Daily Systems Trends Report — November 3, 2026: The Agent Becomes a Workload Class — the Serving Layer Learns to Meter It, the Audit Layer Learns to Distrust It

Tuesday edition. Coverage: the Tuesday, November 3 arXiv batch — 50 distributed-computing, 50 software-engineering and 37 multi-agent papers (arXiv:2611.00006 through 2611.03631). Nothing here overlaps the November 2 report, which covered the Monday batch (arXiv:2610.40721 through 2610.42144).

The theme: the agent becomes a workload class

The week arc so far: 10/26 the interface audit, 10/28 the instruction stack, 10/29 the intervention ledger, 11/1 the baseline audit, 11/2 the repair stack. Every one of those reports was about the logical layer — what the agent reads, claims, approves and repairs. This batch is about the physical layer, and it says something the logical-layer papers assumed away: an agent session is not a request. It is a long-lived, self-similar job whose working set grows monotonically, whose tool calls arrive in bursts on a constrained return path, and whose bill has no additive meter. Five serving papers independently rediscover the same thing classical systems learned about batch jobs and databases decades ago — that the unit of admission, the unit of cache management, and the unit of billing all have to move above the model to the session. Meanwhile the audit papers supply the other half: the session does not know whether it is correct (53% self-judgment, 6-25% foresight, 0.66 AUROC provenance detection), so checkable evidence has to be manufactured outside it — on the phone host, in the harness syscall layer, in a TLA+ proof checker, in an MCP approval prompt that mostly does not exist today. Serving meters the session; auditing grounds it. Same doctrine, two altitudes.

Floor one: the serving layer learns the agent

LLM serving inherited its abstractions from request-response web serving: independent requests, stationary arrivals, evict-from-the-end caches, per-request meters. Agentic workloads break all four at once — histories that only grow, bursts of tool returns, sessions that stay hot for hours, and cost that depends on who else is in the batch. This batch contributes a metastability diagnosis, two cache-management schemes, a fleet characterization, a metering architecture with an impossibility proof, a P2P market design, an economical-accelerator cluster, and a hardware-lottery audit of the FaaS platforms the agent's tools actually run on.

1. Metastability in agent serving (arXiv:2611.02543)

Claim: A brief traffic surge can disrupt prefix reuse in prefill-decode disaggregated LLM serving and trigger a metastable failure — service stays degraded even after arrivals return to a load the engine previously sustained. Evidence: On SGLang, a ten-minute surge reduced goodput by about 88% over the following hour; removing the residual burst sessions restored service within minutes. The sustaining mechanism is population-cache feedback: slower calls prolong sessions and enlarge their aggregate working set, cache misses increase recomputation, and recomputation further delays departures. A fluid model identifies the resource conditions and flags all 17 cache-first cases across 36 simulated deployments. The proposed controller, Basin, gives each session a fixed priority, reserves its predicted peak context against an adaptive admission budget, extends the cache with idle decode memory, and sheds excess demand: on real H200 1P3D deployments (including long-context SWE-bench Pro sessions) 1.20-1.70x the goodput of Continuum and 2.35-3.59x of HiCache alone; in simulation 1.20-2.05x the strongest baseline across six surge scenarios.

2. Lease-aware delivery of tool results (arXiv:2611.00881)

Claim: For web agents, returned observations sit on the critical path to the next decision, and the scheduler that decides when a tool result gets delivered is a real systems component — not a detail. Evidence: LADS couples cache-aware delivery with bounded prefix leases. Key insight: letting a request resume sooner retires extra protection references, freeing lease quota to protect another waiting history; the scheduler prioritizes timely handoffs using current lease ownership and an estimated resumption delay, with bounded departures from cache-first order. Compared with ReAct using FIFO tool-result delivery, mean complete-workflow latency drops 44.6% under bursty tool returns and 42.4% on web-derived burst replay. Foundation: lease-based resource management goes back to distributed file systems (leases for cache coherence, reservation protocols); here the leased object is cache-protection capacity for an agent history. Trade-off: LADS explicitly departs from cache-first delivery, i.e. it trades a little immediate cache efficiency for resumption speed — the paper bounds the deviation rather than trusting the policy. Verdict: directionally right and cheap to adopt at the harness level (schedule tool-result handoffs); the 44.6% number is from bursty synthetic conditions, so treat it as an upper bound on the win.

