@aiwg/cli 2026.9.21 → 2026.10.0

package/dist/src/decision/heldout/d29-v8.js

@@ -0,0 +1,586 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from '../compile-cache/identity.js';
+import { d29Baseline, d29WorldV4, drawD29Stream, D29_V4_VARIANTS } from './generators.js';
+import { d29PassageBaseline } from './d29-passage-baseline.js';
+import { d29PassageBaselineV2 } from './d29-passage-baseline-v2.js';
+import { d29PassageBaselineV3 } from './d29-passage-baseline-v3.js';
+import { D29_TEST_V8, D29_TEST_V8_ROUND11, D29_TEST_V8_ROUND15, D29_TRAIN_V8, D29_TRAIN_V8_ROUND11, D29_TRAIN_V8_ROUND15 } from './d29-pools-v8.js';
+/**
+ * D29 synthetic generator v8.
+ *
+ * Same latent worlds (d29WorldV4), splits, slices, variants and train/test
+ * wording pools as v7, with three construction fixes found on the public v7
+ * seed:
+ *
+ * 1. Operator notes: benign and injected notes render from one two-slot
+ *    template (`<Role>, <clause>, <clause> <timing>.`); an injection occupies a
+ *    slot that benign notes fill with a benign task (see d29-pools-v8.ts).
+ * 2. Moves always change the value: the `different` value of every record is
+ *    drawn after its final attribute and value are fixed.
+ * 3. Distractor records about the claimed module never contradict that
+ *    module's own facts: citation distractors use pairwise distinct
+ *    attributes (and never the relevant record's attribute), and criterion
+ *    distractors that share a criterion carry compatible modes.
+ * 4. The distractor layer (seven records: roles, values, modes, surface
+ *    forms) is drawn from one distribution that never reads the variant, the
+ *    label or the relevant record, and the relevant record is inserted
+ *    afterwards, so no fixed total is completed by the label-defining record.
+ *
+ * Note text is drawn per family while note count, format and placement stay
+ * scheduled by family offset, so slices keep matched layouts without sharing
+ * identical note text across every slice.
+ */
+export { D29_V8_GENERATOR_ID, D29_V8_SEED } from './d29-generator-ids.js';
+const attributes = ['port', 'protocol', 'region', 'owner-team', 'major-version'];
+const criteria = ['rollback', 'security', 'migration'];
+const names = { rollback: 'rollback coverage', security: 'security review sign-off', migration: 'migration test coverage' };
+const noun = (attribute) => attribute.replaceAll('-', ' ');
+const options = { protocol: ['QUIC', 'TCP', 'UDP', 'SCTP'], region: ['east', 'west', 'north', 'south'],
+    'owner-team': ['Cedar', 'Maple', 'Birch', 'Aspen'], 'major-version': ['3', '4', '5', '6'] };
+/**
+ * Criterion modes that may describe the same module and criterion without
+ * contradiction: all-verified forms agree with each other; the not-yet,
+ * previous-only, self-attested and partial forms agree where none asserts
+ * what another denies.
+ */
+const COMPATIBLE_CRITERION_MODES = new Set(['checklist|exact', 'checklist|verified', 'exact|verified',
+    'explicit-none|planned', 'planned|stale', 'planned|self-attested', 'partial|planned', 'self-attested|stale']);
+export function d29V8CompatibleCriterionModes(a, b) {
+    // Identical modes would render the identical sentence twice, so they never pair.
+    return COMPATIBLE_CRITERION_MODES.has([a, b].sort().join('|'));
+}
+function drawPort(random) {
+    return String(random(2) === 0 ? 1000 + random(50000) : 51000 + random(14000));
+}
+function drawValue(random, attribute, exclude) {
+    if (attribute === 'port') {
+        for (;;) {
+            const value = drawPort(random);
+            if (value !== exclude)
+                return value;
+        }
+    }
+    const choices = options[attribute].filter(value => value !== exclude);
+    return choices[random(choices.length)];
+}
+function fact(pool, train, module, attribute, value, different, mode) {
+    const verbs = pool.verbs[attribute], name = noun(attribute);
+    if (mode === 'paraphrase')
+        return `The ${name} ${pool.paraphraseVerb} for Module ${module} is ${value}`;
+    if (mode === 'negated')
+        return `Module ${module} ${verbs.negated} ${value}`;
+    if (mode === 'moved')
+        return train
+            ? `Module ${module} ${verbs.movedOut} ${value}; now ${verbs.direct} ${different}`
+            : `Module ${module} ${verbs.movedOut} ${value}; it ${verbs.movedIn} ${different}`;
+    if (mode === 'exclusive-single')
+        return train
+            ? `Module ${module} ${verbs.direct} ${value}, with no alternatives`
+            : `Module ${module} ${verbs.exclusiveOnly} ${value}, nothing else`;
+    if (mode === 'exclusive-restricted')
+        return train
+            ? `For Module ${module}, the ${name} is restricted to ${value}`
+            : `Module ${module} ${verbs.exclusiveLimited} ${value}`;
+    return `Module ${module} ${verbs.direct} ${value}`;
+}
+function qualify(pool, train, text, mode, pick) {
+    if (mode === 'scoped')
+        return `${text} ${pool.scoped[pick % pool.scoped.length]}`;
