budget: ${s.budget.remaining_usd:.2f} of ${s.budget.cap_usd:.2f} left.\n"
             f"Workspace snapshot: {snapshot_id}. Base commit: {cfg.base}.\n\n"
             f"Referee (this run so far):\n{json.dumps(referee(s), default=str)}\n\n"
-            f"Last records of this run ({len(tail)}; the ledger tool has all of them):\n"
-            + "\n".join(json.dumps(r) for r in tail))
+            f"{_baseline(s)}\n\n"
+            f"Last session of this run:\n{json.dumps(last[0]) if last else 'none'}\n\n"
+            "Every record of this and earlier runs is readable with the `ledger` tool.")
 
 
 def _resolve(repo: Path, ref: str) -> str:
@@ -92,6 +121,8 @@ def run(cfg: RunConfig, provider: agent.Provider | None = None) -> dict:
     done = sum(1 for _ in ledger.records(cfg.ledger_root, run=run_id, kind="session"))
     base_files = grader.base_files(cfg.repo, base)
     summary = {"run": run_id, "base": base, "sessions": 0, "stopped": None, "spent_usd": budget.spent_usd}
+    if cfg.baseline:
+        Toolbox(Session(run_id, f"{run_id}-baseline", run_dir, ws, budget, cfg.ledger_root, task=cfg.task)).baseline(base)
 
     for n in range(done + 1, done + cfg.max_sessions + 1):
         if budget.remaining_usd < MIN_SESSION_USD:
@@ -100,10 +131,11 @@ def run(cfg: RunConfig, provider: agent.Provider | None = None) -> dict:
         s = Session(run_id, f"{run_id}-s{n}", run_dir, ws, budget, cfg.ledger_root, task=cfg.task)
         tools = Toolbox(s)
         snap = ws.snapshot()
-        spec = agent.AgentSpec(system=SYSTEM, prompt=brief(cfg, s, snap.id, n), workspace=ws.path,
+        spec = agent.AgentSpec(system="", prompt=brief(cfg, s, snap.id, n), workspace=ws.path,
                                scratch=run_dir / "scratch" / s.session_id, tools=tools.specs(),
                                base_files=base_files, max_turns=cfg.max_turns,
                                max_budget_usd=min(cfg.session_usd, budget.remaining_usd))
+        spec.system = system_prompt(target.load(), spec)
         t0 = time.monotonic()
         try:
             reply = provider.run(spec)
diff --git a/lab/target.py b/lab/target.py
index 190825a..affe662 100644
--- a/lab/target.py
+++ b/lab/target.py
@@ -35,6 +35,7 @@ class Server:
     health: str = "/health"
     api: str = "vllm"
     startup_timeout_s: float = 1800.0
+    telemetry_env: dict = field(default_factory=dict)   # `[engine.telemetry] env`; `{dir}` = where serve collects from
 
 
 @dataclass(frozen=True)
@@ -80,7 +81,7 @@ def _server(d: dict | None) -> Server | None:
     if not d:
         return None
     return Server(d["launch"], dict(d.get("env") or {}), d.get("health", "/health"), d.get("api", "vllm"),
-                  float(d.get("startup_timeout_s", 1800)))
+                  float(d.get("startup_timeout_s", 1800)), dict((d.get("telemetry") or {}).get("env") or {}))
 
 
 def parse(path: Path) -> Target:
diff --git a/lab/tools.py b/lab/tools.py
index f4b8ffd..001ff1f 100644
--- a/lab/tools.py
+++ b/lab/tools.py
@@ -9,13 +9,27 @@
 from pathlib import Path
 from typing import Any
 
-from lab import engine, ledger
+from lab import corpus, engine, ledger, target
 from lab.agent import ToolSpec
+from lab.budget import Budget, BudgetExceeded, gpu_rate
 from lab.evaltools import EvalTools
+from lab.proftools import ProfTools
 from lab.safety import grader
 
+# Tools that occupy the GPU: their wall time is charged at the venue's rate. The rest cost $0.
+GPU_TOOLS = frozenset({"profile", "trace", "kernel", "hostprof", "bench", "equiv", "submit", "baseline"})
 
-class Toolbox(EvalTools):
+
+def _drop_links(root: Path) -> None:
+    """Remove symlinks the jailed run left in its output: copied outside the jail they would read anything."""
+    if root.is_symlink():
+        raise PermissionError(f"{root.name}: output is a symlink")
+    for p in root.rglob("*"):
+        if p.is_symlink():
+            p.unlink()
+
+
+class Toolbox(EvalTools, ProfTools):
     """Bound to one session: knows the workspace, the budget, the ledger root and the run."""
 
     def __init__(self, session: Any):
@@ -23,25 +37,39 @@ def __init__(self, session: Any):
         self.violation: str | None = None
 
     # -- plumbing ------------------------------------------------------------------------
-    def _record(self, kind: str, tool: str, args: dict, result: dict, snapshot, usd: float = 0.0,
-                config: dict | None = None) -> dict:
+    def _cost(self, tool: str) -> dict:
+        """Wall seconds since the call began; a GPU tool charges them at the venue rate to the run's budget."""
+        seconds = time.monotonic() - getattr(self, "_t0", time.monotonic())
+        if tool not in GPU_TOOLS:
+            return {"usd": 0.0, "seconds": seconds}
+        rate, known = gpu_rate()
+        usd = Budget.gpu_usd(seconds, rate)
+        try:
+            self.s.budget.charge(usd, tool)
+        except BudgetExceeded:              # the GPU time is already spent; the next GPU tool call is refused
+            self.s.budget.spent_usd += usd
+        return {"usd": usd, "seconds": seconds, "gpu_seconds": seconds, "usd_per_hour": rate, "rate_known": known}
+
+    def _record(self, kind: str, tool: str, args: dict, result: dict, snapshot, config: dict | None = None) -> dict:
         body = {"kind": kind, "run": self.s.run_id, "session": self.s.session_id, "tool": tool,
                 "args": args, "snapshot": snapshot.id, "snapshot_blob": snapshot.blob,
-                "patch": snapshot.patch, "result": result, "cost": {"usd": usd}}
+                "patch": snapshot.patch, "result": result, "cost": self._cost(tool)}
         if config:
             body["config"] = config
         return ledger.append(body, self.s.ledger_root)
 
-    def _record_heldout(self, kind: str, tool: str, args: dict, config: dict, metrics: dict, snapshot,
-                        usd: float = 0.0) -> dict:
+    def _record_heldout(self, kind: str, tool: str, args: dict, config: dict, metrics: dict, snapshot) -> dict:
         """A held-out result: top-level config + one aggregate per metric, the only shape the ledger accepts."""
         body = {"kind": kind, "run": self.s.run_id, "session": self.s.session_id, "tool": tool, "args": args,
                 "snapshot": snapshot.id, "snapshot_blob": snapshot.blob, "patch": snapshot.patch,
-                "config": {**config, "split": "heldout"}, "metrics": metrics, "cost": {"usd": usd}}
+                "config": {**config, "split": "heldout"}, "metrics": metrics, "cost": self._cost(tool)}
         return ledger.append(body, self.s.ledger_root)
 
     def _audited(self, tool: str, args: dict):
         """Snapshot, and stop the run on a surface violation: integrity failures are the one hard rule."""
+        self._t0 = time.monotonic()
+        if tool in GPU_TOOLS and self.s.budget.remaining_usd <= 0 and gpu_rate()[0] > 0:
+            raise BudgetExceeded(f"{tool}: no budget left for GPU time")
         snap = self.s.workspace.snapshot()
         if snap.violations:
             self.violation = "; ".join(snap.violations)
@@ -55,6 +83,17 @@ def _pristine(self) -> Path:
         grader.pristine_tree(self.s.workspace.repo, self.s.workspace.base, self.s.workspace.path, a, dest)
         return dest
 
+    def _keep(self, src: Path) -> tuple[str, str]:
+        """`src` into the ledger as a blob, and a copy in the workspace: the ledger is outside the jail, so the agent
+        could not read it there. Returns (blob, workspace-relative copy)."""
+        _drop_links(src)
+        blob = ledger.put_blob(src, self.s.ledger_root)
+        visible = Path("lab") / "runs" / Path(blob).name
+        dest = self.s.workspace.path / visible
+        shutil.rmtree(dest, ignore_errors=True)
+        shutil.copytree(src, dest)
+        return blob, str(visible)
+
     # -- tools ---------------------------------------------------------------------------
     def test(self, args: dict) -> str:
         snap = self._audited("test", args)
@@ -73,27 +112,22 @@ def profile(self, args: dict) -> str:
         snap = self._audited("profile", args)
         tree = self._pristine()
         out = tree / "lab" / "runs"
-        stage_harness(tree)
-        argv = [engine.python(), "-m", "lab.profile", "--requests", str(args.get("requests", 8)),
-                "--prompt-len", str(args.get("prompt_len", 64)), "--max-tokens", str(args.get("max_tokens", 32)),
-                "--out", str(out)]
+        harness = stage_harness(tree)
+        n = int(args.get("requests", 8))
+        argv = [engine.python(), "-m", "lab.profile", "--requests", str(n),
+                "--max-tokens", str(args.get("max_tokens", 32)), "--out", str(out),
+                *workload_flags(args, harness, n)]
         t0 = time.monotonic()
         proc = (self.s.profile_runner or default_profile_runner)(tree, argv)
         bundles = sorted(out.glob("*")) if out.exists() else []
-        blob = ledger.put_blob(bundles[-1], self.s.ledger_root) if bundles else ""
-        visible = ""
-        if blob:   # a copy inside the workspace: the ledger is outside the jail, so the agent could not read it there
-            dest = self.s.workspace.path / "lab" / "runs" / Path(blob).name
-            shutil.rmtree(dest, ignore_errors=True)
-            shutil.copytree(bundles[-1], dest)
-            visible = str(Path("lab") / "runs" / Path(blob).name)
+        blob, visible = self._keep(bundles[-1]) if bundles else ("", "")
         result = {"returncode": proc.returncode, "bundle": blob, "workspace_copy": visible,
                   "seconds": time.monotonic() - t0, "output": (proc.stdout + proc.stderr)[-3000:]}
         self._record("profile", "profile", args, result, snap)
         if proc.returncode != 0 or not blob:
             return f"profile failed ({proc.returncode}):\n{result['output']}"
         return f"bundle at {visible} (in your workspace; left out of your change)\n" + "\n".join(
-            f"  {p.name}" for p in sorted(dest.iterdir()))
+            f"  {p.name}" for p in sorted((self.s.workspace.path / visible).iterdir()))
 
     def ledger_tool(self, args: dict) -> str:
         match = {k: v for k, v in args.items() if k in ("kind", "session", "snapshot", "tool") and v}
@@ -120,40 +154,78 @@ def note(self, args: dict) -> str:
         return "noted"
 