3. Evict from the front, keep the suffix (arXiv:2611.00391)

Claim: Agent workloads repeatedly reuse long histories across successive turns, and recomputing KV for tokens near the end of a sequence is far more expensive than for early tokens, because attention cost grows with history length. Standard eviction keeps prefixes and drops from the ends — exactly backwards for agents. Evidence: Penelope preserves shared prefixes, evicts from the beginning of the remaining history while retaining the cached suffix, and co-designs eviction, recomputation and unified GPU-CPU cache management. Implemented in SGLang and evaluated on three Qwen3 sizes with real agent traces: mean time-to-first-token down up to 60% and job completion time down up to 37% with a GPU-only cache; up to 76% and 60% with a two-tier GPU-CPU cache. Foundation: this is the anti-pattern of textbook prefix reuse — the change is precisely aligned with how agents actually consume context (append-heavy, revisit-everything). Trade-off: front-eviction only pays when sessions revisit; for one-shot workloads the paper's own framing implies no gain. Verdict: the cleanest workload-class paper of the batch — a one-line policy inversion with double-digit wins on real traces. Adopt-shaped.

4. Serving agentic robot fleets (arXiv:2611.01404)

Claim: A robot-fleet agent couples two resource constraints: a vision-language brain that revisits long growing KV state, and a vision-language-action policy executing action chunks under tight deadlines. Capacity planning must therefore split by deadline class. Evidence: Characterization of 80 LIBERO-PRO episodes from three stacks (1,862 brain turns, 1,582 VLA chunks), profiled on H800 GPUs and replayed on vLLM. Brain contexts reach 215k tokens; the median brain request takes 7.78 seconds against a 1.0-second environment-step gap. Under a 0.25-second action-chunk deadline, one VLA GPU meets a 1% starvation target for exactly one robot; under a 1.0-second deadline, measured capacity reaches at least 32. In sustained brain replay, raising concurrency from 20 to 32 robots collapses throughput from about 2.4 to 0.6 requests per second as repetitive prefill displaces generation; a static active-episode cap restores 2.24-2.25 requests per second and lifts completed-episode throughput from 1.30 to 5.00-5.55 episodes per minute. Flag: single-author. Verdict: the measurement table is the contribution — deadline-class separation plus an admission cap is a boring, correct mechanism, and the 4x throughput gain from simply capping concurrent episodes is the batch's best illustration that admission control, not scheduling cleverness, is the lever.

5. Token-as-a-Utility and the metering impossibility (arXiv:2611.01371)

Claim: Raw token counts do not measure inference resource use, and there is a theorem hiding in that observation: under batched serving, no per-request meter can be additive, independent of co-resident traffic, and exactly cost-reflective at once. Evidence: The architecture splits provisioned capacity, metered consumption and contracted quality into separate products. Consumption is expressed in Reference Inference Units derived from prefill and decode demand; occupancy-indexed operator ratings recover shared serving costs; versioned inference records support auditing and re-rating across operators. Measured on three RTX 5000 Ada GPUs with trace-driven multi-tenant calibration: occupancy-indexed rating limits statement-energy error to 9% versus up to 70.5% under fixed-occupancy rating; tenant mispricing falls from 7.36x under flat token counting to 2.39x with RIUs and 1.06x after occupancy-based reconciliation. Foundation: this is the electricity-utility lineage — cost allocation in shared networks, where the impossibility of a perfect loss allocator has been known for a century. Trade-off: more accounting machinery means more attack surface and more dispute surface; the paper's versioned records are the audit story. Verdict: the impossibility result alone reframes the token-billing debate (per-token pricing is structurally not cost-reflective); the RIU design is a serious first proposal, validated at small scale.

6. A compute center anyone can join (arXiv:2611.01865)

Claim: Bitcoin proved strangers can contribute compute under shared rules because proof-of-work is expensive to produce and cheap to verify. Useful inference has no such asymmetry — so the Open Inference Market replaces it with an economic mechanism: workers deliver results without knowing whether they will be audited, unsettled earnings serve as collateral during a challenge window, and confirmed cheating forfeits all of it (earnings-as-collateral). Evidence: In a simplified model: audits needed for deterrence are constant per worker per day (so the audited share falls as the network grows); a new worker can join with a short intensive-audit period and a very small bond; and viability depends only on the ratio of the audit judge's false-flag rate to its detection rate. Under example parameters, about 0.3 replays per worker per day make cheating unprofitable for a rational worker. Flag: two authors, simplified model, no implementation, no measured system. Critical read: the mechanism design is genuinely interesting and it is the same doctrine this report has tracked all fall — deterrence via checkable evidence and staked collateral, not via trust in the proposer. But every number here is a model artifact, not a measurement; the false-flag-to-detection ratio assumption is exactly the correlated-monitor-failure point the October batch showed fails under adversarial pressure. Verdict: watch, do not cite as evidence that P2P inference markets work.