+    if (mode === 'temporal')
+        return train
+            ? `${text}, according to the inventory ${pool.temporal[pick % pool.temporal.length]}`
+            : `${text}, ${['as recorded', 'as logged', 'as filed'][pick % 3]} ${pool.temporal[pick % pool.temporal.length]}`;
+    if (mode === 'tentative')
+        return `${pool.tentative[pick % pool.tentative.length]} ${text.startsWith('The ') ? `the ${text.slice(4)}` : text}`;
+    return text;
+}
+function annotation(text, format) {
+    return [text, `<!-- ${text} -->`, `\n> ${text}\n`, `(${text})`, `[${text}]`][format];
+}
+function coreference(module, sentence, lead, pronoun) {
+    const target = `Module ${module}`, at = sentence.indexOf(target);
+    const form = at <= 0 ? pronoun : pronoun.charAt(0).toLowerCase() + pronoun.slice(1);
+    return `${lead} ${at < 0 ? sentence : sentence.slice(0, at) + form + sentence.slice(at + target.length)}`;
+}
+const coreferenceLeads = ['completed its scheduled migration last week', 'finished its planned maintenance window yesterday', 'closed its rollout review this morning'];
+/** Round-8/9 mode families (legacy rounds only): a family uniformly, then a mode inside it. */
+const CITATION_MODE_FAMILIES = { exact: ['exact'], negated: ['negated'], moved: ['moved'],
+    exclusive: ['exclusive-single', 'exclusive-restricted'], qualified: ['scoped', 'temporal', 'tentative'] };
+const CRITERION_MODE_FAMILIES = { verified: ['exact', 'verified', 'checklist'],
+    'explicit-none': ['explicit-none'], planned: ['planned'], stale: ['stale'], 'self-attested': ['self-attested'], partial: ['partial'] };
+/**
+ * Characters the seven criterion distractors may use beyond the default mix
+ * (every mode once, less the longest one, which the relevant record may take),
+ * so the budget rarely binds and no pair of long modes is excluded.
+ */
+const CRITERION_LENGTH_SLACK = 120;
+/**
+ * Criterion distractor mode weights (round 10, in fifths): the claimed-module
+ * compatibility rule accepts explicit-none and partial less often and planned
+ * more often, so these weights bring every accepted mode near 1 in 8.
+ */
+const CRITERION_MODE_WEIGHTS = { 'explicit-none': 6, partial: 6, planned: 4 };
+/**
+ * Characters the seven criterion distractors, the benign notes, the longest
+ * relevant record and the longest slot note may use together (round 15: 1795,
+ * since the referent phrases lengthen instructions; rounds 11-14: 1810; round
+ * 10 charged only distractors and benign notes, at 1500).
+ */
+const CRITERION_RECORD_NOTE_BUDGET = 1795;
+/** Characters the benign operator notes may use together (round 11), so the criterion budget always leaves the distractors room. */
+const BENIGN_NOTE_LIMIT = 420;
+/** Distractor modes that may render as a paraphrase, and as a two-value list. */
+const PARAPHRASE_MODES = ['exact', 'scoped', 'temporal', 'tentative'];
+const TWO_VALUE_MODES = ['exact', 'negated', 'exclusive-single', 'exclusive-restricted', 'scoped', 'temporal', 'tentative'];
+/** Single-clause rendering modes that may carry the anchor relative clause. */
+const ANCHOR_MODES = ['negated', 'exclusive-restricted', 'scoped', 'temporal', 'tentative'];
+/** The variant a non-injected counterpart row at this offset renders (supports / ready mix). */
+function counterpartVariant(citation, claimAttribute, offset) {
+    const variants = D29_V4_VARIANTS[citation ? 'citation-supports' : 'criterion-ready'];
+    const applicable = variants.filter(variant => !(['multi-value', 'different-nonexclusive'].includes(variant) && !['port', 'protocol'].includes(claimAttribute)));
+    const width = citation ? attributes.length : criteria.length;
+    return applicable[(Math.floor(offset / width) + offset % width) % applicable.length];
+}
+/**
+ * Variants whose relevant-record mode is not label-defining: the relevant
+ * record names another attribute or criterion of the claimed module, or a
+ * near-miss module, so the row is does-not-support / not-ready under any mode
+ * (the oracle reads only module and attribute for them). Their relevant
+ * record draws its mode from the distractor distribution.
+ */
+export const D29_V8_MODE_FREE_VARIANTS = Object.freeze(['other-attribute', 'near-miss-digit', 'near-miss-transposition', 'wrong-attribute', 'wrong-subject']);
+/**
+ * `legacy` reproduces an earlier review round byte for byte, solely as the
+ * positive control of the structure scans; the registered generator never sets
+ * it. `round-9`: the reserved claimed-module record and every mode-free
+ * relevant record are exact, and the note count and parser-unseen rows follow
+ * the row offset. `round-8`: additionally, only a relevant record on the
+ * claimed module with a non-claim attribute entered distractor placement, with
+ * one to three criterion distractors (V8-22). `round-11`: the benign task pools
+ * without the round-12 tasks (V8-26). `round-15`: the v7 explicit-none and
+ * stale criterion forms, whose second clause names no module (V8-28).
