@@ -162,6 +162,12 @@ candidate, including the ones that never ran.
 | 7 | `harness_check` | `shrlm.runner.check_harness`: invariant probes (I1 boundedness, S9 signature/return type, S6 field vocabulary, plumbing, stated limits) — same subprocess | Subprocess only |
 | 8 | `round_trip` | The materialized harness re-serializes byte-identically to the envelope | Subprocess only |
 
+The gate subprocess runs with a stripped environment: the child inherits only a
+small allowlist (`PATH`, `PYTHONPATH`, `HOME`, `TMPDIR`, and locale variables),
+and it re-scrubs itself after import so values re-loaded from a `.env` file are
+dropped too — API keys and every other host secret are gone before candidate
+code runs.
+
 A candidate that survives is returned as a `LoadedCandidate`: the live
 `Harness` (edited surface materialized, every unchanged surface the incumbent's
 own object), the edited surface id, the envelope hash, and the parsed proposal
 
@@ -40,17 +40,23 @@
 defense-in-depth, not a security boundary — the REPL already executes
 model-written code by design.
 
-Rejections are values, never exceptions: expected-invalid input comes back as a
-``CandidateRejection`` naming the gate and the violation, in the style of
-``attribution.py``'s validate-with-named-violation loop, so the promotion
-ledger can record every candidate including the ones that never ran.
+Rejections are values, never exceptions — for expected-invalid candidate
+input. Every gate failure comes back as a ``CandidateRejection`` naming the
+gate and the violation, in the style of ``attribution.py``'s
+validate-with-named-violation loop, so the promotion ledger can record every
+candidate including the ones that never ran. The boundary is precise: once the
+subprocess has vetted a candidate, a host-side failure while rebuilding the
+same harness is a bug in this module, not stage-2 input, and it raises loudly
+(the round-trip hash comparison after it stays a structured rejection because
+it checks the candidate's envelope, not our own code).
 """
 
 import ast
 import hashlib
 import importlib.util
 import json
 import math
+import os
 import subprocess
 import sys
 from dataclasses import dataclass, replace
@@ -621,11 +627,34 @@ def run_subprocess_gate(proposal_path: str) -> dict[str, Any]:
     return {"ok": True}
 
 
+# The entire environment the gate subprocess inherits (plus any ``LC_*``
+# locale variables). The child runs candidate (model-authored) code and needs
+# no credentials — only what it takes to launch ``sys.executable -m
+# shrlm.optimization.candidates`` survives; every API key, token, and secret
+# in the host environment is dropped.
+_GATE_ENV_ALLOWLIST = ("PATH", "PYTHONPATH", "HOME", "TMPDIR", "LANG", "SYSTEMROOT")
+
+
+def _gate_environment() -> dict[str, str]:
+    """The curated environment for the gate subprocess: allowlist plus LC_*."""
+    return {
+        key: value
+        for key, value in os.environ.items()
+        if key in _GATE_ENV_ALLOWLIST or key.startswith("LC_")
+    }
+
+
 def _run_gate_subprocess(proposal_path: Path, timeout_seconds: float) -> dict[str, Any]:
     """Host-side wrapper: run the gate in a child under a wall-clock timeout."""
     command = [sys.executable, "-m", "shrlm.optimization.candidates", str(proposal_path)]
     try:
-        process = subprocess.run(command, capture_output=True, text=True, timeout=timeout_seconds)
+        process = subprocess.run(
+            command,
+            capture_output=True,
+            text=True,
+            timeout=timeout_seconds,
+            env=_gate_environment(),
+        )
     except subprocess.TimeoutExpired:
         return {
             "ok": False,
@@ -778,15 +807,13 @@ def rejection(candidate_id: str, gate: str, reason: str) -> CandidateRejection:
 