     def specs(self) -> list[ToolSpec]:
+        """What each tool does, returns and costs; never when or how to use it."""
+        from regimes import suite
+        from lab.evaltools import HOLDOUT_BUDGET
         obj = {"type": "object", "properties": {}}
+        rate, known = gpu_rate()
+        free = " Costs no GPU time ($0)."
+
+        def gpu(t: str) -> str:
+            return (f" Costs GPU time: ~{t} per call, charged at ${rate:g}/h." if known else
+                    f" Costs GPU time: ~{t} per call; no GPU rate is configured on this host, so it is charged $0.")
+        short, full = suite.TIERS["short"], suite.TIERS["full"]
+        windows = (f"one engine start plus, per regime, a {short['final_s']:.0f} s measurement window at tier short or "
+                   f"{full['final_s']:.0f} s at full, plus {short['probe_s']:.0f} s / {full['probe_s']:.0f} s probes for "
+                   f"regimes that search for a load")
         return [
-            ToolSpec("test", "Lint and run the test suite on a pristine copy of your current workspace, "
-                     "inside the referee's jail. Returns pass/fail and the tail of the output.", obj, self.test),
-            ToolSpec("profile", "Run the engine on a synthetic workload under the profiler and store the raw "
-                     "bundle (event timeline, chrome trace, memory, provenance) in the ledger.",
-                     {"type": "object", "properties": {"requests": {"type": "integer"}, "prompt_len": {"type": "integer"},
+            ToolSpec("test", "Lint and run the test suite on a pristine copy of your current workspace, inside the "
+                     "referee's jail. Returns PASS or FAIL, lint and test status, and the tail of each output." + free,
+                     obj, self.test),
+            ToolSpec("profile", "Run the engine in process under the profiler, jailed, on `requests` sampled from a seen "
+                     "corpus class (`corpus_class`, default steady_interactive; `seed`) or on synthetic token ids "
+                     "(`synthetic`, `prompt_len`); `max_tokens` default 32. Stores the raw bundle (event timeline, chrome "
+                     "trace, op and kernel tables, memory, GPU samples, provenance) in the ledger and copies it into your "
+                     "workspace under lab/runs/, left out of your change. Returns the bundle path and its file names."
+                     + gpu("2-5 min (engine start plus the workload)"),
+                     {"type": "object", "properties": {"corpus_class": {"type": "string"}, "seed": {"type": "integer"},
+                                                       "synthetic": {"type": "boolean"}, "requests": {"type": "integer"},
+                                                       "prompt_len": {"type": "integer"},
                                                        "max_tokens": {"type": "integer"}}}, self.profile),
-            ToolSpec("ledger", "Read past records: every tool call in this and earlier runs, with snapshots and results.",
+            ToolSpec("ledger", "Read records of this and earlier runs: every tool call, session and baseline, with "
+                     "snapshots and results. Filters: `kind`, `session`, `snapshot`, `tool`. Returns the `last` N "
+                     "matches (default 20) as JSON lines." + free,
                      {"type": "object", "properties": {"kind": {"type": "string"}, "session": {"type": "string"},
                                                        "snapshot": {"type": "string"}, "tool": {"type": "string"},
                                                        "last": {"type": "integer"}}}, self.ledger_tool),
-            ToolSpec("budget", "Dollars left in this run.", obj, self.budget),
-            ToolSpec("restore", "Put the workspace back to a snapshot id from the ledger ('base' resets it).",
+            ToolSpec("budget", "Returns the run's dollar cap, spent and remaining. Every record's `cost` holds the "
+                     "measured seconds and dollars of that call." + free, obj, self.budget),
+            ToolSpec("restore", "Put the workspace back to a snapshot id from the ledger ('base' resets it to the base "
+                     "commit). Returns the snapshot restored." + free,
                      {"type": "object", "required": ["snapshot"], "properties": {"snapshot": {"type": "string"}}}, self.restore),
-            ToolSpec("note", "Leave a note for the human running the lab. It is recorded and changes nothing.",
+            ToolSpec("note", "Leave a note for the human running the lab. It is recorded and changes nothing." + free,
                      {"type": "object", "required": ["text"], "properties": {"text": {"type": "string"}}}, self.note),
-            ToolSpec("bench", "Serve your current workspace (pristine copy, jailed) and measure it under the load "
-                     "regimes on the seen split. Returns one headline number per regime, raw.",
+            ToolSpec("bench", "Serve a pristine copy of your current workspace (jailed) and measure it under load "
+                     f"regimes on the seen split. `regimes`: default {_names(self.bench_default_regimes)}; 'all'; or "
+                     f"any of {_names(suite.REGIMES)}. `tier`: short (default) or full. Returns one headline per regime "
+                     f"(objective, value, direction, validity), raw. Takes {windows}." + gpu("5-25 min per regime"),
                      {"type": "object", "properties": {"regimes": {"type": "array", "items": {"type": "string"}},
                                                        "tier": {"type": "string", "enum": ["short", "full"]}}}, self.bench),
             ToolSpec("equiv", "Serve your current workspace and run the correctness gate against the reference "
-                     "model. Returns pass, fail or inconclusive with every metric. tier=full is required before submit.",
+                     "model's outputs at `tier` dev (default) or full. Returns pass, fail or inconclusive with every "
+                     "metric. submit requires a passing full-tier equiv on the snapshot. Takes one engine start plus "
+                     "generating the tier's task set." + gpu("10 min at tier dev and 30-60 min at tier full"),
                      {"type": "object", "properties": {"tier": {"type": "string", "enum": ["dev", "full"]}}}, self.equiv),
             ToolSpec("submit", "Measure your current workspace on the held-out split at the full tier and compare it "
-                     "with the base. Needs a passing full-tier equiv and a seen bench on this snapshot. The only "
-                     "thing that can produce a win. Returns one aggregate per regime.",
+                     "with the base commit measured the same way. Needs a passing full-tier equiv and a completed "
+                     "short-tier seen bench on this snapshot. `regimes`: default those of that bench. The only thing "
+                     "that can produce a win. Returns one aggregate per regime (base, new, delta %, noise band %, "
+                     "verdict) and, with a task, its score. Takes one engine start plus a held-out full-tier "
+                     f"measurement per regime, the base commit's held-out measurement once per run, and up to one of the "
+                     f"{HOLDOUT_BUDGET} held-out queries per regime." + gpu("15-25 min per regime"),
                      {"type": "object", "properties": {"regimes": {"type": "array", "items": {"type": "string"}}}},
                      self.submit),
+            *self.prof_specs(gpu),
         ]
 
 
+def _names(names) -> str:
+    return ", ".join(f"`{n}`" for n in names)
+
+
 HARNESS = ("__init__.py", "profile.py", "bundle.py", "gpu.py")     # all lab.profile imports from the environment
 HARNESS_DIR = "_harness"
+DEFAULT_CORPUS_CLASS = "steady_interactive"   # targets name no corpus class of their own
 
 
 def stage_harness(tree: Path) -> Path:
@@ -166,10 +238,21 @@ def stage_harness(tree: Path) -> Path:
     return dest.parent
 
 
-def default_profile_runner(tree: Path, argv: list[str]):
-    """lab.profile in the pristine tree as agent code: jailed, weights read-only, harness first on the path."""
+def workload_flags(args: dict, harness: Path, n: int) -> list[str]:
+    """lab.profile's workload source: synthetic ids if asked, else `n` seen-split corpus requests sampled out here
+    (the jail holds no corpus, and the verified loader needs the held-out split too) and staged in the harness."""
+    if args.get("synthetic"):
+        return ["--synthetic", "--prompt-len", str(args.get("prompt_len", 64))]
+    t = target.load()
+    w = corpus.sample(args.get("corpus_class") or DEFAULT_CORPUS_CLASS, "seen", int(args.get("seed", 0)), n, t.corpus_dir)
+    (harness / "workload.json").write_text(json.dumps(w))
+    return ["--workload", str(harness / "workload.json")] + (["--enable-thinking"] if t.chat_kwargs.get("enable_thinking") else [])
+
+
+def default_profile_runner(tree: Path, argv: list[str], read: list[Path] = ()):
+    """lab.profile in the pristine tree as agent code: jailed, weights and `read` read-only, harness first on the path."""
     path = os.pathsep.join([str(tree / HARNESS_DIR), str(tree / "src"), str(tree)])
-    return grader.jailed(tree, argv, timeout_s=3600, env_extra={"PYTHONPATH": path})
+    return grader.jailed(tree, argv, timeout_s=3600, env_extra={"PYTHONPATH": path}, read=read)
 