7. Cluster efficiency on economical accelerators (arXiv:2611.02975)

Claim: Long-context serving can be cost-efficient on cheap accelerators if — and only if — the interconnect keeps their per-dollar advantage intact. Evidence: The paper measures cluster efficiency in tokens per $ and tokens per joule, guided by a characterization of coding-agent workloads, and builds the stack on the Tenstorrent Galaxy (Blackhole chips): integrated communication engines, pipelined ring transfers, communication-computation overlap, device-side decode replay. Across three dense models in BF16 and 8-bit configurations at 8K-256K-token contexts, the Galaxy achieves 1.07-2.24x the tokens-per-$ of an eight-GPU RTX PRO 6000 Blackwell server under a three-year acquisition-and-electricity cost model. The control experiment is the headline: emulating TCP-class communication on the same chips reduces throughput by 23.5-67.4% and eliminates the cost advantage in every evaluated configuration. Critical read: Tenstorrent-adjacent work, and the cost model (three-year acquisition plus electricity) is the dominant assumption — vendor-baseline sensitivity applies, as it did to uGDS in October. Verdict: the falsification test (slow the interconnect, lose the win) is the right methodology and transfers to any accelerator comparison; the absolute numbers should be re-derived per procurement.

8. The FaaS hardware lottery, measured (arXiv:2611.02990)

Claim: Commercial serverless platforms schedule identical function invocations on different CPU types behind one interface, and the resulting hardware lottery is invisible to users but billed to them. Evidence: Systematic study across four commercial FaaS platforms. Using variance decomposition: CPU heterogeneity alone explains 4% to 97% of performance variance on AWS Lambda and Google Cloud Run Functions. On Azure Functions, a platform-level mechanism produces bimodal execution durations that overshadow CPU effects. The CPU composition on AWS Lambda shifts within a single week. On Google Cloud Run Functions and Alibaba Function Compute, availability of instruction-set extensions such as SHA-NI differs between CPU types. Since all platforms bill by duration, invocations on the slowest CPU type cost up to three times as much as on the fastest. Foundation: the FaaS-research lineage (Bermbach group, TU Berlin + ECDF) — the same group that has been auditing serverless cold starts and benchmark validity for years. Verdict: immediately actionable for anyone running latency- or cost-sensitive agents on FaaS: measure your own CPU-type distribution before benchmarking, and treat provider SLAs as duration-priced hardware lotteries. This is the traditional-sound-empiricism half of the batch.

Floor two: the audit layer learns to distrust

The serving papers above meter the session. The audit papers ask whether the session can be believed. The batch's collective answer: no — agents cannot judge their own work (53% correctness), cannot foresee the bugs they introduce (foresight resolve rate 6-25%), and cannot be distinguished from independent implementations by current provenance detectors (0.66 AUROC). The constructive half of the batch puts checkable evidence where the model cannot see: on-device host records, harness syscall observation, machine-checked proofs, and approval prompts that — as measured — are absent almost everywhere they are needed.

9. Built on broken assumptions (arXiv:2611.02207)

Claim: Benchmarks test coding agents one request at a time, on human-written code, checked once. Real agentic development is chains: each request built on the last. The chain is where agents fail, and not for the obvious reason. Evidence: BOBA-Bench: 280 chains of 20 consecutive requests drawn from 140 real open-source projects; ten coding agents evaluated. All ten do far worse on chains: 95% completion taken one at a time, 51% chained. Worse code is not the cause — once checked, agent code is nearly as good a base for later requests as human code. The cause is the mistakes agents miss: they declare a request done when their own tests pass, even when those tests miss a mistake; the next request then fails about twice as often, and the mistake is rarely found later. Asked whether an implementation is correct, agents are right 53% of the time. A single external correction plus one repair round lifts chain completion from 51% to 59%, and the repaired mistake stops hurting what follows. Critical read: this is the causal-structure paper of the batch: it separates substrate quality from error propagation and shows the binding constraint is access to verification, not model quality. It converges exactly with Foresight-SWE (next item) and with October's chain: SWE-Residual acceptance bias (10/20), PASS-is-a-claim (10/28), the repair stack (11/2). Verdict: adopt the benchmark design (chains, not single requests); the design implication — put an external check between every two requests — is the cheapest reliability intervention described in this batch.