     # The subprocess vetted materialization and invariants; now build the live
     # harness the evaluation will run: edited surface from the envelope,
-    # unchanged surfaces the incumbent's own objects (KTD2).
+    # unchanged surfaces the incumbent's own objects (KTD2). A failure here is
+    # a host-side bug, not expected-invalid input, so it raises (fail fast).
     module_path = proposal_path.parent / MODULE_FILENAME
-    try:
-        module = import_surface_module(module_path) if surface_id in ("S7", "S8", "S9") else None
-        fields = surface_field_values(serialization, surface_id, module)
-        harness = replace(incumbent, name=serialization["name"], **fields)
-        materialized_hash = hash_of_serialization(serialize_harness(harness))
-    except Exception as error:  # defensive: the subprocess already vetted this path
-        return rejection(candidate_id, GATE_MATERIALIZATION, f"{type(error).__name__}: {error}")
+    module = import_surface_module(module_path) if surface_id in ("S7", "S8", "S9") else None
+    fields = surface_field_values(serialization, surface_id, module)
+    harness = replace(incumbent, name=serialization["name"], **fields)
+    materialized_hash = hash_of_serialization(serialize_harness(harness))
     if materialized_hash != envelope["hash"]:
         return rejection(
             candidate_id,
@@ -907,6 +934,13 @@ def load_candidates(
 
 
 if __name__ == "__main__":
+    # The host already launches this child with the curated environment, but
+    # the imports above re-populate secrets from any ``.env`` file
+    # (``rlm.clients`` calls ``load_dotenv`` at import time). Scrub back down
+    # to the allowlist before a byte of candidate code runs.
+    for _key in list(os.environ):
+        if _key not in _GATE_ENV_ALLOWLIST and not _key.startswith("LC_"):
+            del os.environ[_key]
     print(json.dumps(run_subprocess_gate(sys.argv[1])))
 
 
 
@@ -29,6 +29,34 @@
    from the manifest alone, and the candidate comes back marked
    ``over_budget`` -- rejected, never silently dropped.
 
+One more experiment-owned containment, for the same KTD3 reason the caps are:
+the *hard wall-clock backstop*. Candidate callables (the S7/S8/S9 surfaces)
+run synchronously inside the host loop, and the runtime's own ``max_timeout``
+is only checked between iterations -- so a candidate call that never returns
+(``while True`` in a middleware, a hang in harness construction) would block
+the host forever: nothing persisted, nothing charged, ``validate_round`` never
+returning. The harness cannot be trusted to bound itself (its runtime policy
+is an editable surface), so ``run_governed_round`` arms a SIGALRM timer around
+each single-run slice at ``hard_deadline_seconds`` -- the per-run
+``max_timeout`` times ``HARD_DEADLINE_FACTOR`` plus
+``HARD_DEADLINE_GRACE_SECONDS``. The factor leaves room for a final iteration
+that started just under the limit (the runtime's between-iteration check
+remains the primary, precise mechanism); the fixed grace absorbs the
+per-slice overhead outside the RLM loop (harness build, verification,
+persistence). When the alarm fires, ``HardDeadlineExceeded`` is raised at the
+hung bytecode; as a ``TimeoutExceededError`` subclass it flows through the
+driver's per-run limit handler and persists as an ordinary
+RESOURCE_TERMINATED run (persist-first, KTD5), which the breaker then charges
+at the per-run ceiling. If the interrupt escapes ``run_round`` entirely (a
+hang outside the per-run try, e.g. in harness construction), the governed
+round synthesizes and persists the in-flight run's terminated manifest line
+itself (``driver.persist_interrupted_run``) before continuing. The backstop
+is skipped -- documented, not silently -- where SIGALRM cannot bind (no
+SIGALRM on the platform, or not the main thread); it closes the in-host hang
+hole at the v1 level, and a full subprocess-per-run boundary is the v2
+escalation. A candidate that swallows ``BaseException`` inside its hang can
+still defeat a signal-raised exception -- that adversarial case is also v2's.
+
 Pricing one persisted run (``breaker_run_cost``) has one policy worth pinning:
 a budget-terminated run carries the limit exception's actual ``spent`` figure
 as its persisted cost (see ``driver._partial_completion``) and is charged
@@ -40,18 +68,95 @@
 costume (the same stance ``runner.acceptance_inputs`` takes).
 """
 