 
 def clean_pristine(run_dir: Path) -> None:
diff --git a/lab/trace_contract.py b/lab/trace_contract.py
new file mode 100644
index 0000000..aae4612
--- /dev/null
+++ b/lab/trace_contract.py
@@ -0,0 +1,172 @@
+"""The request-trace contract (lab/TRACE.md): load an engine's trace directory and check every row and file against it."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import math
+import sqlite3
+import sys
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+SCHEMA_VERSION = 1
+TERMINAL_STATES = frozenset({"ok", "rejected_429", "rejected_400", "expired", "preempted", "error",
+                             "cancelled", "aborted"})
+EPOCH_MIN = 946_684_800.0           # 2000-01-01: anything smaller is a monotonic reading, not epoch seconds
+MAX_DURATION_S = 86_400.0           # a request longer than a day is a unit error (ms or ns)
+TPOT_RTOL = 1e-3
+
+REQUIRED = {"schema_version": int, "trace_id": str, "arrival_ts": float, "terminal_state": str,
+            "prompt_tokens": int, "tokens_out": int, "total_s": float, "ttft_s": float, "tpot_s": float}
+NULLABLE = {"ttft_s", "tpot_s"}
+OPTIONAL = {"session_id": str, "config_id": str, "prefill_mode": str, "turn_index": int,
+            "queue_wait_s": float, "prefill_s": float, "decode_s": float, "replica_age_s": float,
+            "pending_depth": int, "active_size": int, "max_batch_size": int, "concurrent_sessions": int,
+            "kv_free_blocks": int, "kv_free_frac": float, "cache_hit_tokens": int, "decode_steps": int,
+            "decode_batch_width_max": int, "preempted": int, "decode_batch_width_mean": float}
+DURATIONS = ("total_s", "ttft_s", "tpot_s", "queue_wait_s", "prefill_s", "decode_s")
+META_KEYS = ("schema_version", "rows_written", "rows_dropped", "closed")
+
+
+@dataclass
+class Report:
+    rows: list[dict] = field(default_factory=list)
+    files: dict[str, dict] = field(default_factory=dict)     # file name -> its meta
+    errors: list[str] = field(default_factory=list)
+
+    @property
+    def valid(self) -> bool:
+        return not self.errors
+
+    @property
+    def rows_dropped(self) -> int:
+        return sum(int(m.get("rows_dropped") or 0) for m in self.files.values())
+
+
+def _typed(v, t) -> bool:
+    if isinstance(v, bool):
+        return False
+    return isinstance(v, (int, float)) and math.isfinite(v) if t is float else isinstance(v, t)
+
+
+def check_row(row: dict, now: float | None = None) -> list[str]:
+    """Every way `row` breaks the contract, as plain sentences; empty when it conforms."""
+    now = time.time() if now is None else now
+    errs = [f"missing {k}" for k in REQUIRED if k not in row]
+    for k, t in {**REQUIRED, **OPTIONAL}.items():
+        v = row.get(k)
+        if v is None:
+            if k in REQUIRED and k in row and k not in NULLABLE:
+                errs.append(f"{k} is null")
+        elif not _typed(v, t):
+            errs.append(f"{k} is {type(v).__name__}, expected {t.__name__}")
+    if errs:
+        return errs
+    if row["schema_version"] != SCHEMA_VERSION:
+        errs.append(f"schema_version {row['schema_version']}, expected {SCHEMA_VERSION}")
+    if not row["trace_id"]:
+        errs.append("trace_id is empty")
+    if row["terminal_state"] not in TERMINAL_STATES:
+        errs.append(f"terminal_state {row['terminal_state']!r} not one of {sorted(TERMINAL_STATES)}")
+    ts = row["arrival_ts"]
+    if ts < EPOCH_MIN:
+        errs.append(f"arrival_ts {ts} is not epoch seconds (a monotonic clock?)")
+    elif ts > now + MAX_DURATION_S:
+        errs.append(f"arrival_ts {ts} is in the future: epoch ms or ns, not seconds?")
+    for k in DURATIONS:
+        v = row.get(k)
+        if v is not None and not 0 <= v <= MAX_DURATION_S:
+            errs.append(f"{k} {v} outside [0, {MAX_DURATION_S:.0f}] s (mixed clocks or units?)")
+    n, ttft, tpot, total = row["tokens_out"], row["ttft_s"], row["tpot_s"], row["total_s"]
+    for k in ("prompt_tokens", "tokens_out"):
+        if row[k] < 0:
+            errs.append(f"{k} is negative")
+    if (n >= 1) != (ttft is not None):
+        errs.append(f"ttft_s must be set exactly when tokens_out >= 1 (tokens_out {n}, ttft_s {ttft})")
+    if ttft is not None and ttft > total * (1 + 1e-9):
+        errs.append(f"ttft_s {ttft} > total_s {total} (mixed units?)")
+    if n >= 2 and ttft is not None:
+        want = (total - ttft) / (n - 1)
+        if tpot is None or abs(tpot - want) > TPOT_RTOL * abs(want) + 1e-9:
+            errs.append(f"tpot_s {tpot} != (total_s - ttft_s) / (tokens_out - 1) = {want:.6g}")
+    elif tpot is not None:
+        errs.append(f"tpot_s {tpot} set with tokens_out {n} (< 2)")
+    qw, pf = row.get("queue_wait_s"), row.get("prefill_s")
+    if ttft is not None and qw is not None and pf is not None and qw + pf > ttft * (1 + 1e-6) + 1e-9:
+        errs.append(f"queue_wait_s + prefill_s = {qw + pf:.6g} > ttft_s {ttft} (mixed units?)")
+    frac = row.get("kv_free_frac")
+    if frac is not None and not 0 <= frac <= 1:
+        errs.append(f"kv_free_frac {frac} outside [0, 1]")
+    hit = row.get("cache_hit_tokens")
+    if hit is not None and not 0 <= hit <= row["prompt_tokens"]:
+        errs.append(f"cache_hit_tokens {hit} outside [0, prompt_tokens {row['prompt_tokens']}]")
+    return errs
+
+
+def _read_sqlite(path: Path) -> tuple[list[dict], dict]:
+    conn = sqlite3.connect(f"file:{path}?mode=ro", uri=True)
+    conn.row_factory = sqlite3.Row
+    try:
+        tables = {r[0] for r in conn.execute("SELECT name FROM sqlite_master WHERE type = 'table'")}
+        rows = [dict(r) for r in conn.execute("SELECT * FROM requests")] if "requests" in tables else None
+        meta = dict(tuple(r) for r in conn.execute("SELECT key, value FROM meta")) if "meta" in tables else None
+    finally:
+        conn.close()
+    return rows, meta
+
+
+def _read_jsonl(path: Path) -> tuple[list[dict], dict | None]:
+    rows = [json.loads(line) for line in path.read_text().splitlines() if line.strip()]
+    meta_path = path.with_name(path.stem + ".meta.json")
+    return rows, (json.loads(meta_path.read_text()) if meta_path.exists() else None)
+
+
+def validate(directory: str | Path, now: float | None = None) -> Report:
+    """Load every trace file in `directory` and check its meta and each row."""
+    d, rep = Path(directory), Report()
+    paths = sorted(d.glob("*.sqlite")) + sorted(d.glob("*.jsonl"))
+    if not paths:
+        rep.errors.append(f"{d}: no *.sqlite or *.jsonl trace files")
+    for p in paths:
+        try:
+            rows, meta = _read_sqlite(p) if p.suffix == ".sqlite" else _read_jsonl(p)
+        except (sqlite3.Error, json.JSONDecodeError, UnicodeDecodeError) as e:
+            rep.errors.append(f"{p.name}: unreadable ({e})")
+            continue
+        if rows is None:
+            rep.errors.append(f"{p.name}: no requests table")
+            continue
+        if meta is None:
+            rep.errors.append(f"{p.name}: no meta (drop counts must be written, never silent)")
+            meta = {}
+        for k in META_KEYS:
+            if k in meta and not _typed(meta[k], int):
+                rep.errors.append(f"{p.name}: meta {k} is {type(meta[k]).__name__}, expected int")
+            elif k not in meta and meta:
+                rep.errors.append(f"{p.name}: meta missing {k}")
+        if meta.get("schema_version") not in (None, SCHEMA_VERSION):
+            rep.errors.append(f"{p.name}: meta schema_version {meta['schema_version']}, expected {SCHEMA_VERSION}")
+        if meta.get("closed") == 1 and meta.get("rows_written") != len(rows):
+            rep.errors.append(f"{p.name}: meta rows_written {meta.get('rows_written')} but {len(rows)} rows")
+        rep.files[p.name] = meta
+        for i, row in enumerate(rows):
+            rep.errors += [f"{p.name} row {i} ({row.get('trace_id')!r}): {e}" for e in check_row(row, now)]
+        rep.rows += rows
+    return rep
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description="Check an engine's request-trace directory against lab/TRACE.md")
+    ap.add_argument("dir")
+    rep = validate(ap.parse_args(argv).dir)
+    for e in rep.errors:
+        print(e)
+    print(f"{'ok' if rep.valid else 'INVALID'}: {len(rep.rows)} rows in {len(rep.files)} files, "
+          f"{rep.rows_dropped} dropped, {len(rep.errors)} errors")
+    return 0 if rep.valid else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/regimes/suite.py b/regimes/suite.py
index b68784c..5da50cf 100644
--- a/regimes/suite.py
+++ b/regimes/suite.py
@@ -47,7 +47,9 @@ class Ctx:
     min_requests: int = 100            # a probe runs until it holds this many: 99% of fewer means little
     interactive: Limits = INTERACTIVE  # MLPerf limits; probes must last well beyond the TTFT limit to see overload
     conversational: Limits = CONVERSATIONAL
+    rows: list | None = None           # when a list, every measured row lands here (no text), tagged with its call
     _pools: dict = field(default_factory=dict)
+    _calls: int = 0
 
     @property
     def probe_s(self) -> float:
@@ -74,11 +76,22 @@ def duration(self, rate: float, final: bool) -> float:
         return min(max(base, self.min_requests / rate), base * MAX_STRETCH)
 
     def run_open(self, reqs):
-        return run_open(self.url, self.model, reqs, self.timeout, self.count_tokens, chat_kwargs=self.chat_kwargs)
+        started = time.time()
+        return self._keep(run_open(self.url, self.model, reqs, self.timeout, self.count_tokens,
+                                   chat_kwargs=self.chat_kwargs), started)
 
     def run_closed(self, reqs, c, duration):
-        return run_closed(self.url, self.model, reqs, c, duration, self.timeout, self.count_tokens,
-                          chat_kwargs=self.chat_kwargs)
+        started = time.time()
+        rows, elapsed = run_closed(self.url, self.model, reqs, c, duration, self.timeout, self.count_tokens,
+                                   chat_kwargs=self.chat_kwargs)
+        return self._keep(rows, started), elapsed
+
+    def _keep(self, rows, started: float):
+        """Rows into the sink: `call` numbers the run_open/run_closed call, `call_started_at` is its epoch start."""
+        if self.rows is not None:
+            self.rows.extend({"call": self._calls, "call_started_at": started, **r.to_dict()} for r in rows)
+            self._calls += 1
+        return rows
 
     @classmethod
     def from_target(cls, t, url: str, **kw) -> "Ctx":
diff --git a/targets/inference-server.toml b/targets/inference-server.toml
index 764d53c..de30fc0 100644
--- a/targets/inference-server.toml
+++ b/targets/inference-server.toml
@@ -19,6 +19,9 @@ add_only = ["tests/test_*.py"]               # what it may add but never change
 test = "python -m pytest -q -p no:cacheprovider -m 'not heavy and not needs_host'"
 lint = "python -m ruff check ."
 
+[engine.telemetry]                           # optional: engine-native files serve collects after teardown
+env = { TELEMETRY_DIR = "{dir}", TIMELINE_DIR = "{dir}/timeline" }   # request rows (lab/TRACE.md); events.jsonl apart
+
 [reference]                                  # the unmodified model the correctness gate compares against
 api = "vllm"
 launch = "vllm serve Qwen/Qwen3-30B-A3B --dtype bfloat16 --served-model-name Qwen/Qwen3-30B-A3B --max-model-len 32768 --port {port}"
diff --git a/tests/fake_engine.py b/tests/fake_engine.py
index ebdbada..2506ebd 100644
--- a/tests/fake_engine.py
+++ b/tests/fake_engine.py
@@ -1,13 +1,15 @@
 """A fake OpenAI-compatible streaming engine with a fixed number of decode slots, for the regime tests.
 
