Work order: execute research follow-ups from the 2026-09-24 sweep

[Xore]

Goal

Execute the concrete follow-ups spawned by the research-label sweep of 2026-09-24. This is the work order; each item below has its own tracking issue and is closed by its own PR.

Source research

• research: honeypot-aware LLM budget allocation — session abandonment measurement #3219 — session-abandonment research findings
• ml: wire Tier 2 (accuracy) into ml-worker/benchmarks — BETH sanity rail + calibration on the #1968/#2395 disposition corpus #2986 — Tier 2 accuracy scoping

Work items (in recommended order)

#	Item	Gate
#3295	Export and census the queryable operator-disposition corpus	Establishes the label gate for all later calibration. Do this first.
#3294	BETH Tier 2 sanity-rail harness in ml-worker/benchmarks/	Bounded, unblocked. Independent of #3295.
#3292	Preserve session terminal observation and capture coverage	Prerequisite for any abandonment-rate denominator.
#3293	Offline session-engagement aggregate with labeled benign baseline	Blocked on #3292.

Sequencing rules

1. ml: export and census the queryable operator-disposition corpus for calibration #3295 before ml: add BETH Tier 2 sanity-rail harness to ml-worker/benchmarks #3294's downstream work. The disposition census tells us whether calibration is reachable at all. The BETH harness itself is independent and can proceed in parallel, but no threshold or weight argument may be derived from either until ml: export and census the queryable operator-disposition corpus for calibration #3295's census is in.
2. llm worker: preserve session terminal observation and capture coverage in state summaries #3292 before research: add an offline session-engagement aggregate with labeled benign coverage #3293. Engagement aggregates are meaningless without a terminal-observation field and a capture-coverage denominator.
3. Calibration is precision-only, never recall. Only above-threshold alerts persist, so the disposition corpus can measure alert precision but not deployment recall. No issue, doc, or commit may claim otherwise.
4. BETH is a sanity rail, not promotion evidence. No change to the composite's 0.4/0.4/0.2 weights or to ML_ALERT_THRESHOLD may be argued from it. Point-adjusted F1 stays banned.
5. Engagement metrics never attribute an attacker. Disconnect is ambiguous across scanners, ordinary clients, deliberate disengagement and network failure. No issue, doc, or commit may label a client as automated/AI from these signals.

Invariants (unchanged by this work)

• frontend-next/public/static/theme.css stays the only stylesheet, vendored from Xore/theme via theme.lock. New styling goes upstream first.
• No AI attribution in commits, PR bodies, or issue comments.
• If a change touches arcane/home/<stack>/, the merge is not live until Arcane is manually resynced — autoSync=false.

Done when

• Each of ml: export and census the queryable operator-disposition corpus for calibration #3295, ml: add BETH Tier 2 sanity-rail harness to ml-worker/benchmarks #3294, llm worker: preserve session terminal observation and capture coverage in state summaries #3292, research: add an offline session-engagement aggregate with labeled benign coverage #3293 has a merged PR or a comment explaining why it is deferred, and this issue is closed.
• docs/ml-worker-evaluation.md carries any new result sets with reproducibility metadata.

[Xore]

Work order complete. All four research follow-ups are landed on main:

• ml: export and census the queryable operator-disposition corpus for calibration #3295 disposition corpus export census — PR feat(ml-worker): add disposition corpus export census #3297
• ml: add BETH Tier 2 sanity-rail harness to ml-worker/benchmarks #3294 BETH Tier 2 sanity-rail harness — PR feat(ml-worker): add BETH Tier 2 sanity rail #3298
• llm worker: preserve session terminal observation and capture coverage in state summaries #3292 terminal observation + capture coverage — landed via feat(llm-worker): record terminal observation coverage #3301, carried in by feat(llm-worker): add offline engagement aggregate #3302 (both closed once feat(llm-worker): add offline engagement aggregate #3302 merged and feat(llm-worker): record terminal observation coverage #3301 rebased empty)
• research: add an offline session-engagement aggregate with labeled benign coverage #3293 offline engagement aggregate — PR feat(llm-worker): add offline engagement aggregate #3302

Blocker along the way: #3299 (rand 0.10 breaking bump on main, no call-site migration) — PR #3300, merged, which was holding #3297/#3298/#3301/#3302 red on the Rust job.

Both invariants from this order held in the merged code: calibration stayed precision-only (the census exports only closed dispositions and prints a PRECISION-ONLY banner; no recall claim is made anywhere), and engagement metrics can never attribute an automated attacker (covered/uncovered split, a separately reported labeled benign baseline, and docs stating disconnect cannot identify an automated or AI client). 82/82 llm-worker tests pass on main.

Follow-up worth filing separately: the self-hosted buildx cache was repeatedly poisoned mid-run — corrupt index.json referencing absent blobs, and a group-read-only oci-layout that left all but the last-writing runner user locked out. PR #3304 fixes the second in-repo; the corruption source is still unexplained.