10. Do coding agents catch their own bugs? (arXiv:2611.01181)

Claim: Engineers must foresee unstated consequences of code changes — the vulnerability you should have prevented, the bug the next PR will fix. Current benchmarks never measure this. Evidence: Foresight-SWE: 212 samples across 4 languages and 35 popular open-source repositories; each sample contains two PRs, the second resolving defects the first introduced. The foresight resolve rate (FRR) counts an agent as succeeding only if it fully completes the original task and avoids the defect the later PR identified. Across eleven LLMs, FRR ranges from 6.13% to 24.53%. Foundation: this is the benchmark incarnation of an old software-architecture virtue — fail-safe design and review for latent defects — which current agentic evaluation simply never prices. Critical read: read the title as the paper's summary: they do not. The number is brutal but the design is careful — ground truth comes from what human maintainers actually fixed next, not from a synthetic fault model. Verdict: pair with BOBA for the same conclusion from two independent angles (BOBA: errors propagate because checks are missing; Foresight: the checks agents are asked to run never include foresight). Both say the unit of agentic evaluation should be the aftermath, not the PR.

11. Can agentic code laundering be detected? (arXiv:2611.01966)

Claim: Coding agents can now rewrite repository-scale codebases while preserving tested behavior, which creates a provenance problem for plagiarism detection, license auditing and software supply-chain law: can such rewrites be traced to their source? Evidence: Launder-Bench, built from 282 real-world repositories with a source-hidden reconstruction protocol that decomposes source behavior, reconstructs modules and structure, and keeps rewrites only after execution-based verification. Two settings: 1,128 pairwise provenance instances and 229 attribution instances with abstention when evidence is insufficient. Measured same-domain independent repositories establish how much similarity arises without shared provenance. Results: the strongest static method reaches only 0.66 AUROC on pairwise detection; repository encoders rank the true source first on up to 22% of attribution queries but earn calibrated attribution credit on only 1-2%. Critical read: the calibrated-credit distinction is the intellectually honest part — ranking the right source is not evidence of derivation when independent implementations can be similarly close, and the benchmark prices that distinction. This continues the laundering arc this report has tracked since October (approval laundering 10/1, disparity laundering 11/1): provenance is becoming the legal-scale question of agentic software. Verdict: the benchmark is the deliverable; the 1-2% calibrated number should end any claim that current detectors can attribute agent-rewritten code.

12. When neither side confirms: MCP tool approval (arXiv:2611.02527)

Claim: The MCP specification asks for a human who can deny destructive tool calls, but it splits the mechanism between the server (which can annotate a tool or ask the user through the host via elicitation) and the host (which decides whether to prompt). When neither side confirms, deletion and money movement happen without anyone being asked. Evidence: Both sides measured from source code. In a 1,000-repository sample of the official MCP registry, an estimated 90% of destructive tools (95% CI 82-95%) have no server-side confirmation; most servers that do elicit proceed — or fall back to a flag the model itself can set — when the host cannot relay the question. Of 41 popular open-source hosts and agent SDKs, 32 have no application-side approval gate for destructive calls. Critical read: this is the field audit of the approval-moment doctrine that this report has covered since October (approval laundering 10/1, the contract layer 10/21, Who Approved This 10/22). The measurement design is the right one — audit the deployed artifacts, not the spec. The finding inverts the usual reading: the spec is fine, the ecosystem is the vulnerability. Verdict: if you build agent tooling, this is a checklist item for this week: enumerate destructive tools, check who confirms, and treat a model-settable fallback flag as no confirmation at all.

13. Does the judge see what the evaluation requires? (arXiv:2611.02676)

Claim: LLM-judge evaluation pipelines render recorded agent runs into text packets for the judge, and the pipeline itself can silently violate what the evaluation requires. Four input-assurance obligations are proposed: required content survives rendering; checkers cover their requirements; a failed check stops later use; and the judge reads the bytes last checked. Evidence: In one pipeline with 30 trajectories, matching hashes, passing checkers and successful staging coexisted with violations of all four obligations. The renderer omitted every structured tool call, leaving 53 of 60 judged steps blank despite matching hashes. For one judge configuration, later context raised error flags by 13 more on error steps than on correct ones; restoring every call reduced that contrast to 2 (a reduction of 11, 0.37 per trajectory, 95% cluster-bootstrap interval 0.17 to 0.53). Separately written checkers accepted an unmatched tool result. In integration tests, a stub judge read a failed build's packet and a copy changed after staging. Three added controls stopped 18 of 19 constructed fault cases before the stub read any packet. Critical read: Data61 lineage (Xia, Lu, Zhu) continuing their audit-the-auditor series. The core finding is the October theme in a new costume: a gate whose inputs are interface artifacts is only as good as the artifacts — hashes matched, checkers passed, and the judge still graded blanks. Verdict: the four obligations are cheap to implement in any judge pipeline and the 18/19 fault-catch figure is measured, not claimed.