 Requests wait for a free slot (so queueing raises TTFT), then stream one token per `token_s`. With `queue_limit`, a
-request arriving to a full queue gets an explicit 503. Run standalone for the cold-start test:
+request arriving to a full queue gets an explicit 503. With $TELEMETRY_DIR set, each streamed request appends
+{trace_id, tokens_out} to `requests.jsonl` there, like an engine's own per-request rows. Run standalone:
   python tests/fake_engine.py --port N [--delay S]
 """
 from __future__ import annotations
 
 import argparse
 import json
+import os
 import threading
 import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -52,6 +54,9 @@ def do_POST(self):
                 text = ("42" if "17 + 25" in last else ("The answer is (B)." if wrong else "The answer is (C).")
                         if "pick one" in last else " ".join(f"t{i}" for i in range(n)))
                 time.sleep(token_s * n)
+                if os.environ.get("TELEMETRY_DIR"):
+                    with lock, open(os.path.join(os.environ["TELEMETRY_DIR"], "requests.jsonl"), "a") as f:
+                        f.write(json.dumps({"trace_id": self.headers.get("X-Trace-Id"), "tokens_out": n}) + "\n")
                 return self._json({"choices": [{"message": {"role": "assistant", "content": text}, "finish_reason": "stop"}],
                                    "usage": {"completion_tokens": n}})
             with lock:
@@ -74,6 +79,9 @@ def do_POST(self):
                     self._chunk({"choices": [{"index": 0, "delta": {"content": t}}]})
                 self._chunk({"choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}]})
                 self._chunk({"choices": [], "usage": {"completion_tokens": len(text)}})
+                if os.environ.get("TELEMETRY_DIR"):
+                    with lock, open(os.path.join(os.environ["TELEMETRY_DIR"], "requests.jsonl"), "a") as f:
+                        f.write(json.dumps({"trace_id": self.headers.get("X-Trace-Id"), "tokens_out": len(text)}) + "\n")
                 self._chunk(b"[DONE]")
                 self.wfile.write(b"0\r\n\r\n"); self.wfile.flush()
             finally:
diff --git a/tests/test_lab_artifacts.py b/tests/test_lab_artifacts.py
new file mode 100644
index 0000000..68c761b
--- /dev/null
+++ b/tests/test_lab_artifacts.py
@@ -0,0 +1,44 @@
+"""lab.artifacts: blobs round-trip, and client rows join engine rows by trace id (SQLite and JSONL)."""
+from __future__ import annotations
+
+import json
+import sqlite3
+
+from lab import artifacts
+
+
+def test_store_load_and_join(tmp_path):
+    work, root = tmp_path / "work", tmp_path / "ledger"
+    (work / "device").mkdir(parents=True)
+    (work / "device" / "meta.json").write_text(json.dumps({"available": False}))
+    (work / "telemetry").mkdir()
+    con = sqlite3.connect(work / "telemetry" / "run1.sqlite")
+    con.execute("CREATE TABLE requests (trace_id TEXT, queue_wait_s REAL)")
+    con.execute("INSERT INTO requests VALUES ('bg-a', 0.5)")
+    con.commit(); con.close()
+    (work / "telemetry" / "events.jsonl").write_text('{"event": "step"}\n{"trace_id": "bg-b", "tokens_out": 3}\n')
+    (work / "serve.log").write_text("ready\n")
+    artifacts.write_rows(work, [{"id": "a", "ttft_s": 0.1}, {"id": "b"}, {"id": "c"}])
+    a = artifacts.store(work, root)
+    assert not work.exists() and all((root / p).exists() for p in a.values())
+    rec = {"result": {"artifacts": a}}
+    back = artifacts.load(rec, root)
+    assert back["device"] == {"available": False} and back["serve_log"] == "ready\n" and back["device_samples"] is None
+    j = {r["id"]: r["engine"] for r in artifacts.joined(rec, root)}
+    assert j == {"a": {"trace_id": "bg-a", "queue_wait_s": 0.5}, "b": {"trace_id": "bg-b", "tokens_out": 3}, "c": None}
+
+
+def test_absent_telemetry_is_none(tmp_path):
+    work = tmp_path / "work"
+    artifacts.write_rows(work, [])
+    a = artifacts.store(work, tmp_path / "ledger")
+    assert a["telemetry"] is None and a["device"] is None and artifacts.joined({"result": {"artifacts": a}}, tmp_path / "ledger") == []
+
+
+def test_timeline_events_are_not_read_as_request_rows(tmp_path):
+    from lab import artifacts
+    d = tmp_path / "telemetry"; (d / "timeline").mkdir(parents=True)
+    (d / "requests.jsonl").write_text(json.dumps({"trace_id": "bg-1", "tokens_out": 3}) + "\n")
+    (d / "timeline" / "events.jsonl").write_text(json.dumps({"kind": "finish", "trace_id": "bg-1", "step": 4}) + "\n")
+    rows = artifacts.telemetry_rows(d)
+    assert rows == [{"trace_id": "bg-1", "tokens_out": 3}]
diff --git a/tests/test_lab_corpus.py b/tests/test_lab_corpus.py
index 76da4d6..d347ce5 100644
--- a/tests/test_lab_corpus.py
+++ b/tests/test_lab_corpus.py
@@ -24,6 +24,7 @@
     load_manifest,
     load_trace,
     read_trace,
+    sample,
     write_trace,
 )
 
@@ -226,6 +227,18 @@ def test_missing_trace_is_refused(tmp_path):
         load_manifest(tmp_path)
 
 
+def test_sample_is_seeded_and_carries_its_provenance(tmp_path):
+    m = _mini_corpus(tmp_path)
+    write_trace(tmp_path / "cold_start" / "seen.jsonl", [TraceRequest(0.0, f"s{i}", 0, f"p{i}", 64) for i in range(5)])
+    m = build_manifest(m.classes, tmp_path)
+    (tmp_path / "manifest.json").write_text(json.dumps(m.to_dict(), indent=2) + "\n")
+    w = sample("cold_start", "seen", 3, 4, tmp_path)
+    assert w == sample("cold_start", "seen", 3, 4, tmp_path) and len(set(w["source"]["lines"])) == 4
+    assert w["source"] == {"kind": "corpus", "class": "cold_start", "split": "seen", "seed": 3,
+                           "corpus_version": m.corpus_version, "lines": w["source"]["lines"]}
+    assert w["messages"][0] == [{"role": "user", "content": f"p{w['source']['lines'][0]}"}]
+
+
 def test_trace_round_trip(tmp_path):
     reqs = [TraceRequest(0.0, "s-0", 0, "hello", 16),
             TraceRequest(1.5, "s-0", 1, "hello\n\nhi!\n\nmore", 16, expected_output_hash="ab",
diff --git a/tests/test_lab_evaltools.py b/tests/test_lab_evaltools.py
index 5899e61..7fc4bce 100644
--- a/tests/test_lab_evaltools.py
+++ b/tests/test_lab_evaltools.py
@@ -8,7 +8,7 @@
 
 import pytest
 
-from lab import ledger, target
+from lab import ledger, serve, target
 from lab.budget import Budget
 from lab.session import Session
 from lab.tools import Toolbox
@@ -46,6 +46,8 @@ def _target(tmp_path: Path, repo: Path, ref_dir: Path) -> Path:
 add_only = ["tests/test_*.py"]
 test = "python -m pytest -q -p no:cacheprovider"
 lint = "python -m ruff check ."
+[engine.telemetry]
+env = {{ TELEMETRY_DIR = "{{dir}}" }}
 [reference]
 api = "vllm"
 launch = "python {FAKE} --port {{port}}"
@@ -98,12 +100,15 @@ def lab(tmp_path, monkeypatch):
     tb = Toolbox(s)
     tb.serve_jailed = False
     tb.bench_default_regimes = ("single_stream",)
-    saved, think = dict(suite.TIERS["short"]), suite.THINK_S
+    from regimes import runner
+    saved, think, lag = dict(suite.TIERS["short"]), suite.THINK_S, runner.MAX_CLIENT_LAG_S
+    runner.MAX_CLIENT_LAG_S = 0.05      # wiring tests on a shared laptop; client precision has its own test
     suite.TIERS["short"].update(probe_s=1.0, final_s=1.5)
     suite.TIERS["full"].update(probe_s=1.0, final_s=1.5)
     suite.THINK_S = 0.3
     yield tb, s
     suite.TIERS["short"].update(saved); suite.TIERS["full"].update(probe_s=60.0, final_s=600.0); suite.THINK_S = think
+    runner.MAX_CLIENT_LAG_S = lag
     target._cache.clear()
 
 
@@ -117,6 +122,27 @@ def test_bench_serves_and_measures(lab):
     assert rec["result"]["ready_s"] is not None and (s.run_dir / "serve-bench.log").exists()
 
 
+def test_bench_keeps_passive_data_as_blobs(lab):
+    from lab import artifacts, gpu
+    tb, s = lab
+    tb.bench({"regimes": ["single_stream"]})
+    rec = next(ledger.records(s.ledger_root, kind="bench"))
+    a = rec["result"]["artifacts"]
+    assert set(a) == {"device", "telemetry", "client_rows", "serve_log"}
+    assert all((s.ledger_root / p).exists() for p in a.values())
+    back = artifacts.load(rec, s.ledger_root)
+    assert back["device"]["available"] == gpu.available()
+    rows = back["client_rows"]
+    assert len(rows) == rec["result"]["regimes"][0]["summary"]["n"] and {r["regime"] for r in rows} == {"single_stream"}
+    assert "text" not in rows[0]
+    joined = artifacts.joined(rec, s.ledger_root)
+    assert all(j["engine"] and j["engine"]["tokens_out"] == 6 for j in joined)      # every request has its engine row
+    assert not (s.run_dir / "pristine" / serve.TELEMETRY_SUBDIR).exists()          # moved out of the served tree
+    assert not list(s.run_dir.glob("passive-*"))                                     # scratch emptied into blobs
+    contract = json.loads((s.ledger_root / a["telemetry"] / "contract.json").read_text())
+    assert contract["valid"] is False and contract["errors"]      # checked on collection; the fake's rows don't conform
+
+
 def test_equiv_judges_against_the_reference(lab):
     tb, s = lab
     out = json.loads(tb.equiv({}))
@@ -124,6 +150,26 @@ def test_equiv_judges_against_the_reference(lab):
     assert out["metrics"]["accuracy"]["unanswered"] == 0 and "kl_mean" in out["metrics"]["divergence"]
     rec = next(ledger.records(s.ledger_root, kind="equiv"))
     assert rec["result"]["passed"] is True and rec["result"]["tier"] == "dev"
+    from lab import artifacts
+    rows = artifacts.load(rec, s.ledger_root)["client_rows"]
+    assert len(rows) == 40 and all("text" not in r for r in rows)
+    from correctness.run import TRACE_PREFIX
+    joined = artifacts.joined(rec, s.ledger_root, prefix=TRACE_PREFIX)
+    assert all(j["engine"] for j in joined)                    # every gate request has its engine row (X-Trace-Id)
+
+
+def test_submit_keeps_heldout_passive_data_out_of_the_ledger(lab):
+    tb, s = lab
+    tb.equiv({"tier": "full"}); tb.bench({"regimes": ["single_stream"]})
+    before = {p.name for p in (s.ledger_root / "blobs").iterdir()}
+    json.loads(tb.submit({}))
+    rec = next(r for r in ledger.records(s.ledger_root, kind="submit") if r.get("config", {}).get("split") == "heldout")
+    assert rec.keys() - ledger.WRITER_FIELDS <= ledger.HELDOUT_FIELDS and "artifacts" not in json.dumps(rec)
+    assert {p.name for p in (s.ledger_root / "blobs").iterdir()} == before          # no held-out blob of any kind
+    private = list((s.run_dir / "heldout-private").iterdir())
+    assert len(private) == 1 and (private[0] / "client_rows.jsonl").read_text().strip()
+    assert (private[0] / "telemetry" / "requests.jsonl").exists() and (private[0] / "device" / "meta.json").exists()
+    assert not (s.run_dir / "pristine" / serve.TELEMETRY_SUBDIR).exists()
 