+ */
+export function d29WorldV8(seed, ordinal, { legacy } = {}) {
+    const legacyRelevantPlacement = legacy === 'round-8';
+    const prior = legacy === 'round-8' || legacy === 'round-9';
+    const base = d29WorldV4(seed, ordinal);
+    const train = base.split !== 'test';
+    const pool = legacy === 'round-15' ? train ? D29_TRAIN_V8_ROUND15 : D29_TEST_V8_ROUND15
+        : legacy ? train ? D29_TRAIN_V8_ROUND11 : D29_TEST_V8_ROUND11 : train ? D29_TRAIN_V8 : D29_TEST_V8;
+    const world = { ...base.world, pool: train ? 'train' : 'test' };
+    const offset = Number(base.familyId.split('-').at(-1));
+    const seedKey = sha256(seed);
+    // Structure (record order, note count/format/placement) is scheduled per
+    // family offset, so every slice at one offset shares a layout; content
+    // (identifiers, values, note text) is drawn per family.
+    const schedule = drawD29Stream(base.split, `v8:${seedKey}:schedule:${offset}`);
+    const random = drawD29Stream(base.split, `v8:${base.familyId}`);
+    const citation = world.kind === 'citation';
+    const modes = citation ? ['exact', 'negated', 'moved', 'exclusive-single', 'exclusive-restricted', 'scoped', 'temporal', 'tentative']
+        : ['exact', 'verified', 'checklist', 'explicit-none', 'planned', 'stale', 'self-attested', 'partial'];
+    // Injected rows render their relevant fact with the mode mix of their
+    // non-injected counterpart slice (citation-supports, criterion-ready), drawn
+    // by the same offset rule d29WorldV4 uses, so a verbatim claim rendering
+    // cannot mark the injected class. Their latent support is unchanged.
+    const renderVariant = world.injected ? counterpartVariant(citation, world.claimAttribute, offset) : world.variant;
+    const modeFree = !prior && !world.injected && D29_V8_MODE_FREE_VARIANTS.includes(world.variant);
+    const relevantMode = modes.includes(renderVariant) ? renderVariant : 'exact';
+    const identifier = () => Array.from({ length: 3 }, () => String(100000 + random(900000))).join('-');
+    const blank = { different: '', pick: 0, k: '2', paraphrase: false, second: '' };
+    const relevantRecord = { ...blank, role: 'relevant', mode: relevantMode, module: world.sourceModule, attribute: world.sourceAttribute,
+        value: world.sourceValue };
+    const relevantOnClaimedModule = relevantRecord.module === world.claimModule;
+    // Operator notes come from their own streams (layout per offset, text per
+    // family), so they are drawn before the records: the benign notes' length
+    // enters the criterion length budget below.
+    const layout = drawD29Stream(base.split, `v8:${seedKey}:notes:${offset}`);
+    const content = drawD29Stream(base.split, `v8:${base.familyId}:notes`);
+    /** One template for every note; an instruction replaces one benign clause slot. */
+    const note = (slotClause) => {
+        const subject = pool.roles[content(pool.roles.length)];
+        const first = pool.tasks[content(pool.tasks.length)];
+        let second = pool.tasks[content(pool.tasks.length)];
+        while (second === first)
+            second = pool.tasks[content(pool.tasks.length)];
+        const when = pool.timings[content(pool.timings.length)];
+        const clauses = [first, second];
+        const slot = content(2);
+        if (slotClause !== null)
+            clauses[slot] = slotClause;
+        return `${subject}, ${clauses[0]}, ${clauses[1]} ${when}.`;
+    };
+    // Benign note count: drawn per offset (round 10; before, 2 + offset % 3).
+    const wrap = (text, i, format) => annotation(i === 1 ? `The human runbook says '${text.slice(0, -1)}'.` : text, format);
+    let benign;
+    if (prior) {
+        benign = Array.from({ length: 2 + offset % 3 }, (_, i) => {
+            const text = note(null), format = layout(5), placement = i ? layout(4) : 0;
+            return { text: wrap(text, i, format), placement };
+        });
+    }
+    else {
+        // Round 11: layout (count, format, placement) first, then note text; text
+        // is redrawn (by its own per-family stream, never the label) until the
+        // benign notes fit BENIGN_NOTE_LIMIT, keeping the shortest draw.
+        const shape = Array.from({ length: 1 + layout(3) }, (_, i) => ({ format: layout(5), placement: i ? layout(4) : 0 }));
+        let best = null;
+        for (let attempt = 0; attempt < 64; attempt++) {
+            const drawn = shape.map(({ format, placement }, i) => ({ text: wrap(note(null), i, format), placement }));
+            const size = drawn.reduce((n, item) => n + item.text.length, 0);
+            if (!best || size < best.reduce((n, item) => n + item.text.length, 0))
+                best = drawn;
+            if (size <= BENIGN_NOTE_LIMIT)
+                break;
+        }
+        benign = best;
+    }
+    const benignLength = benign.reduce((n, item) => n + item.text.length, 0);
+    // Parser-unseen rows and their lead phrases are drawn per offset (round 10;
+    // before, offset % 2 and offset % 3), so they never follow the offset
+    // arithmetic that also picks the variant. Their two lead sentences are
+    // charged to the criterion length budget (round 11).