14. The return assumption, measured and repaired (arXiv:2611.01930)

Claim: Agents operating web infrastructure from the command line assume each tool call returns within bounded time with its requested action finished. Many commands ask a question before acting; harnesses either close the program's input (so it returns status 0 having done nothing) or leave it open at a terminal nobody types at (so it waits out the clock and pays in time and tokens). Evidence: 91,469 production tool calls and 89,047 public agent trajectories; 8 widely used harnesses tested; Litmus, a catalog of 158 checked invocations; Tripwire, 25 task pairs differing only in whether a question guards the action. Findings: with closed input, 11.5% of tested invocations return status 0 without performing the requested action; 7 of 8 harnesses close input when no terminal is attached; an unanswered question at a plain terminal multiplies token use by 2.9 and moves an LLM from 7th to 3rd place among 8. The repair, RECEIPT, keeps input open, reads what each process waits for from system calls, and returns that state to an unmodified agent through a model-checked protocol: false claims of success reduced by 73.5% across 5 LLMs, and all 25 guarded tasks completed on a second harness. Critical read: the model-checked protocol detail is the sound-foundation part — the repair is verified against a protocol model, not just benchmarked. The paper's closing recommendation is the deliverable: agent builders should report what each tool call did, not only how it ended. Verdict: highest immediate-utility paper in the audit section; every harness in this stack (including ours) should report process wait-state.

15. Host-grounded execution on the phone (arXiv:2611.02644)

Claim: Mobile GUI agents mostly drive phones over ADB from a separate computer, out of reach of ordinary users and of the apps through which most people reach web services. An installable agent needs its evidence from the device itself. Evidence: Coati, a source-available agent installed as an Android app. Its on-phone runtime records what a model alone cannot see: the effect of each action at its target, result screens across apps, and progress of repeated steps. VerifyLoop checks action outcomes and completion claims against host evidence and reports a completion it cannot audit as unverified. On all 116 AndroidWorld tasks with Gemini 3.8 Flash as backbone: 86.5% success over three trials, ahead of the strongest open-source agent Artemis (77.6% with the same accessibility-only access; 76.5% even when allowed ADB) and far ahead of FinalRun and Midscene (about 59%); VerifyLoop cuts false completion claims by about a third at comparable success. The routed fast executor cuts median task time by 39% and runs three of four loop tasks 2.8-5.4x faster with 6-9x fewer model tokens; per-app procedural memory shortens a repeated deep route from 18.5 steps to 6-7; on an Android 16 phone, routed execution completes all 27 benchmark runs with 76% fewer reasoning calls on the critical path. Critical read: the sentence that matters: host evidence, not model self-assessment, makes an installable agent reliable and fast. Same doctrine as October's StateMirror (deterministic pre-execution checks at the boundary) and the 11/1 attribution audit — the evidence floor is the cheap deterministic component. Verdict: the verification-at-the-host pattern is transferable to any GUI-agent stack; the 6-9x token reduction from loop replay is the cost story worth tracking.

16. An evidence-based template for agent instruction files (arXiv:2611.02383)

Claim: Repository-level instruction files (AGENTS.md, CLAUDE.md, Copilot instructions, Cursor rules) are the substrate agents actually read, but adoption, consistency and maintenance of these files have been unmeasured. Evidence: Empirical study of 3,387 instruction files from 1,000 GitHub repositories across four formats. Findings: 42.2% of instruction-bearing repositories in the higher-popularity cohort maintain multiple formats; among 386 manually examined corresponding-section pairs, 16.1% provide divergent guidance; 40.4% of analyzed files have only one recorded modification event. From category prevalence and addition ratios the authors derive an evidence-based template of ten Required, four Gap and two Recommended categories; explicit template guidance raises structural category coverage from 18.7% to 82.8% in a generation experiment. They also release AGIT-Instruct for evaluating instruction-file generation (best full-file ROUGE-1 F1 0.459 via RAG; 19.4% of generated instances fully preserve developer-written intent, 61.2% partially). Critical read: this is the empirical bookend to 10/28's Hidden in Plain Sight (the instruction stack) and 10/26's AGENTS.md census. The 16.1% divergent-guidance number is the practical headline: coexisting formats are not copies, they are forks, and the agent resolves the fork at first read (per 10/10's One Skill Too Many). Verdict: the template is immediately usable in any repository this stack touches; treat multi-format divergence as a maintenance defect, not a convenience.

Floor three: harness and verification machinery

Three of the batch's strongest papers do not fit the serving/audit split because they attack the layer between: the harness. One fits a minimal harness to a fixed model; one measures whether recursive self-improvement gains transfer; one puts agents to work producing machine-checked proofs of real system specifications; one removes servers from state-machine replication.