 
 def test_submit_needs_full_equiv_and_a_bench_then_records_one_aggregate_per_metric(lab):
@@ -199,3 +245,60 @@ def test_tools_refuse_cleanly_when_the_engine_does_not_start(lab, monkeypatch):
     assert tb.bench({}).startswith("bench failed: engine did not start")
     rec = list(ledger.records(s.ledger_root, kind="bench"))[-1]
     assert rec["result"]["verdict"] == "error"
+    assert rec["result"]["artifacts"]["telemetry"] is None and rec["result"]["artifacts"]["serve_log"]   # no section: skipped
+
+
+class TwoSessions:
+    """Continues once, then stops; keeps each session's spec."""
+    name = "scripted"
+
+    def __init__(self):
+        self.specs = []
+
+    def run(self, spec):
+        from lab.agent import AgentReply
+        self.specs.append(spec)
+        return AgentReply({"status": "continue" if len(self.specs) == 1 else "stop", "note": None}, 0.1, 1, None)
+
+
+def test_baseline_is_measured_once_per_run_and_briefed_with_one_ledger_record(lab, monkeypatch, tmp_path):
+    from lab import evaltools, session
+    tb, s = lab
+    monkeypatch.setattr(evaltools.EvalTools, "bench_default_regimes", ("single_stream",))
+    monkeypatch.setattr(evaltools.EvalTools, "serve_jailed", False)
+    calls = []
+    real = evaltools.run_regimes
+    monkeypatch.setattr(evaltools, "run_regimes", lambda *a, **kw: calls.append(a[2:4]) or real(*a, **kw))
+    cfg = session.RunConfig(goal="g", budget_usd=2.0, repo=s.workspace.repo, runs_dir=tmp_path / "runs",
+                            ledger_root=tmp_path / "led", run_id="rb", max_sessions=2)
+    p = TwoSessions()
+    assert session.run(cfg, p)["sessions"] == 2
+    session.run(cfg, TwoSessions())                       # resumed: still the same baseline
+    assert calls == [(["single_stream"], "seen")]
+    base = list(ledger.records(cfg.ledger_root, kind="baseline"))
+    assert len(base) == 1 and base[0]["result"]["verdict"] == "ok"
+    assert base[0]["cost"]["seconds"] > 0 and "rate_known" in base[0]["cost"]
+    assert base[0]["config"] == {"split": "seen", "tier": "short", "commit": session._resolve(cfg.repo, "HEAD")}
+    assert (tmp_path / "runs" / "rb" / "base-seen-short.json").exists()      # the cache submit compares against
+    first, second = (sp.prompt for sp in p.specs)
+    for prompt in (first, second):
+        line = prompt.split("Baseline (", 1)[1].split("\n")[1]
+        assert json.loads(line)["single_stream"]["value"] == base[0]["result"]["metrics"]["single_stream"]["value"]
+    assert "Last session of this run:\nnone" in first
+    last = json.loads(second.split("Last session of this run:\n", 1)[1].split("\n")[0])
+    assert last["kind"] == "session" and last["session"] == "rb-s1"
+    assert second.count('"id": "ev-') == 1                # one ledger record, nothing else inlined
+
+
+def test_a_base_that_will_not_serve_is_briefed_as_a_fact(lab, monkeypatch, tmp_path):
+    from lab import session
+    tb, s = lab
+    t = target.load()
+    broken = target.Server("python -c 'import sys; sys.exit(3)'", {}, "/health", "vllm", 5.0)
+    monkeypatch.setattr(target, "load", lambda path=None: t.__class__(**{**t.__dict__, "engine": broken}))
+    cfg = session.RunConfig(goal="g", budget_usd=2.0, repo=s.workspace.repo, runs_dir=tmp_path / "runs",
+                            ledger_root=tmp_path / "led", run_id="rx", max_sessions=1)
+    p = TwoSessions()
+    session.run(cfg, p)
+    assert "not measured; engine did not start" in p.specs[0].prompt
+    assert next(ledger.records(cfg.ledger_root, kind="baseline"))["result"]["verdict"] == "error"
diff --git a/tests/test_lab_gpu.py b/tests/test_lab_gpu.py
new file mode 100644
index 0000000..51fdc3c
--- /dev/null
+++ b/tests/test_lab_gpu.py
@@ -0,0 +1,82 @@
+"""lab.gpu against a fake nvidia-smi: field fallbacks, unsupported fields as None, epoch column on the samples."""
+
+from __future__ import annotations
+
+import csv
+import io
+import os
+import stat
+import sys
+import time
+from datetime import datetime
+
+import pytest
+
+from lab import gpu
+
+FAKE = """#!{python}
+import sys, time
+args = sys.argv[1:]
+fields = next(a for a in args if a.startswith("--query-gpu=")).split("=", 1)[1].split(",")
+if any(f in {bad!r} for f in fields):
+    sys.exit(6)
+vals = {{"clocks_throttle_reasons.active": "0x0000000000000004", "clocks.applications.memory": "[N/A]",
+        "timestamp": "2026/10/08 01:02:03.250"}}
+row = ", ".join(vals.get(f, "1") for f in fields)
+if "-lms" in args:
+    print(", ".join(fields), flush=True)
+    while True:
+        print(row, flush=True)
+        time.sleep(0.01)
+print(row)
+"""
+
+
+@pytest.fixture
+def fake_smi(tmp_path, monkeypatch):
+    def install(bad=("clocks_event_reasons.active",)):
+        p = tmp_path / "nvidia-smi"
+        p.write_text(FAKE.format(python=sys.executable, bad=set(bad)))
+        p.chmod(p.stat().st_mode | stat.S_IEXEC)
+        monkeypatch.setenv("PATH", f"{tmp_path}{os.pathsep}{os.environ['PATH']}")
+        gpu.supported.cache_clear()
+    yield install
+    gpu.supported.cache_clear()
+
+
+def test_no_nvidia_smi_is_none(monkeypatch):
+    monkeypatch.setattr(gpu.shutil, "which", lambda _: None)
+    assert gpu.query() is None and gpu.reasons_field() is None
+    assert gpu.Sampler("x.csv").start() is False
+
+
+def test_query_falls_back_to_the_older_throttle_field(fake_smi):
+    fake_smi()
+    q = gpu.query()
+    assert q["clocks_event_reasons.active"] == "0x0000000000000004" and q["name"] == "1"
+    assert q["clocks.applications.graphics"] == "1" and q["clocks.applications.memory"] is None
+
+
+def test_query_without_any_reasons_field_reports_none(fake_smi):
+    fake_smi(bad=gpu.REASONS + ("clocks.applications.graphics",))
+    q = gpu.query()
+    assert q["clocks_event_reasons.active"] is None and q["clocks.applications.graphics"] is None
+    assert q["clocks.sm"] == "1"
+
+
+def test_sampler_writes_epoch_seconds(fake_smi, tmp_path):
+    fake_smi()
+    s = gpu.Sampler(tmp_path / "gpu.csv")
+    assert s.start()
+    time.sleep(0.3)
+    s.stop()
+    rows = list(csv.DictReader(io.StringIO((tmp_path / "gpu.csv").read_text()), skipinitialspace=True))
+    assert rows and not (tmp_path / "gpu.smi.csv").exists()
+    want = datetime(2026, 10, 8, 1, 2, 3, 250000).timestamp()
+    assert float(rows[0]["epoch_s"]) == pytest.approx(want, abs=1e-3)
+    assert rows[0]["clocks_throttle_reasons.active"] == "0x0000000000000004"
+
+
+def test_unparseable_timestamp_leaves_epoch_empty():
+    out = gpu.add_epoch("timestamp, x\nnot a time, 1\n")
+    assert out.splitlines() == ["epoch_s,timestamp,x", ",not a time,1"]
diff --git a/tests/test_lab_profile.py b/tests/test_lab_profile.py
index adabea0..471cd1c 100644
--- a/tests/test_lab_profile.py
+++ b/tests/test_lab_profile.py
@@ -22,6 +22,11 @@ async def test_bundle_is_complete(tmp_path, stub_backend_cls):
 