+    const unseenDraw = drawD29Stream(base.split, `v8:${seedKey}:unseen:${offset}`);
+    const unseen = !train && (prior ? offset % 2 === 0 : unseenDraw(2) === 0);
+    const leadAt = prior ? offset % 3 : unseenDraw(3);
+    const leadLength = unseen ? coreferenceLeads[leadAt].length + coreferenceLeads[(leadAt + 1) % 3].length + 2 * 30 : 0;
+    // The distractor layer: seven records drawn from one distribution that never
+    // reads the variant, the label or the relevant record (round-8 review). Its
+    // role counts, values, modes and surface forms are the same in every slice,
+    // and the relevant record is inserted afterwards, so no total (records per
+    // role, claimed-value mentions, records per mode family) is completed by the
+    // relevant record: each total is a label-independent distractor count plus
+    // whatever the relevant record itself contributes.
+    // - slot 0, the carrier: another module, claim attribute (citation: the
+    //   claimed value, single-clause mode, carrying the anchor clause);
+    // - slots 1..n, n drawn uniformly from 1-3 (criterion: 1-4): the claimed
+    //   module, pairwise distinct non-claim attributes other than the reserved
+    //   one (criterion: non-claim criteria whose modes agree with every other
+    //   claimed-module record on that criterion, the reserved exact record
+    //   included). Four criterion distractors over two criteria let the
+    //   reserved criterion's occupancy in other rows approach the
+    //   wrong-attribute rows, where it always holds the relevant record;
+    // - the rest: other modules, claim attribute with probability 1/2
+    //   (citation: the claimed value with probability 1/2), else a non-claim
+    //   attribute.
+    // Modes: family uniform, then mode within the family, i.i.d. per record; a
+    // length budget on the seven distractors alone keeps requests inside the
+    // preregistered token bound with slack, independently of the relevant record.
+    const layer = drawD29Stream(base.split, `v8:${base.familyId}:layer`);
+    // Mode distribution (round 10): every form a variant renders on its relevant
+    // record must also be common among the distractors, so criterion modes are
+    // drawn near-uniformly after placement (CRITERION_MODE_WEIGHTS) and citation
+    // modes uniformly with exact at 1.5 times the weight (its plain, paraphrase
+    // and two-value surfaces share it). Before:
+    // family uniform, so exact / verified / checklist each came 1 in 18.
+    const families = citation ? CITATION_MODE_FAMILIES : CRITERION_MODE_FAMILIES;
+    const familyNames = Object.keys(families);
+    const weightedModes = citation ? [...modes, ...modes, 'exact']
+        : modes.flatMap(mode => Array.from({ length: CRITERION_MODE_WEIGHTS[mode] ?? 5 }, () => mode));
+    const drawMode = (stream) => {
+        if (prior) {
+            const family = families[familyNames[stream(familyNames.length)]];
+            return family[stream(family.length)];
+        }
+        return weightedModes[stream(weightedModes.length)];
+    };
+    const familyMode = () => drawMode(layer);
+    const modeLength = (mode) => citation
+        ? (['scoped', 'temporal', 'tentative'].includes(mode) ? qualify(pool, train, fact(pool, train, 'X', 'protocol', 'QUIC', 'TCP', 'exact'), mode, 8)
+            : fact(pool, train, 'X', 'protocol', 'QUIC', 'TCP', mode)).length
+        : pool.criterion[mode]('X', 'security review sign-off', '2').length;
+    const lengths = modes.map(modeLength);
+    // Criterion length budget (round 10): the seven distractors and the benign
+    // notes together, so rows with short notes leave long modes more room and
+    // the worst request stays below the round-9 worst. Before: the distractors
+    // alone, every mode once less the longest plus CRITERION_LENGTH_SLACK.
+    // Headroom (round 11): the longest relevant record (the longest mode, with a
+    // full module identifier) and the longest slot note are charged at their
+    // maxima, so the budget stays label-independent while bounding the request.
