Allocation Is a Capability-Growth Mechanism:Telemetry and Scheduling in a Self-Growing LLM Red-Team

Most jailbreak research measures attack effectiveness: a technique, a target, a success rate. We study the layer underneath: the orchestration that decides, continuously and under a budget, which harvested techniques ever get evaluated and how a fixed evaluation budget is spread across competing strategies, in a self-growing red-team that harvests reusable attack techniques from the open web, reproduces them against deployment configurations, and graduates the effective ones into a permanent repertoire. Our central finding is categorical: repertoire growth is gated by orchestration, not by technique quality. The instrument that makes it visible is reachability telemetry (a per-strategy record of what was eligible to run but never did), which separates “evaluated and failed” (capability failure) from “never evaluated” (orchestration failure), a distinction a conventional outcome log cannot draw and the contribution we expect to transfer beyond red-teaming. With it we show, holding the 40 primitives, the judge, and every other input fixed and changing only the scheduler policy (greedy → starvation-aware order, candidate quota 0→3), that a cost-optimal greedy scheduler had silently starved its best candidates (85% of all eligible strategy-appearances never ran; planner-tier reachability 0.07): graduations go 0→3 and reachability 0.07→0.98. This is a categorical flip (a candidate at reachability ≈ 0 cannot breach by construction), so it needs no confidence interval. A deliberately least-favourable sweep over the twenty least-tried candidates greedy never reaches confirms they are sound, not weak: 8 of 20 (40%) graduate against a structural 0 under greedy (we report a Fisher exact p = 0.003 only for completeness and do not lean on it). Two further chains corroborate the reframe and motivate it as a research program rather than settle it: an alignment-trained planner refused to author escalation plans (validity ≈22%), which we removed structurally by moving attack structure into deterministic grammars (no model call, pinned by an offline test); and the evaluation budget K behaves as a cheap growth lever for a structural reason: under a quota each ladder runs the full rotation regardless, so cost-per-graduation falls as fixed/K over more graduations. The remaining results are single paid sweeps, scoped as proofs of concept, not powered claims: cross-tier scheduling order as a capability lever, the K cost magnitudes ($8.37/$7.01/$1.44 at K=3/5/20, non-common cost basis), and a variance-dominated grammar A/B. A separate winner-attribution bias, read from the full 11,075-trial breach matrix, is structural in its direction: short-circuit win-counts nearly invert true per-model vulnerability, with the magnitudes period-specific. The contribution is a reframing and the instrument that earns it: in a self-growing system, evaluation allocation is a lever on capability, not merely cost, and telemetry of what could have run is what surfaces the real constraints