     meta = json.loads((out / "meta.json").read_text())
     assert meta["requests"] == 4 and meta["max_tokens"] == 3 and meta["failed"] == 0
+    assert meta["outcomes"]["full"] == 4 and meta["outcomes"]["tokens_out"]["total"] == 12
+    assert meta["warmup"]["requests"] == 1 and meta["profiler_on"] is True
+    assert meta["profiler"]["activities"] == ["CPU"] and "all_threads" in meta["profiler"]
+    assert set(meta["gpu"]) == {"window_start", "window_end"}
+    assert meta["timeline"]["events_dropped"] == 0 and meta["timeline"]["events_written"] > 0
     assert meta["workload_hash"] == bundle.workload_hash(prompts, 3)
     assert meta["device"] == "cpu" and meta["window"]["wall_s"] > 0 and meta["torch"]
     assert meta["settings"]["max_batch_size"] == 4
@@ -37,9 +42,124 @@ async def test_bundle_is_complete(tmp_path, stub_backend_cls):
     finished = [e for e in events if e["kind"] == "finish"]
     assert len(finished) == 5          # 1 warmup + 4 profiled
     stats = json.loads((out / "stats.json").read_text())
-    assert stats["total_completed"] == 5 and stats["timeline"]["events_dropped"] == 0
+    assert stats["window_start"]["total_completed"] == 1 and stats["window_end"]["total_completed"] == 5
+    assert stats["window_delta"]["total_completed"] == 4 and stats["window_delta"]["total_admitted"] == 4
+
+    ops = json.loads((out / "ops.json").read_text())
+    assert ops["top"] and {"name", "count", "self_cpu_us", "self_device_us"} <= set(ops["top"][0])
+    assert not (out / "kernels.json").exists()          # no CUDA activity on CPU
+    mem = json.loads((out / "memory.json").read_text())
+    assert mem["window_peak"] is None and mem["host_rss_peak_lifetime_bytes"] > 0
+
+
+@pytest.mark.asyncio
+async def test_warmup_defaults_to_the_window_and_peaks_reset_after_it(tmp_path, stub_backend_cls, monkeypatch):
+    calls = []
+    peaks = iter([{"allocated_bytes": 900, "reserved_bytes": 1000}, {"allocated_bytes": 500, "reserved_bytes": 1200}])
+    monkeypatch.setattr(bundle, "device_peaks", lambda d: calls.append("peak") or next(peaks))
+    monkeypatch.setattr(bundle, "reset_peaks", lambda d: calls.append("reset"))
+    prompts = profile.synthetic_prompts(3, 8)
+    out = await profile.run(stub_backend_cls(), Settings(max_batch_size=4), prompts, max_tokens=2, out=tmp_path)
+    assert calls == ["peak", "reset", "peak"]
+    mem = json.loads((out / "memory.json").read_text())
+    assert mem["window_peak"] == {"allocated_bytes": 500, "reserved_bytes": 1200}
+    assert mem["lifetime_peak"] == {"allocated_bytes": 900, "reserved_bytes": 1200}
+    meta = json.loads((out / "meta.json").read_text())
+    assert meta["warmup"]["requests"] == 3
+    events = [json.loads(l) for l in (out / "events.jsonl").read_text().splitlines()]
+    begin = next(i for i, e in enumerate(events) if e["kind"] == "profile_window")
+    assert sum(e["kind"] == "finish" for e in events[:begin]) == 3
+
+
+def test_warmup_prompts_match_lengths_not_contents():
+    prompts = [[5] * 3, [7] * 9]
+    w = profile.warmup_prompts(prompts, 3)
+    assert [len(p) for p in w] == [3, 9, 3] and not any(p in prompts for p in w)
+
+
+def test_outcomes_count_empty_as_failed_and_short_separately():
+    o = profile.outcomes([[1, 2, 3], [], [1], RuntimeError("x")], max_tokens=3)
+    assert (o["errors"], o["empty"], o["short"], o["full"]) == (1, 1, 1, 1)
+    assert o["tokens_out"] == {"total": 4, "min": 0, "mean": 4 / 3, "max": 3}
+
+
+def test_stats_delta_counts_only_the_window():
+    s0 = {"total_completed": 2, "decode_steps": 10, "active_size": 1, "wave_sizes": {1: 2}}
+    s1 = {"total_completed": 6, "decode_steps": 25, "active_size": 0, "wave_sizes": {1: 2, 4: 1}}
+    assert profile.stats_delta(s0, s1) == {"total_completed": 4, "decode_steps": 15, "wave_sizes": {4: 1}}
+
+
+def test_kernels_table_aggregates_cuda_events_by_name():
+    from types import SimpleNamespace as NS
+    from torch.autograd import DeviceType
+
+    def ev(name, us, dev=DeviceType.CUDA):
+        return NS(name=name, device_type=dev, time_range=NS(elapsed_us=lambda: us))
+    assert bundle.kernels_table([ev("aten::mm", 50, DeviceType.CPU)]) is None
+    k = bundle.kernels_table([ev("gemm", 10), ev("gemm", 30), ev("softmax", 5), ev("aten::mm", 50, DeviceType.CPU)])
+    assert k["launches"] == 3 and k["total_us"] == 45
+    assert k["kernels"][0] == {"name": "gemm", "count": 2, "total_us": 40, "mean_us": 20, "max_us": 30}
+
+
+def test_main_profiles_a_presampled_corpus_workload(tmp_path, stub_backend_cls, monkeypatch):
+    import inference_server.tokenizer as tokmod
+
+    class Tok:
+        def __init__(self, *a): pass
+        def encode_messages(self, msgs, thinking=True):
+            return [len(m["content"]) for m in msgs] + [int(thinking)]
+    monkeypatch.setattr(tokmod, "Tokenizer", Tok)
+    monkeypatch.setattr(profile, "build_backend", lambda s: (stub_backend_cls(), None))
+    w = {"source": {"kind": "corpus", "class": "steady_interactive", "split": "seen", "seed": 0,
+                    "corpus_version": "v", "lines": [0, 1]},
+         "messages": [[{"role": "user", "content": "hi"}], [{"role": "user", "content": "hello"}]]}
+    (tmp_path / "w.json").write_text(json.dumps(w))
+    assert profile.main(["--workload", str(tmp_path / "w.json"), "--max-tokens", "2", "--out", str(tmp_path / "o")]) == 0
+    meta = json.loads(next((tmp_path / "o").glob("*/meta.json")).read_text())
+    assert meta["workload"] == {**w["source"], "thinking": False} and meta["requests"] == 2
+    assert meta["workload_hash"] == bundle.workload_hash([[2, 0], [5, 0]], 2)
+
+
+def test_main_needs_an_explicit_workload_source():
+    with pytest.raises(SystemExit):
+        profile.main([])
 