17. Optimize the harness, not the model (arXiv:2611.03434)

Claim: For government intelligence teams, security and cost constraints rule out hosted frontier models and broad tool surfaces; the lever that remains is the harness. CLEO fits a minimal agent harness to a fixed, self-hostable LLM, admitting only the tools, guardrails, memory policies and loop components that improve accuracy while remaining general and auditable. Evidence: On a held-out dataset the CLEO harness reaches an 83.8% pass rate, within 1.2 points of the strongest out-of-the-box Claude Code SDK baseline, while being two orders of magnitude smaller. Foundation: this lands mid-arc between 10/20's JustGoal (goal-only beats open-source harness machinery on most operators) and 10/21's Toolflation: the claim is that harness surface is a cost and attack surface that must be earned per component, with an expert-validated dataset as the gate. Critical read: the baseline is one SDK on one dataset, and the domain (investigative analysis) is specific — treat the 1.2-point gap as evidence of feasibility, not of parity. Verdict: the method (component-wise admission under a held-out gate) is the transferable artifact; it is the same negative-selection logic Aletheia used for permissions in October.

18. Measuring self-improvement transfer (arXiv:2611.02797)

Claim: Recursively self-improving systems are evaluated without metrics that distinguish capability gains from scenario fitting, without sustainable protocols for unseen tasks, and without attribution of improvement to evolution traces. Evidence: SelfImprove-Bench organizes tasks into three primary capabilities (Exploring, Planning, Reasoning) instantiated on games for controllability and reproducibility, with template-driven generation and difficulty coefficients. Evaluation is organized into a generalization ladder from G0 to G4 measuring how far gains transfer from training conditions. Experiments reveal that the evolutionary gains of existing RSI methods are inconsistent across generalization levels. Critical read: this is the RSI counterpart of October's RSI-claims audit (11/1) and the harness-self-improvement null result (10/23 radar): the field's favorite growth story does not clear a held-out ladder. The G0-G4 ladder is a clean, stealable instrument — it prices transfer, not headline deltas. Verdict: benchmark-grade evidence against unqualified RSI claims; use the ladder shape in any self-improvement evaluation.

19. Agents proving TLA+ specifications (arXiv:2611.02849)

Claim: Machine-checked proofs for real-world system specifications have been limited by human proof-engineering effort; agentic AI on top of the TLA+ Proof System (TLAPS) can extend the frontier. Evidence: TLAPS-Bench provides a proof harness supporting iterative proof development, with agents equipped with proof tools and libraries and safeguards against reward hacking. Corpus: 265 proof targets from 95 TLA+ specifications of real-world systems, spanning cache coherence, Byzantine consensus and write-ahead logging. Evaluated frontier agents (Codex with GPT models) on a subset of 70 proof targets across 12 specifications: the highest-scoring model, GPT-6.1 Sol (max), proved 31 targets (44.3%). The author list is the tell: Chris Newcombe, Igor Konnov, Stephan Merz, Markus Kuppe, Murat Demirbas, Tianyin Xu — the traditional formal-methods establishment (AWS lineage, INRIA, Ant) building the benchmark themselves. Critical read: this is the traditional-foundation paper of the batch: Lamport's spec-and-proof lineage meets agents, with the proof checker — not the model — as the authority. 44.3% is honest about the difficulty; inductive-invariant discovery remains the bottleneck. Verdict: the harness-with-anti-reward-hacking design is the pattern to copy wherever agents touch formal artifacts.

20. Eliminating servers in state-machine replication (arXiv:2611.01363)

Claim: SMR systems make servers the choke point: they materialize, store and serve snapshots of state while the durable total order lives on the same or disaggregated servers. Serverless SMR moves both the materialized state and the durable total order to disaggregated storage, with clients maintaining a single materialized copy; the shared log becomes the only interface, enabling distributed materialization. Evidence: AirDB, a transactional key-value store built on the design: higher availability than etcd over Raft; oblivious to server failures and bad client activity; cold starts 10-45x faster. Foundation: this is the disaggregation lineage (shared-log systems like Slog and Delta; serverless state literature) taken one step further — the server role itself dissolved into the log. Critical read: the availability claim is the strong one; the 10-45x cold-start number is where the design pays for long-tail server management. Watch for write-path costs at scale, which the abstract does not price. Verdict: boring-mechanism pedigree, peer-reviewable design; a serious etcd-challenger architecture if the write-path numbers hold.