+import signal
+import threading
+from collections.abc import Callable
 from dataclasses import dataclass, field
-from typing import Any
+from typing import Any, TypeVar
 
+from rlm.utils.exceptions import TimeoutExceededError
 from shrlm.optimization.bundle import round_dir
 from shrlm.optimization.candidates import GATE_CAPS, CandidateRejection, cap_violations
-from shrlm.optimization.driver import RoundConfig, run_id_for, run_round
+from shrlm.optimization.driver import (
+    RoundConfig,
+    load_manifest,
+    persist_interrupted_run,
+    run_id_for,
+    run_round,
+)
 from shrlm.optimization.taxonomy import VerifierCause
 
 # Candidate outcomes the promotion ledger records for a governed round.
 OUTCOME_COMPLETED = "completed"
 OUTCOME_OVER_BUDGET = "over_budget"
 
+# The hard wall-clock deadline for one run slice, derived from the per-run
+# ``max_timeout`` cap: ``max_timeout * HARD_DEADLINE_FACTOR +
+# HARD_DEADLINE_GRACE_SECONDS`` (see the module docstring for the rationale).
+HARD_DEADLINE_FACTOR = 1.5
+HARD_DEADLINE_GRACE_SECONDS = 30.0
+
+_T = TypeVar("_T")
+
+
+class HardDeadlineExceeded(TimeoutExceededError):
+    """The hard wall-clock backstop fired: a run slice never returned control.
+
+    Subclasses ``TimeoutExceededError`` deliberately: the driver's per-run
+    limit handler (``driver.ROOT_LIMIT_EXCEPTIONS``) then persists it exactly
+    like the runtime's own timeout -- a failing RESOURCE_TERMINATED run whose
+    error string names this class -- with no driver change required.
+    """
+
+    def __init__(self, deadline: float):
+        super().__init__(
+            elapsed=deadline,
+            timeout=deadline,
+            message=(
+                f"hard wall-clock deadline exceeded: the run slice did not return "
+                f"within {deadline:.1f}s; candidate code likely hung inside a live call"
+            ),
+        )
+
+
+def hard_deadline_seconds(max_timeout: float | None) -> float | None:
+    """The backstop deadline for one run slice; ``None`` disables the backstop.
+
+    ``None`` in means ``None`` out: governed rounds always carry a
+    ``max_timeout`` (``ValidationCaps`` makes it mandatory), so an unbounded
+    slice only occurs for a hand-built config that opted out of the cap.
+    """
+    if max_timeout is None:
+        return None
+    return max_timeout * HARD_DEADLINE_FACTOR + HARD_DEADLINE_GRACE_SECONDS
+
+
+def _alarm_available() -> bool:
+    """Whether SIGALRM can bind here: POSIX only, main thread only."""
+    return hasattr(signal, "SIGALRM") and threading.current_thread() is threading.main_thread()
+
+
+def _call_with_hard_deadline(fn: Callable[[], _T], deadline: float | None) -> _T:
+    """Run ``fn`` under a SIGALRM hard deadline, restoring alarm state after.
+
+    With no deadline, or where SIGALRM cannot bind (``_alarm_available``), the
+    call runs unguarded -- the documented no-backstop mode; the runtime's own
+    between-iteration timeout remains in force either way.
+    """
+    if deadline is None or not _alarm_available():
+        return fn()
+
+    def _on_alarm(signum: int, frame: Any) -> None:
+        raise HardDeadlineExceeded(deadline)
+
+    previous = signal.signal(signal.SIGALRM, _on_alarm)
+    signal.setitimer(signal.ITIMER_REAL, deadline)
+    try:
+        return fn()
+    finally:
+        signal.setitimer(signal.ITIMER_REAL, 0.0)
+        signal.signal(signal.SIGALRM, previous)
+
 