 
 def test_synthetic_prompts_are_deterministic():
     assert profile.synthetic_prompts(2, 5) == profile.synthetic_prompts(2, 5)
     assert profile.synthetic_prompts(2, 5) != profile.synthetic_prompts(2, 5, seed=1)
+
+
+@pytest.mark.asyncio
+async def test_cuda_range_window_writes_no_torch_trace(tmp_path, stub_backend_cls):
+    out = await profile.run(stub_backend_cls(), Settings(max_batch_size=2), profile.synthetic_prompts(2, 4), max_tokens=2,
+                            out=tmp_path, profiler="cuda-range")
+    assert not (out / "trace.json").exists()
+    assert json.loads((out / "meta.json").read_text())["profiler"]["kind"] == "cuda-range"
+
+
+FAKE_PYSPY = r'''#!/usr/bin/env python3
+import json, sys
+a = sys.argv[1:]
+open(LOG, "a").write(json.dumps(a) + "\n")
+if a[0] == "record":
+    open(a[a.index("--output") + 1], "w").write("{}")
+else:
+    print("Thread 1 (active): MainThread")
+'''
+
+
+@pytest.mark.asyncio
+async def test_pyspy_samples_this_process_under_a_repeated_workload(tmp_path, stub_backend_cls):
+    import os
+    exe = tmp_path / "py-spy"
+    exe.write_text(FAKE_PYSPY.replace("LOG, ", f"{str(tmp_path / 'calls.log')!r}, "))
+    exe.chmod(0o755)
+    out = await profile.run(stub_backend_cls(), Settings(max_batch_size=2), profile.synthetic_prompts(2, 4), max_tokens=2,
+                            out=tmp_path / "b", profiler="pyspy", pyspy=(str(exe), 0.5, 50))
+    rec, dump = [json.loads(line) for line in (tmp_path / "calls.log").read_text().splitlines()]
+    assert rec[:3] == ["record", "--pid", str(os.getpid())] and "--nonblocking" in rec and "speedscope" in rec
+    assert dump == ["dump", "--pid", str(os.getpid()), "--nonblocking"]
+    assert (out / "pyspy.speedscope.json").exists() and "MainThread" in (out / "pyspy-dump.txt").read_text()
+    meta = json.loads((out / "meta.json").read_text())
+    assert meta["profiler"]["kind"] == "pyspy" and meta["rounds"] >= 1 and meta["failed"] == 0
diff --git a/tests/test_lab_proftools.py b/tests/test_lab_proftools.py
new file mode 100644
index 0000000..e7df890
--- /dev/null
+++ b/tests/test_lab_proftools.py
@@ -0,0 +1,221 @@
+"""trace, kernel and hostprof against fake nsys, ncu and py-spy on PATH; and every tool's cost accounting."""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import stat
+import subprocess
+
+import pytest
+
+from lab import ledger, proftools
+from lab import tools as labtools
+from lab.budget import Budget, BudgetExceeded
+from lab.session import Session
+from lab.tools import GPU_TOOLS, Toolbox
+from lab.workspace import Workspace
+from tests.lab_fixtures import make_repo
+
+FAKE = r'''#!/usr/bin/env python3
+"""Fake Nsight / py-spy: every call is appended to LOG (the jail wipes the env); reports are dummies where asked."""
+import json, os, sys
+name, a = os.path.basename(sys.argv[0]), sys.argv[1:]
+open(LOG, "a").write(json.dumps([name] + a) + "\n")
+val = lambda flag: a[a.index(flag) + 1]
+if name == "nsys" and a[0] == "profile":
+    open(val("--output") + ".nsys-rep", "w").write("rep")
+elif name == "nsys" and a[0] == "stats":
+    open(val("--output") + "_cuda_gpu_kern_sum.csv", "w").write("Time (%),Total Time (ns),Instances,Name\n91.0,1000,4,gemm_kernel\n")
+elif name == "ncu" and "--import" in a:
+    print('"ID","Kernel Name","gpu__time_duration.sum"\n"0","gemm_kernel","1234"')
+elif name == "ncu":
+    open(val("--export") + ".ncu-rep", "w").write("rep")
+'''
+INSTRUMENTS = ("nsys", "ncu", "py-spy")
+
+
+@pytest.fixture
+def tb(tmp_path, monkeypatch):
+    monkeypatch.setenv("LAB_NO_JAIL", "1")
+    monkeypatch.setenv("LAB_GPU_USD_PER_HOUR", "3600")          # $1 per second: the charge equals the seconds
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    for name in INSTRUMENTS:
+        (bin_dir / name).write_text(FAKE.replace("LOG, ", f"{str(tmp_path / 'calls.log')!r}, "))
+        (bin_dir / name).chmod(0o755 | stat.S_IEXEC)
+    monkeypatch.setenv("PATH", f"{bin_dir}{os.pathsep}{os.environ['PATH']}")
+    repo = make_repo(tmp_path)
+    ws = Workspace(repo, "HEAD", tmp_path / "ws", tmp_path / "ledger"); ws.create()
+    run_dir = tmp_path / "run"; run_dir.mkdir()
+    s = Session("r1", "r1-s1", run_dir, ws, Budget(100.0), tmp_path / "ledger")
+    return Toolbox(s)
+
+
+def calls(tb):
+    log = tb.s.run_dir.parent / "calls.log"
+    return [json.loads(line) for line in log.read_text().splitlines()] if log.exists() else []
+
+
+def last(tb, **match):
+    return list(ledger.records(tb.s.ledger_root, **match))[-1]
+
+
+def after(argv, flag):
+    return argv[argv.index(flag) + 1]
+
+
+def assert_charged(tb, rec):
+    c = rec["cost"]
+    assert c["rate_known"] is True and c["usd_per_hour"] == 3600.0
+    assert c["usd"] == pytest.approx(c["seconds"]) and c["usd"] > 0 and c["gpu_seconds"] == c["seconds"]
+    assert tb.s.budget.spent_usd == pytest.approx(sum(r["cost"]["usd"] for r in ledger.records(tb.s.ledger_root)))
+
+
+def test_trace_wraps_the_workload_in_nsys_then_exports_stats(tb):
+    out = tb.trace({"requests": 2})
+    assert "gemm_kernel" in out and out.startswith("trace output at lab/runs/")
+    prof, stats = calls(tb)
+    assert prof[:2] == ["nsys", "profile"] and after(prof, "--capture-range") == "cudaProfilerApi"
+    assert after(prof, "-m") == "lab.profile" and after(prof, "--profiler") == "cuda-range"
+    assert after(prof, "--requests") == "2" and after(prof, "--max-tokens") == "32"
+    assert stats[:2] == ["nsys", "stats"] and after(stats, "--report") == proftools.NSYS_REPORTS
+    assert stats[-1].endswith("_instr/trace.nsys-rep")
+    rec = last(tb, kind="profile")
+    assert rec["tool"] == "trace" and rec["result"]["returncode"] == 0
+    blob = tb.s.ledger_root / rec["result"]["bundle"]
+    assert (blob / "trace.nsys-rep").exists() and (blob / "stats_cuda_gpu_kern_sum.csv").exists()
+    assert (tb.s.workspace.path / rec["result"]["workspace_copy"] / "trace.nsys-rep").exists()
+    assert_charged(tb, rec)
+
+
+def test_kernel_targets_the_regex_with_limits_and_keeps_raw_metrics(tb):
+    out = tb.kernel({"kernel_regex": "gemm|fused_moe.*", "launch_count": 4, "launch_skip": 10, "set": "full"})
+    assert "gpu__time_duration.sum" in out
+    prof, imp = calls(tb)
+    assert prof[0] == "ncu" and after(prof, "--kernel-name") == "regex:gemm|fused_moe.*"
+    assert after(prof, "--launch-count") == "4" and after(prof, "--launch-skip") == "10" and after(prof, "--set") == "full"
+    assert after(prof, "--profile-from-start") == "off" and after(prof, "--profiler") == "cuda-range"
+    assert imp[0] == "ncu" and after(imp, "--import").endswith("kernel.ncu-rep") and after(imp, "--page") == "raw"
+    rec = last(tb, kind="profile")
+    blob = tb.s.ledger_root / rec["result"]["bundle"]
+    assert (blob / "kernel.ncu-rep").exists() and "gemm_kernel" in (blob / "metrics.csv").read_text()
+    assert_charged(tb, rec)
+
+
+def test_hostprof_runs_the_workload_with_py_spy_readable_in_the_jail(tb, monkeypatch):
+    seen = {}
+
+    def runner(tree, argv, read=()):            # stands in for lab.profile, which needs the engine
+        seen.update(argv=argv, read=read)
+        b = tree / proftools.OUT / "bundle" / "b1"
+        b.mkdir(parents=True)
+        (b / "pyspy-dump.txt").write_text("Thread 1 (active): MainThread\n  step (scheduler.py:10)\n")
+        (b / "pyspy.speedscope.json").write_text("{}")
+        return subprocess.CompletedProcess(argv, 0, "", "")
+    monkeypatch.setattr(labtools, "default_profile_runner", runner)
+    out = tb.hostprof({"seconds": 5, "rate": 250})
+    assert "MainThread" in out
+    argv, exe = seen["argv"], shutil.which("py-spy")
+    assert argv[1:3] == ["-m", "lab.profile"] and after(argv, "--profiler") == "pyspy"
+    assert after(argv, "--seconds") == "5" and after(argv, "--rate") == "250"
+    assert after(argv, "--pyspy-bin") == os.path.realpath(exe)
+    assert os.path.dirname(os.path.realpath(exe)) in map(str, seen["read"])
+    rec = last(tb, kind="profile")
+    assert rec["tool"] == "hostprof" and (tb.s.ledger_root / rec["result"]["bundle"] / "bundle/b1/pyspy-dump.txt").exists()
+    assert_charged(tb, rec)
+
+
+@pytest.mark.parametrize("tool,args", [("trace", {}), ("kernel", {"kernel_regex": "gemm"}), ("hostprof", {})])
+def test_refused_cleanly_without_the_instrument(tb, monkeypatch, tool, args):
+    real = shutil.which
+    monkeypatch.setattr(proftools.shutil, "which", lambda n, *a, **k: None if n in INSTRUMENTS else real(n, *a, **k))
+    out = getattr(tb, tool)(args)
+    assert out.startswith(f"{tool} refused:") and "not on PATH" in out
+    rec = last(tb, kind="note")
+    assert rec["tool"] == tool and rec["result"]["verdict"] == "refused" and calls(tb) == []
+
+
+@pytest.mark.parametrize("bad", ["gemm; rm -rf /", "$(id)", "`id`", "a b", "x\nid", "a'b", 'a"b', "a&b", "../x",
+                                 "", "a" * 201, "(", None, 7, ["gemm"]])
+def test_kernel_regex_rejects_injection(tb, bad):
+    with pytest.raises(ValueError):
+        tb.kernel({"kernel_regex": bad})
+    assert calls(tb) == [] and not list(ledger.records(tb.s.ledger_root))
+
+
+@pytest.mark.parametrize("tool,args", [
+    ("kernel", {"kernel_regex": "gemm", "set": "full --replay-mode application"}),
+    ("kernel", {"kernel_regex": "gemm", "launch_count": 0}),
+    ("kernel", {"kernel_regex": "gemm", "launch_count": "4; id"}),
+    ("trace", {"requests": True}), ("trace", {"requests": "8 --out /"}), ("trace", {"max_tokens": 10**6}),
+    ("hostprof", {"seconds": 301}), ("hostprof", {"rate": -1}),
+])
+def test_arguments_are_validated_before_anything_runs(tb, tool, args):
+    with pytest.raises(ValueError):
+        getattr(tb, tool)(args)
+    assert calls(tb) == []
+
+
+def test_cost_free_tools_record_wall_time_and_zero(tb):
+    tb.note({"text": "hi"})
+    tb.restore({"snapshot": "base"})
+    for rec in ledger.records(tb.s.ledger_root):
+        assert rec["cost"]["usd"] == 0.0 and rec["cost"]["seconds"] >= 0 and "rate_known" not in rec["cost"]
+    assert tb.s.budget.spent_usd == 0.0
+    assert {"test", "ledger", "budget", "restore", "note"}.isdisjoint(GPU_TOOLS)
+
+
+def test_an_unknown_rate_is_recorded_as_unknown_and_charged_zero(tb, monkeypatch):
+    monkeypatch.delenv("LAB_GPU_USD_PER_HOUR")
+    monkeypatch.setattr(labtools, "default_profile_runner",
+                        lambda tree, argv, read=(): subprocess.CompletedProcess(argv, 1, "", "no engine"))
+    tb.profile({})
+    c = last(tb, kind="profile")["cost"]
+    assert c["usd"] == 0.0 and c["rate_known"] is False and c["seconds"] > 0
+    assert any("no GPU rate is configured" in t.description for t in tb.specs() if t.name == "profile")
+
+
+def test_gpu_time_is_charged_to_the_budget_and_stops_at_the_cap(tb, monkeypatch):
+    monkeypatch.setattr(labtools, "default_profile_runner",
+                        lambda tree, argv, read=(): subprocess.CompletedProcess(argv, 1, "", "no engine"))
+    tb.profile({})
+    spent = tb.s.budget.spent_usd
+    assert spent > 0 and Budget.resume(100.0, "r1", tb.s.ledger_root).spent_usd == pytest.approx(spent)
+    tb.s.budget.spent_usd = tb.s.budget.cap_usd
+    with pytest.raises(BudgetExceeded):
+        tb.trace({})
+    assert calls(tb) == []
+    specs = {t.name: t.description for t in tb.specs()}
+    assert all("Costs GPU time" in specs[n] and "$3600/h" in specs[n] for n in GPU_TOOLS if n in specs)
+    assert all("Costs no GPU time ($0)" in specs[n] for n in specs if n not in GPU_TOOLS)
+
+
+def test_every_instrument_passes_a_workload_source_to_lab_profile(tb):
+    """lab.profile refuses to run without one of --corpus-class/--workload/--prompts/--synthetic."""
+    tb.trace({"requests": 2, "synthetic": True})
+    prof = calls(tb)[0]
+    assert "--synthetic" in prof and after(prof, "--prompt-len") == "64"
+    tb.kernel({"kernel_regex": "gemm", "requests": 2})          # default: the seen corpus, staged in the harness
+    ncu = [c for c in calls(tb) if c[0] == "ncu"][0]
+    wl = after(ncu, "--workload")
+    assert wl.endswith("_harness/workload.json")
+
+
+def test_symlinks_left_by_the_jailed_run_are_not_copied_out(tb, monkeypatch):
+    secret = tb.s.run_dir / "heldout-private" / "rows.jsonl"
+    secret.parent.mkdir()
+    secret.write_text("held-out")
+
+    def runner(tree, argv, read=()):
+        b = __import__("pathlib").Path(after(argv, "--out")) / "b1"
+        b.mkdir(parents=True)
+        (b / "meta.json").write_text("{}")
+        (b / "leak").symlink_to(secret)
+        (b / "dir").symlink_to(secret.parent, target_is_directory=True)
+        return subprocess.CompletedProcess(argv, 0, "", "")
+    monkeypatch.setattr(labtools, "default_profile_runner", runner)
+    tb.profile({"synthetic": True})
+    copy = tb.s.workspace.path / last(tb, kind="profile")["result"]["workspace_copy"]
+    assert sorted(p.name for p in copy.iterdir()) == ["meta.json"]
diff --git a/tests/test_lab_runtime.py b/tests/test_lab_runtime.py
index 77c190d..259badc 100644
--- a/tests/test_lab_runtime.py
+++ b/tests/test_lab_runtime.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import re
 import subprocess
 from pathlib import Path
 