Critical analysis: one doctrine, two altitudes

Put the two floors side by side and the batch's synthesis is unusually crisp. The serving papers all move a decision above the model to the session: Basin admits the session against a predicted peak context; LADS leases cache protection against a resumption estimate; Penelope evicts by workload shape rather than by sequence end; the robot-fleet study caps concurrent episodes; Token-as-a-Utility meters by occupancy rather than tokens. The audit papers all move a decision outside the model to an evidence floor: Coati checks claims against host records; RECEIPT reports process wait-state from syscalls; the judge-assurance obligations pin the judge to the last-checked bytes; TLAPS-Bench makes a proof checker the authority; MCP approval — where it exists at all — interposes a human. This is the same motion October traced at the logical layer (proposers propose, checkers dispose) arriving at the physical layer, and both floors fail the same way when the check is missing: 88% goodput loss after a surge nobody caps, 44% chain failure after a mistake nobody checks, 11.5% silent no-ops from a return assumption nobody validates, 90% of destructive tools with no confirmation.

The traditional-foundations comparison: every mechanism in this batch has a working ancestor. Metastability comes from queueing and database failure analysis; leases from distributed file systems; admission caps from load control; occupancy metering from electricity networks; host-verified outcomes from OS-level auditing; machine-checked proof from Lamport and Newcombe; the log-as-interface from shared-log databases. What is new is not the mechanism but the client: a workload that grows, reuses, bills and claims — and the batch's quiet warning is that agent-era systems fail in the gaps between a 1960s control theory and a 2026 workload model. The negative results are as load-bearing as the positive ones: agent self-judgment at 53%, foresight at 6-25%, provenance attribution at 1-2% calibrated credit, RSI gains inconsistent across a generalization ladder, and an audit-judge ratio that the P2P paper admits is the single point on which its whole mechanism balances.

Batch verdict table

Week arc: October proved the audit, November prices the workload

The arc: 10/26 the interface audit, 10/28 the instruction stack, 10/29 the intervention ledger, 11/1 the baseline audit, 11/2 the repair stack, and today the workload class. Each report moved one layer down the stack: what agents read, what they claim, when to intervene, compared to what, how to recover — and now what they cost to run and whether the meter can be trusted. The synthesis has sharpened into a sentence: an agent session is a new workload class whose admission, cache, delivery, meter and audit are all open design problems, and every sound answer so far puts a cheap deterministic component between the model and the consequence — at the queue, the cache, the syscall layer, the host, the proof checker. The gaps left open by this batch: no serving paper prices the audit (does Basin-style admission change RECEIPT-style false-success rates?), and no audit paper prices its own serving cost (host-evidence verification adds reads to the critical path that LADS is optimizing). Those two cost ledgers have not met yet.

Radar: flagged, title-evidence only (not read in depth)

All items below are from the same November 3 batch. Claims are from titles and listing metadata only — flagged accordingly, no numbers asserted.

• 2611.02121 Conditional Calibration Contracts under Coupled Load — a branch-aware audit of switched inference; pairs with the metering item if its contracts are enforceable.
• 2611.02079 ParetoSaddler — Pareto-guided optimization of agent harnesses for quality and cost; the cost-half companion to CLEO.
• 2611.01572 Impossible Code, Barely Changed Score — a replay study of judge-based evaluation; read next to the judge-assurance obligations.
• 2611.01742 From Single-Agent Self-Discovery to Multi-Agent Adaptation — scaling laws of partner feedback and conventions; test against the 10/18 jury-not-electorate result.
• 2611.01840 Self-Evolving Agentic Workflows via Semantic Decomposition — RSI-adjacent; hold to the G0-G4 ladder before believing.
• 2611.01449 CONFIRM — governing scientific reporting for agentic neuroimaging; the reporting-governance pattern in a domain with real error costs.
• 2611.01265 Bounding Coding-Agent Autonomy: Boundary Contracts — a pilot study; pairs with 10/21's contract layer and 10/22's Concordat.
• 2611.03066 A Trustworthy and Governable Internet of Agentics — architectural perspective on protocols, systems and governance; position-paper grade, flag accordingly.
• 2611.00384 Agent Stack for ML Training Lifecycle — generation, validation and optimization of training-agent stacks.
• 2611.00163 Claude for Excel — an industry-adjacent claim that agentic spreadsheet work is transformative; the first commercial-workload entry of its kind in a batch this size.
• 2611.00689 Getting a Grip: Governed Messages — operating human-agent software teams through governed message passing.
• 2611.03020 The Tower of Babel in AI — who should speak and when it pays to listen; theory-side companion to October's Tower-of-Babel critique thread.
• 2611.03600 Four Bridges — measuring deception propensity in a multi-agent game; security-relevant metric.
• 2611.03219 Can Coding Agents Sustain Continual Evolution without Forgetting? — the long-horizon counterpart to BOBA's chain benchmark.
• 2611.03197 Finding the Pivots to Repair Broken Source-Test Evolution — connects to the 11/2 repair stack.
• 2611.03231 Specification-Driven Governance for Fairness-by-Design — governance in agentic SE; watch whether the specification is enforceable or aspirational.
• 2611.02285 Spec-First Architecture with Verification Agents — synthesis/verification split; compare to 10/28's who-holds-the-pen line.
• 2611.03575 VeriHarm-Bench — verifiable measurement of harmful success in coding agents; the adversarial mirror of BOBA.
• 2611.03523 DistDebug-Bench — can LLM agents diagnose bugs in distributed systems? (cross-listed DC/SE).
• 2611.01173 From Stories to Bugs — story-based semantic fuzzing of interactive systems.