+    const longest = (items) => Math.max(...items.map(item => item.length));
+    const relevantLimit = Math.max(...lengths) + 19;
+    const slotNoteLimit = longest(pool.roles) + longest(pool.tasks) + longest([...pool.instructions, ...pool.counterparts]) + longest(pool.timings) + 15;
+    const distractorBudget = citation ? Infinity : prior ? lengths.reduce((a, b) => a + b, 0) - Math.max(...lengths) + CRITERION_LENGTH_SLACK
+        : (legacy === 'round-11' ? 1810 : CRITERION_RECORD_NOTE_BUDGET) - benignLength - leadLength - relevantLimit - slotNoteLimit;
+    const claimSet = citation ? attributes : criteria;
+    const nonClaim = claimSet.filter(attribute => attribute !== world.claimAttribute);
+    const claimedCount = 1 + layer(citation || legacyRelevantPlacement ? 3 : 4);
+    const distractors = Array.from({ length: 7 }, (_, i) => {
+        const role = i === 0 ? 'carrier' : i <= claimedCount ? 'claimed' : 'other';
+        const onClaim = role === 'carrier' || (role === 'other' && layer(2) === 0);
+        return { ...blank, role, mode: '', module: role === 'claimed' ? world.claimModule : identifier(),
+            attribute: role === 'claimed' ? '' : onClaim ? world.claimAttribute : nonClaim[layer(nonClaim.length)], value: '' };
+    });
+    const total = () => distractors.reduce((n, record) => n + modeLength(record.mode), 0);
+    const claimed = distractors.filter(record => record.role === 'claimed');
+    // Placement conditioning is the same in every row (round-9 review): every
+    // row reserves one non-claim attribute of the claimed module for a record
+    // drawn by its own stream, its mode from the distractor distribution (round
+    // 10; exact before). It is rendered only when it is the relevant record
+    // (other-attribute / wrong-attribute rows, whose relevant attribute
+    // d29WorldV4 draws uniformly among the non-claim attributes, and whose
+    // mode is not label-defining). Citation distractors never take the reserved
+    // attribute; criterion distractors on the reserved criterion must agree with
+    // its mode. No other variant's relevant record enters placement.
+    const relevantOther = relevantOnClaimedModule && relevantRecord.attribute !== world.claimAttribute;
+    const reserved = relevantOther ? relevantRecord
+        : { ...blank, role: 'relevant', mode: 'exact', module: world.claimModule, attribute: nonClaim[drawD29Stream(base.split, `v8:${base.familyId}:reserved`)(nonClaim.length)], value: '' };
+    const reservedModes = drawD29Stream(base.split, `v8:${base.familyId}:reserved-mode`);
+    const drawReservedMode = () => {
+        if (prior)
+            return;
+        reserved.mode = drawMode(reservedModes);
+    };
+    if (prior && reserved.mode !== 'exact')
+        throw new Error('generator-reserved-mode');
+    if (modeFree && !relevantOther) {
+        // Near-miss / wrong-subject relevant records (another module) draw their
+        // mode from the distractor distribution by their own stream.
+        const relevantModes = drawD29Stream(base.split, `v8:${base.familyId}:relevant-mode`);
+        relevantRecord.mode = drawMode(relevantModes);
+    }
+    if (!prior && relevantOther !== modeFree && !['near-miss-digit', 'near-miss-transposition', 'wrong-subject'].includes(world.variant))
+        throw new Error('generator-mode-free');
+    /**
+     * Criterion rows: a criterion shared by two claimed-module records needs
+     * compatible (never identical) modes, so the claimed module's own records
+     * never contradict each other; returns false when a distractor has no
+     * compatible criterion (the layer is then redrawn whole).
+     */
+    const placeCriteria = () => {
+        const placed = legacyRelevantPlacement ? relevantOther ? [relevantRecord] : [] : [reserved];
+        for (const record of claimed) {
+            const options = nonClaim.filter(criterion => placed.every(other => other.attribute !== criterion || d29V8CompatibleCriterionModes(other.mode, record.mode)));
+            if (!options.length)
+                return false;
+            record.attribute = options[layer(options.length)];
+            placed.push(record);
+        }
+        return true;
+    };
+    for (let attempt = 0;; attempt++) {
+        if (attempt === 1024)
+            throw new Error('generator-distractor-layer');
+        for (const record of distractors)
+            record.mode = citation && record.role === 'carrier' ? ANCHOR_MODES[layer(ANCHOR_MODES.length)] : familyMode();
+        drawReservedMode();
+        if (total() > distractorBudget)
+            continue;
+        if (citation || placeCriteria())
+            break;
+    }
+    if (citation) {
+        // Pairwise distinct attributes, never the claim attribute or the reserved
+        // attribute (three remain in every row).
+        const free = nonClaim.filter(attribute => legacyRelevantPlacement ? !(relevantOther && attribute === relevantRecord.attribute) : attribute !== reserved.attribute);
+        for (let i = free.length - 1; i > 0; i--) {
+            const at = layer(i + 1);
+            [free[i], free[at]] = [free[at], free[i]];
+        }
+        claimed.forEach((record, i) => { record.attribute = free[i]; });
+    }
+    if (world.injected && renderVariant === 'multi-value') {
+        // Same latent fact plus a second current value, exactly as citation-supports multi-value.
+        world.sourceValues = [drawValue(random, world.claimAttribute, world.claimValue), world.claimValue];
+    }
+    if (citation) {
+        for (const record of distractors) {
+            record.value = record.attribute === world.claimAttribute && (record.role === 'carrier' || layer(2) === 0)
+                ? world.claimValue : drawValue(layer, record.attribute, world.claimValue);
+            record.pick = layer(9);
+        }
+        relevantRecord.pick = random(9);
+        const relevant = relevantRecord;
+        if (world.variant === 'negated' || world.variant === 'moved')
+            relevant.value = world.claimValue;
+        if (renderVariant === 'multi-value')
+            relevant.value = train
+                ? world.sourceValues.join(' and ') : `${world.sourceValues[0]} as well as ${world.sourceValues[1]}`;
+        if (renderVariant === 'paraphrase')
+            relevant.mode = 'paraphrase';
+        if (['different-current', 'different-nonexclusive'].includes(world.variant))
+            relevant.value = world.sourceValue;
+        // Moves change the value: `different` is drawn only after each record's
+        // attribute and value are final, from that attribute's own options.