@@ -43,7 +44,8 @@ def cfg(tmp_path, monkeypatch):
     monkeypatch.setenv("LAB_NO_JAIL", "1")
     repo = make_repo(tmp_path)
     return RunConfig(goal="make speed() faster", budget_usd=2.0, repo=repo, base="HEAD",
-                     runs_dir=tmp_path / "runs", ledger_root=tmp_path / "ledger", max_sessions=5)
+                     runs_dir=tmp_path / "runs", ledger_root=tmp_path / "ledger", max_sessions=5,
+                     baseline=False)      # the base is measured in tests/test_lab_evaltools.py, on the fake engine
 
 
 def test_a_session_edits_tests_notes_and_stops(cfg):
@@ -192,7 +194,8 @@ def test_cli_parses(monkeypatch, cfg):
 def test_heldout_results_go_through_the_aggregate_only_writer(cfg):
     from lab.tools import Toolbox
     snap = type("Snap", (), {"id": "x", "blob": "blobs/a", "patch": "blobs/b"})()
-    sess = type("S", (), {"run_id": "r", "session_id": "s", "ledger_root": cfg.ledger_root})()
+    from lab.budget import Budget
+    sess = type("S", (), {"run_id": "r", "session_id": "s", "ledger_root": cfg.ledger_root, "budget": Budget(1.0)})()
     tb = Toolbox(sess)
     m = {"ttft_p50_ms": {"base": 800, "new": 700, "delta_pct": -12.5, "band_pct": 3, "verdict": "win"}}
     rec = tb._record_heldout("submit", "submit", {}, {"class": "steady_interactive"}, m, snap)
@@ -220,5 +223,29 @@ def script(n, ws: Path):
     ref = json.loads(prompt.split("Referee (this run so far):\n", 1)[1].split("\n\n", 1)[0])
     assert ref["integrity"]["valid"] is False and set(ref["facts"]) == {"harness"}
     assert ref["facts"]["harness"]["latency_limits"]["interactive"]["ttft_s"] == 0.5
-    for word in ("should", "try", "recommend", "consider", "better to"):
-        assert word not in prompt.split("Last records")[0].lower()
+    assert "Baseline: not measured in this run." in prompt and "Last session of this run:\nnone" in prompt
+    assert not ADVICE.search(prompt.split("Last session")[0])
+
+
+ADVICE = re.compile(r"\b(should|try|tries|recommend\w*|consider\w*|best|first|cheapest|avoid\w*|prefer\w*|tips?)\b",
+                    re.IGNORECASE)
+
+
+def test_system_prompt_is_generated_from_the_target_and_tools_and_advises_nothing(cfg):
+    from lab import target
+
+    def script(n, ws: Path):
+        yield ("reply", AgentReply({"status": "stop", "note": None}, 0.1, 1, None))
+    p = ScriptedProvider(script)
+    session.run(cfg, p)
+    spec, t = p.specs[0], target.load()
+    system = spec.system
+    for tool in spec.tools:
+        assert f"- `{tool.name}`: {tool.description}" in system
+    assert {x.name for x in spec.tools} >= {"test", "profile", "ledger", "budget", "restore", "note", "bench",
+                                            "equiv", "submit"}
+    for glob in t.write + t.add_only:
+        assert f"`{glob}`" in system
+    assert t.model in system and t.engine_repo.name in system and "`stop`" in system and "`note`" in system
+    assert "{" not in system.replace(t.engine.launch, "").replace(json.dumps(t.engine.env), "")   # all filled
+    assert not ADVICE.search(system), ADVICE.search(system)
diff --git a/tests/test_lab_trace_contract.py b/tests/test_lab_trace_contract.py
new file mode 100644
index 0000000..43abb61
--- /dev/null
+++ b/tests/test_lab_trace_contract.py
@@ -0,0 +1,137 @@
+"""lab.trace_contract: conforming trace dirs pass (JSONL, SQLite, the engine's own writer); bad clocks, ids and units fail."""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+import time
+
+import pytest
+
+from lab import trace_contract as tc
+
+NOW = 1_790_000_000.0
+
+
+def _row(**kw) -> dict:
+    base = dict(schema_version=1, trace_id="bg-1", arrival_ts=NOW - 60, terminal_state="ok", prompt_tokens=10,
+                tokens_out=5, total_s=1.0, ttft_s=0.2, tpot_s=0.2, queue_wait_s=0.05, prefill_s=0.1,
+                session_id="s", cache_hit_tokens=None, prefill_mode="batched")
+    return {**base, **kw}
+
+
+def _meta(n, **kw) -> dict:
+    return {"schema_version": 1, "rows_written": n, "rows_dropped": 0, "closed": 1, **kw}
+
+
+def _jsonl(tmp_path, rows, meta="auto", name="run"):
+    (tmp_path / f"{name}.jsonl").write_text("".join(json.dumps(r) + "\n" for r in rows))
+    if meta is not None:
+        (tmp_path / f"{name}.meta.json").write_text(json.dumps(_meta(len(rows)) if meta == "auto" else meta))
+    return tmp_path
+
+
+def _errors(row) -> list[str]:
+    return tc.check_row(row, now=NOW)
+
+
+def test_conforming_jsonl_dir_passes(tmp_path):
+    rows = [_row(), _row(trace_id="bg-2", tokens_out=1, tpot_s=None), _row(trace_id="bg-3", terminal_state="rejected_429",
+            tokens_out=0, ttft_s=None, tpot_s=None, total_s=0.0, queue_wait_s=None, prefill_s=None)]
+    rep = tc.validate(_jsonl(tmp_path, rows), now=NOW)
+    assert rep.valid, rep.errors
+    assert len(rep.rows) == 3 and rep.rows_dropped == 0
+
+
+def test_conforming_sqlite_in_the_engine_layout_passes(tmp_path):
+    row = _row()
+    conn = sqlite3.connect(tmp_path / "run-x.sqlite")
+    conn.execute(f"CREATE TABLE requests ({', '.join(row)})")
+    conn.execute(f"INSERT INTO requests VALUES ({', '.join('?' * len(row))})", list(row.values()))
+    conn.execute("CREATE TABLE meta (key TEXT PRIMARY KEY, value)")
+    conn.executemany("INSERT INTO meta VALUES (?, ?)", list(_meta(1, rows_dropped=2, run_id="run-x").items()))
+    conn.commit()
+    conn.close()
+    rep = tc.validate(tmp_path, now=NOW)
+    assert rep.valid, rep.errors
+    assert rep.rows_dropped == 2 and rep.rows[0]["trace_id"] == "bg-1"
+
+
+@pytest.mark.parametrize("row,needle", [
+    ({k: v for k, v in _row().items() if k != "trace_id"}, "missing trace_id"),
+    (_row(trace_id=""), "trace_id is empty"),
+    (_row(trace_id=None), "trace_id is null"),
+    (_row(arrival_ts=123_456.7), "not epoch seconds"),                 # perf_counter / uptime
+    (_row(arrival_ts=NOW * 1000), "epoch ms or ns"),                  # epoch milliseconds
+    (_row(ttft_s=200.0), "ttft_s 200.0 > total_s"),                   # ttft in ms, total in s
+    (_row(queue_wait_s=50.0), "queue_wait_s + prefill_s"),            # one span in ms
+    (_row(total_s=-0.5), "outside [0"),                               # wall minus monotonic
+    (_row(total_s=1_000_000.0, ttft_s=200.0, tpot_s=199_950.0), "outside [0"),   # everything in ms... and a day long
+    (_row(tpot_s=0.05), "tpot_s 0.05 != (total_s - ttft_s)"),         # a different TPOT definition
+    (_row(tokens_out=3, ttft_s=None, tpot_s=None), "ttft_s must be set exactly"),
+    (_row(tokens_out=0, tpot_s=None), "ttft_s must be set exactly"),
+    (_row(tokens_out=1), "set with tokens_out 1"),
+    (_row(terminal_state="done"), "terminal_state 'done'"),
+    (_row(schema_version=2), "schema_version 2"),
+    (_row(prompt_tokens="10"), "prompt_tokens is str"),
+    (_row(tokens_out=True), "tokens_out is bool"),
+    (_row(cache_hit_tokens=11), "cache_hit_tokens 11"),
+    (_row(kv_free_frac=1.5), "kv_free_frac 1.5"),
+])
+def test_bad_rows_are_rejected_with_a_reason(row, needle):
+    errs = _errors(row)
+    assert any(needle in e for e in errs), errs
+
+
+def test_a_bad_row_fails_the_dir_and_names_the_file_and_trace(tmp_path):
+    rep = tc.validate(_jsonl(tmp_path, [_row(), _row(trace_id="bg-9", arrival_ts=5.0)]), now=NOW)
+    assert not rep.valid and len(rep.errors) == 1
+    assert rep.errors[0].startswith("run.jsonl row 1 ('bg-9')")
+
+
+def test_drops_must_be_reported(tmp_path):
+    assert "no meta" in " ".join(tc.validate(_jsonl(tmp_path, [_row()], meta=None), now=NOW).errors)
+
+
+def test_meta_missing_a_count_or_disagreeing_with_the_rows_fails(tmp_path):
+    a, b = tmp_path / "a", tmp_path / "b"
+    a.mkdir(), b.mkdir()
+    no_drops = {k: v for k, v in _meta(1).items() if k != "rows_dropped"}
+    assert "meta missing rows_dropped" in " ".join(tc.validate(_jsonl(a, [_row()], meta=no_drops), now=NOW).errors)
+    assert "rows_written 3 but 1 rows" in " ".join(tc.validate(_jsonl(b, [_row()], meta=_meta(3)), now=NOW).errors)
+
+
+def test_open_file_may_lag_its_count(tmp_path):
+    """closed=0: the engine was killed before final counts; the row count is not held against it."""
+    assert tc.validate(_jsonl(tmp_path, [_row()], meta=_meta(0, closed=0)), now=NOW).valid
+
+
+def test_empty_dir_fails_and_cli_exit_codes(tmp_path, capsys):
+    assert tc.main([str(tmp_path)]) == 1
+    _jsonl(tmp_path, [_row(arrival_ts=time.time() - 5)])
+    assert tc.main([str(tmp_path)]) == 0
+    assert capsys.readouterr().out.strip().endswith("ok: 1 rows in 1 files, 0 dropped, 0 errors")
+
+
+def test_inference_server_rows_conform(tmp_path):
+    """The engine's own writer, through its own scheduler-facing API, produces a conforming dir."""
+    telemetry = pytest.importorskip("inference_server.telemetry", reason="needs the engine", exc_type=ImportError)
+    if not hasattr(telemetry, "SCHEMA_VERSION"):
+        pytest.skip("engine predates the trace contract (inference-server#102)")
+    store = telemetry.RowStore(tmp_path)
+    t0 = time.perf_counter()
+    for i, (state, n) in enumerate([("ok", 5), ("ok", 1), ("ok", 0), ("rejected_429", 0), ("cancelled", 2)]):
+        rec = telemetry.RequestRecord(
+            trace_id=f"bg-{i}", session_id="s", turn_index=0, arrival_ts=time.time(), pending_depth=0,
+            active_size=0, max_batch_size=8, kv_free_blocks=10, kv_free_frac=0.5, concurrent_sessions=0,
+            prompt_tokens=10, replica_age_s=1.0)
+        admitted = state != "rejected_429"
+        rec.finish(state, arrival_mono=t0, enqueue_ts=t0 + 0.01, admit_ts=t0 + 0.02 if admitted else 0.0,
+                   first_token_ts=t0 + 0.1 if admitted else 0.0, end_ts=t0 + 0.5, tokens_out=n,
+                   cache_hit_tokens=4 if admitted else None, decode_width_steps=n, decode_width_sum=n,
+                   decode_width_max=1, prefill_mode="batched" if admitted else None)
+        store.put(rec)
+    store.close()
+    rep = tc.validate(tmp_path)
+    assert rep.valid, rep.errors
+    assert len(rep.rows) == 5 and list(rep.files) == [store.path.name]