Sources glossary

• arXiv:2611.02543 — When Cache Pressure Becomes a Trap: Metastability in Agent Serving (Lu, Zhou, Lin, Ustiugov). Submitted November 2, 2026.
• arXiv:2611.00881 — LADS: Lease-Aware Delivery Scheduling of Tool Results for Language Model Agents (Hou, Jiang). Submitted October 31, 2026.
• arXiv:2611.00391 — Rethinking KV Cache Eviction for Agentic LLM Serving (Fan, Meng, Xia, Chen, Li, Nikolopoulos). Submitted October 30, 2026.
• arXiv:2611.01404 — Serving Agentic Robot Fleets: Workload Characterization, KV-Cache Thrashing, and Admission Control (He). Submitted November 1, 2026.
• arXiv:2611.01371 — Token-as-a-Utility: A Model-Agnostic Architecture for Metering and Provisioning AI Inference Services (Aun et al.). Submitted November 1, 2026.
• arXiv:2611.01865 — A Compute Center Anyone Can Join: A Peer-to-Peer System for AI Inference (Lin, Zhang). Submitted November 1, 2026.
• arXiv:2611.02975 — Introducing Cluster Efficiency to LLM Serving: Pooling Economical Accelerators over Fast Interconnects (Jiang, Glusac, Yuan, Yoneki). Submitted November 2, 2026.
• arXiv:2611.02990 — Same Function, Different CPU: Quantifying Hardware Heterogeneity in Commercial FaaS Platforms (Heisterberg, Carl, Schirmer, Bermbach). Submitted November 2, 2026.
• arXiv:2611.02207 — Built on Broken Assumptions (BOBA): Why Coding Agents Cannot Be Left Alone (Cuadron, Gupta). Submitted November 1, 2026.
• arXiv:2611.01181 — Do Coding Agents Catch Their Own Bugs? (They Do Not.) – Foresight-SWE (Patel, Liao, Henderson, He, Chen). Submitted October 31, 2026.
• arXiv:2611.01966 — Launder-Bench: Can Repository-Level Agentic Code Laundering Be Detected? (Hu et al.). Submitted November 1, 2026.
• arXiv:2611.02527 — When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts (Yao, Yang, Wang, Zhou, Ye). Submitted November 2, 2026.
• arXiv:2611.02676 — Does the Judge See What the Evaluation Requires? Input Assurance for LLM Agent Evaluation (Xia, Lu, Li, Sejdinovic, Zhu). Submitted November 2, 2026.
• arXiv:2611.01930 — RECEIPT: Measuring and Repairing the Return Assumption of LLM Agents in Web Service Operations (Yang et al.). Submitted November 1, 2026.
• arXiv:2611.02644 — Coati: Host-Grounded Execution for Installable Mobile GUI Agents (Ying, Shi, Shi, Zheng). Submitted November 2, 2026.
• arXiv:2611.02383 — Toward an Evidence-Based Template for Agent Instruction Files (Shanto, Islam, Asaduzzaman, Ngom). Submitted November 2, 2026.
• arXiv:2611.03434 — Optimize the Harness, Not the Model: Fitting a Minimal Agent to a Self-Hostable LLM (Gefen, Chassida, Basin, Feigenblat). Submitted November 2, 2026.
• arXiv:2611.02797 — SelfImprove-Bench: Evaluating Generalization in Self-Improving Agents (Xu et al.). Submitted November 2, 2026.
• arXiv:2611.02849 — TLAPS-Bench: Formally Proving Correctness of Real-World System Specifications with TLA+ Proof System (Cheng et al., incl. Newcombe, Konnov, Merz, Kuppe, Demirbas, Xu). Submitted November 2, 2026.
• arXiv:2611.01363 — Eliminating Servers in State Machine Replication (Park, Hu, Yu, Balakrishnan, Park). Submitted November 1, 2026.