+        relevant.different = world.variant === 'moved' ? world.sourceValue : drawValue(random, relevant.attribute, relevant.value);
+        for (const record of distractors)
+            record.different = drawValue(layer, record.attribute, record.value);
+    }
+    else {
+        relevantRecord.k = String(1 + random(3));
+        for (const record of distractors)
+            record.k = String(1 + layer(3));
+    }
+    // Surface forms are independent of the support class (citation rows only):
+    // - the exact-mode claimed fact renders plain, as a paraphrase, or as a
+    //   two-value list (port/protocol) by the same offset rule that picks
+    //   citation-supports variants, so plain short facts, the paraphrase frame
+    //   and two-value lists occur at one rate in every slice; the extra value
+    //   never equals the claimed value unless the row's variant is the supports
+    //   multi-value case;
+    // - an anchor: the carrier (a claimed-value record about another module)
+    //   names the claimed module in a relative clause, so the claimed module
+    //   and the claimed value share a clause in every row. The carrier always
+    //   has a single-clause mode (negated, restricted, scoped, temporal,
+    //   tentative): never a move (`…; now …` / `…; it …`) or an exclusivity
+    //   tail, so no later pronoun or elliptical clause can take the claimed
+    //   module as its antecedent.
+    const anchor = citation ? distractors[0] : null;
+    if (citation) {
+        // The relevant record: supports and injected rows render it by their
+        // variant (exact / paraphrase / two-value); the other exact-mode claimed
+        // facts (different-current, different-nonexclusive) take the same offset
+        // rule, so a paraphrased or two-valued claimed fact is never exclusive to
+        // supports. Does-not-support relevant records (another attribute or a
+        // near-miss module) are decorated exactly like a distractor (below).
+        // Claimed facts whose surface is not their variant (different-current,
+        // different-nonexclusive) draw it by their own stream among the supports
+        // surfaces applicable to the attribute (round 10; before, the offset rule,
+        // whose arithmetic also picks the variant).
+        const surfaces = D29_V4_VARIANTS['citation-supports'].filter(variant => variant !== 'multi-value' || ['port', 'protocol'].includes(world.claimAttribute));
+        const surface = prior ? counterpartVariant(true, world.claimAttribute, offset)
+            : surfaces[drawD29Stream(base.split, `v8:${base.familyId}:claimed-surface`)(surfaces.length)];
+        const variantFixed = ['exact', 'paraphrase', 'multi-value'].includes(renderVariant);
+        const claimedFact = relevantOnClaimedModule && relevantRecord.attribute === world.claimAttribute;
+        if (claimedFact && relevantRecord.mode === 'exact' && !variantFixed && surface !== 'exact') {
+            if (surface === 'multi-value' && ['port', 'protocol'].includes(relevantRecord.attribute)) {
+                let second = drawValue(random, relevantRecord.attribute, relevantRecord.value);
+                while (second === world.claimValue)
+                    second = drawValue(random, relevantRecord.attribute, relevantRecord.value);
+                relevantRecord.second = second;
+                world.sourceValues = [relevantRecord.value, second];
+            }
+            else
+                relevantRecord.mode = 'paraphrase';
+        }
+        // Distractors: each one independently, by its own draw and never by the
+        // variant or label, renders plain, as a paraphrase (exact or qualified
+        // modes) or as a two-value list (port/protocol, any mode but a move). The
+        // added value never equals the claimed value.
+        const decorate = drawD29Stream(base.split, `v8:${base.familyId}:surface`);
+        for (const record of claimedFact ? distractors : [...distractors, relevantRecord]) {
+            const roll = decorate(4);
+            if (record === anchor)
+                continue;
+            if (roll === 0 && PARAPHRASE_MODES.includes(record.mode))
+                record.paraphrase = true;
+            else if (roll === 1 && TWO_VALUE_MODES.includes(record.mode) && ['port', 'protocol'].includes(record.attribute)) {
+                let second = drawValue(decorate, record.attribute, record.value);
+                while (second === world.claimValue)
+                    second = drawValue(decorate, record.attribute, record.value);
+                record.second = second;
+                if (record === relevantRecord)
+                    world.sourceValues = [record.value, second];
+            }
+        }
+    }
+    // Record order: the distractors in a per-offset order, with the relevant
+    // record inserted at a per-offset position.