 @dataclass(frozen=True)
 class ValidationCaps:
@@ -195,6 +300,33 @@ def over_budget(self) -> bool:
         return self.outcome == OUTCOME_OVER_BUDGET
 
 
+def _run_slice(
+    config: RoundConfig, *, stop_after: int, deadline: float | None, known: int
+) -> list[dict[str, Any]]:
+    """One ``run_round`` slice under the hard-deadline backstop.
+
+    The common hang -- inside a candidate call during ``harnessed.completion``
+    -- never reaches this function's handler: the driver's per-run limit
+    handler catches ``HardDeadlineExceeded`` (a ``TimeoutExceededError``) and
+    persists the terminated run itself, so the slice returns normally. What is
+    handled here is the interrupt that *escaped* ``run_round`` -- a hang in
+    harness construction, or an alarm landing between a run's completion and
+    its manifest append. ``known`` (the manifest lines already accounted for)
+    decides recovery: if nothing new persisted, the in-flight run's terminated
+    line is synthesized (``persist_interrupted_run``); if the run did persist
+    before the alarm landed, the reloaded manifest is simply returned.
+    """
+    try:
+        return _call_with_hard_deadline(lambda: run_round(config, stop_after=stop_after), deadline)
+    except HardDeadlineExceeded as error:
+        persisted = load_manifest(config.out_dir, config.round_index)
+        if len(persisted) == known:
+            entry = persist_interrupted_run(config, error)
+            if entry is not None:
+                persisted.append(entry)
+        return persisted
+
+
 def run_governed_round(config: RoundConfig, breaker: CandidateSpendBreaker) -> GovernedRoundResult:
     """Run one round under the breaker: persist-first, one run at a time.
 
@@ -205,6 +337,12 @@ def run_governed_round(config: RoundConfig, breaker: CandidateSpendBreaker) -> G
     moment its manifest line lands; once the breaker trips, the remaining runs
     are skipped and reported, never silently dropped.
 
+    Each slice runs under the hard wall-clock backstop (module docstring): a
+    candidate call that hangs is interrupted at ``hard_deadline_seconds``,
+    persisted as a RESOURCE_TERMINATED run, charged (at the per-run ceiling
+    when the termination persisted no cost), and the round continues -- the
+    host never blocks indefinitely on candidate code.
+
     Args:
         config: The round to run, its limits already merged by
             ``governed_limits``.
@@ -216,13 +354,21 @@ def run_governed_round(config: RoundConfig, breaker: CandidateSpendBreaker) -> G
         breaker's cumulative spend, and the run ids the breaker skipped.
     """
     namespace = str(round_dir(config.out_dir, config.round_index))
-    entries = run_round(config, stop_after=0)
+    deadline = hard_deadline_seconds(config.max_timeout)
+    # The stop_after=0 slice executes no runs but does build the harness when
+    # runs are pending -- candidate code that can itself hang, hence the guard.
+    entries = _run_slice(
+        config,
+        stop_after=0,
+        deadline=deadline,
+        known=len(load_manifest(config.out_dir, config.round_index)),
+    )
     for entry in entries:
         breaker.charge(entry, namespace=namespace)
 
     while not breaker.tripped:
         known = len(entries)
-        entries = run_round(config, stop_after=1)
+        entries = _run_slice(config, stop_after=1, deadline=deadline, known=known)
         if len(entries) == known:
             break  # nothing pending: the round is complete
         for entry in entries[known:]:
@@ -244,12 +390,16 @@ def run_governed_round(config: RoundConfig, breaker: CandidateSpendBreaker) -> G
 
 
 __all__ = [
+    "HARD_DEADLINE_FACTOR",
+    "HARD_DEADLINE_GRACE_SECONDS",
     "OUTCOME_COMPLETED",
     "OUTCOME_OVER_BUDGET",
     "CandidateSpendBreaker",
     "GovernedRoundResult",
+    "HardDeadlineExceeded",
     "ValidationCaps",
     "breaker_run_cost",
     "governed_limits",
+    "hard_deadline_seconds",
     "run_governed_round",
 ]