What Should an Agent Be Allowed to Change?

Sealing the host made the naive mutation impossible and the agent useless. The fix is a Bench: a disposable environment that starts with no files and no network, where every capability is granted narrowly, per task, and revocably.