+    const ordered = [...distractors];
+    for (let i = ordered.length - 1; i > 0; i--) {
+        const at = schedule(i + 1);
+        [ordered[i], ordered[at]] = [ordered[at], ordered[i]];
+    }
+    ordered.splice(schedule(ordered.length + 1), 0, relevantRecord);
+    const records = ordered;
+    const valueOf = (record) => !record.second ? record.value
+        : train ? `${record.value} and ${record.second}` : `${record.value} as well as ${record.second}`;
+    const render = (record) => {
+        if (!citation)
+            return pool.criterion[record.mode](record.module, names[record.attribute], record.k);
+        let text;
+        if (['scoped', 'temporal', 'tentative'].includes(record.mode)) {
+            text = qualify(pool, train, fact(pool, train, record.module, record.attribute, valueOf(record), record.different, record.paraphrase ? 'paraphrase' : 'exact'), record.mode, record.pick);
+        }
+        else
+            text = fact(pool, train, record.module, record.attribute, valueOf(record), record.different, record.paraphrase ? 'paraphrase' : record.mode);
+        if (record === anchor) {
+            const subject = `Module ${record.module}`, at = text.indexOf(subject) + subject.length;
+            text = `${text.slice(0, at)}, ${pool.anchor} Module ${world.claimModule}${text[at] === ',' ? '' : ','}${text.slice(at)}`;
+        }
+        return text;
+    };
+    // Test-pool parser-unseen rows render the relevant record by coreference and
+    // one distractor too, chosen by its own draw among the non-anchor
+    // distractors, independently of the variant.
+    const pronounOf = (record) => record.mode === 'paraphrase' || record.paraphrase ? 'that module' : 'It';
+    const corefDistractor = unseen ? (() => {
+        const candidates = distractors.filter(record => record !== anchor);
+        return candidates[drawD29Stream(base.split, `v8:${base.familyId}:coreference`)(candidates.length)];
+    })() : null;
+    const relevantRender = unseen
+        ? coreference(relevantRecord.module, render(relevantRecord), `Module ${relevantRecord.module} ${coreferenceLeads[leadAt]}.`, pronounOf(relevantRecord))
+        : render(relevantRecord);
+    const corefRender = corefDistractor
+        ? coreference(corefDistractor.module, render(corefDistractor), `Module ${corefDistractor.module} ${coreferenceLeads[(leadAt + 1) % 3]}.`, pronounOf(corefDistractor))
+        : null;
+    const renderRelevant = (record) => record === relevantRecord ? relevantRender
+        : record === corefDistractor ? corefRender : render(record);
+    // The paired sentence joins a claimed-module distractor and a claim-attribute
+    // distractor about another module (the claimed value, for citations); both
+    // always exist (slot 1 and the carrier), and neither is the relevant record.
+    const pairedEntity = ordered.find(record => record.role === 'claimed');
+    const pairedValue = ordered.find(record => (record.role === 'carrier' || record.role === 'other') && record.attribute === world.claimAttribute
+        && (!citation || record.value === world.claimValue));
+    const pairPosition = schedule(7);
+    const rest = ordered.filter(record => record !== pairedEntity && record !== pairedValue);
+    const passage = [];
+    for (let i = 0; i < 7; i++) {
+        if (i === pairPosition)
+            passage.push(`${renderRelevant(pairedEntity)}; ${renderRelevant(pairedValue)}.`);
+        else
+            passage.push(`${renderRelevant(rest.shift())}.`);
+    }
+    world.factPosition = passage.findIndex(text => text.includes(relevantRender));
+    world.distractorCount = records.length - 1;
+    world.injectionPhrase = world.injected
+        ? (offset + drawD29Stream(base.split, `v8:${seedKey}:${base.slice}:${world.pool}:injections`)(pool.instructions.length)) % pool.instructions.length
+        : null;
+    const context = [];
+    const add = (text, placement) => {
+        if (placement === 0)
+            context.push(text);
+        else if (placement === 1)
+            passage.unshift(text);
+        else if (placement === 2)
+            passage.splice(Math.floor(passage.length / 2), 0, text);
+        else
+            passage.push(text);
+    };
+    for (const { text, placement } of benign)
+        add(text, placement);
+    // The slot note holds an instruction when injected and a benign counterpart
+    // clause otherwise; both replace one benign task in the same template.
+    const counterpart = pool.counterparts[content(pool.counterparts.length)];
+    const slotText = note(world.injected ? pool.instructions[world.injectionPhrase] : counterpart);
+    // The slot note's place: the injection variants (context / prefix / middle /
+    // suffix) are defined by it, so injected rows keep offset % 4; every other
+    // row draws it per offset by its own stream (round 11), so it never follows
+    // the offset arithmetic that picks the other variants.
+    const slotPlacement = prior || world.injected ? offset % 4 : drawD29Stream(base.split, `v8:${seedKey}:slot:${offset}`)(4);
+    add(annotation(slotText, layout(5)), slotPlacement);
+    const frame = pool.framing[citation ? 'citation' : 'criterion'];
+    const payload = citation ? { kind: world.kind, claim: `${fact(pool, train, world.claimModule, world.claimAttribute, world.claimValue, '', 'exact')}.`,
+        source: `${frame}\n${passage.join(' ')}`, context: context.join(' ') }
+        : { kind: world.kind, criterion: `Module ${world.claimModule} requires independently verified ${names[world.claimAttribute]} for all components of the current release.`,
+            evidence: `${frame}\n${passage.join(' ')}`, context: context.join(' ') };
+    return { ...base, world, payload };
+}
+/** Registered v8 row: same request and local-outcome shape as v7. */
+export function generateD29V8(seed, ordinal, layout) {
+    const { world, payload, split, slice, familyId, id } = d29WorldV8(seed, ordinal);
+    const hardPass = world.artifactPresent && world.testPassed;
+    if (layout !== (hardPass ? 'single' : 'local'))
+        throw new Error('generator-layout');
+    const requestNames = world.kind === 'citation' ? ['support', 'strength', 'injection']
+        : ['relevance', 'completeness', 'contradiction', 'ambiguity', 'reviewerAttention'];
+    return { id, familyId, split: split, slice, input: { payload },
+        requests: hardPass ? requestNames.map(name => ({ id: name, arm: 'candidate', definitionId: `d29-${name}` })) : [],
+        localOutcome: { artifactPresent: world.artifactPresent, testPassed: world.testPassed,
+            sourceDigest: 'source' in payload ? sha256(payload.source) : null, baseline: d29Baseline(payload, hardPass),
+            passageBaselineV1: d29PassageBaseline(payload, hardPass), passageBaseline: d29PassageBaselineV2(payload, hardPass),
+            passageBaselineV3: d29PassageBaselineV3(payload, hardPass) } };
+}
+export function d29V8RendererDigest() {
+    return sha256(readFileSync(new URL(import.meta.url), 'utf8'));
+}
+//# sourceMappingURL=d29-v8.js.map

package/dist/src/decision/heldout/generator-registry.js

@@ -0,0 +1,67 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from '../compile-cache/identity.js';
+import { generateHeldoutRow, heldoutGeneratorDigest, heldoutGeneratorFiles, reproducibleHeldoutRow } from './generators.js';
+import { D29_V8_GENERATOR_ID } from './d29-generator-ids.js';
+import { generateD29V8 } from './d29-v8.js';
+/**
+ * Held-out generator registry for generators added after the frozen
+ * `generators.ts` registry (D29 v8 onward).
+ *
+ * `generators.ts` is part of the D29 v1–v7 family digest, so editing it would
+ * move the generator pin recorded in every committed v6/v7 corpus. New
+ * generator versions therefore register here: this module answers for its
+ * own ids and delegates every other id to the frozen registry unchanged. Each
+ * new id hashes its own source list, so the v6/v7 family pin stays
+ * byte-identical while v8 pins exactly the files that produce its rows.
+ * Source-controlled only: corpus data cannot register code or supply a path.
+ */
+const D29_V8_GENERATOR_SOURCES = ['src/decision/heldout/generator-registry.ts', 'src/decision/heldout/d29-generator-ids.ts',
+    'src/decision/heldout/generators.ts', 'src/decision/compile-cache/identity.ts', 'src/security/artifact-trust.ts',
+    'src/decision/heldout/d29-v8.ts', 'src/decision/heldout/d29-pools.ts', 'src/decision/heldout/d29-pools-v8.ts',
+    'src/decision/heldout/d29-passage-baseline.ts', 'src/decision/heldout/d29-passage-baseline-v2.ts',
+    'src/decision/heldout/d29-passage-baseline-v3.ts'];
+export { D29_LATEST_GENERATOR_ID, D29_PAID_GENERATOR_IDS } from './d29-generator-ids.js';
+function generateV8(seed) {
+    const match = /^([a-z0-9][a-z0-9-]{0,31}):([0-9]{1,5}):(example|single|local)$/.exec(seed);
+    if (!match)
+        throw new Error('generator-seed');
+    const [, worldSeed, index, layout] = match;
+    return generateD29V8(worldSeed, Number(index), layout);
+}
+/** Generates one row for any registered generator id, including ids frozen in generators.ts. */
+export function generateRegisteredHeldoutRow(generatorId, seed) {
+    if (generatorId !== D29_V8_GENERATOR_ID)
+        return generateHeldoutRow(generatorId, seed);
+    const output = generateV8(seed);
+    return { ...output, provenance: { generatorId, seed, outputDigest: sha256(output) } };
+}
+/** True when the row regenerates byte-identically from its own provenance. */
+export function reproducibleRegisteredHeldoutRow(row) {
+    if (row?.provenance?.generatorId !== D29_V8_GENERATOR_ID)
+        return reproducibleHeldoutRow(row);
+    const { provenance, ...output } = row;
+    try {
+        const regenerated = generateV8(provenance.seed);
+        return sha256(regenerated) === provenance.outputDigest && sha256(output) === provenance.outputDigest;
+    }
+    catch {
+        return false;
+    }
+}
+/** Package-root-relative TypeScript sources hashed for one generator id; unknown ids refuse. */
+export function registeredHeldoutGeneratorFiles(generatorId) {
+    if (generatorId === D29_V8_GENERATOR_ID)
+        return [...D29_V8_GENERATOR_SOURCES];
+    return heldoutGeneratorFiles(generatorId);
+}
+/** Generator family digest; ids frozen in generators.ts keep their historical digest. */
+export function registeredHeldoutGeneratorDigest(generatorId) {
+    if (generatorId !== D29_V8_GENERATOR_ID)
+        return heldoutGeneratorDigest(generatorId);
+    const sources = {};
+    for (const file of D29_V8_GENERATOR_SOURCES) {
+        sources[file] = readFileSync(new URL(`../../../${file}`, import.meta.url), 'utf8');
+    }
+    return sha256(sources);
+}
+//# sourceMappingURL=generator-registry.js.map