@dzhechkov/harness-core 0.8.35 → 0.8.37

package/src/score.ts

@@ -21,6 +21,7 @@
  */
 
 import { amendmentIdsIn } from './amendment-trace.js';
+import { QE_SEVERITIES, findInvalidQeVerdictLines, parseQeFindings, readQeVerdictLines, type QeFindingsRefusedRow, type QeFindingsSummary } from './qe-findings.js';
 
 export type DisciplineVerdict = 'pass' | 'partial' | 'absent';
 
@@ -45,11 +46,29 @@ export interface RunScorecard {
    * stay distinguishable.
    */
   readonly mutationEvidence?: MutationEvidence;
+  /**
+   * qe-findings-record FR-4: where `qeGrade` came from — a machine-written `QE-VERDICT:` line, the
+   * pre-existing prose scan, or neither. ADDITIVE for the same reason as `mutationEvidence`: every
+   * scorecard built before this field existed still satisfies `RunScorecard`.
+   */
+  readonly gradeSource?: GradeSource;
+  /**
+   * qe-findings-record FR-4: the report's Findings ledger, when one exists. `absent` for the 406
+   * pre-existing reports that carry neither the table nor the heading (NFR-1) — never omitted, for
+   * the same "gate never ran vs a field an older scorer never wrote" reason `mutationEvidence` gives.
+   */
+  readonly findings?: QeFindingsScoreView;
   readonly passed: number;
   readonly total: number;
   readonly summary: string;
 }
 
+/** A lighter projection of `QeFindingsResult` for the scorecard — summary + refused + hollow, never
+ *  the full row list (that stays in `parseQeFindings`'s own return value for a caller that wants it). */
+export type QeFindingsScoreView =
+  | { readonly status: 'absent' }
+  | { readonly status: 'present'; readonly hollow: boolean; readonly summary: QeFindingsSummary; readonly refused: readonly QeFindingsRefusedRow[] };
+
 /** The artifact texts of one run, keyed by RELATIVE path under `features/<slug>/`. */
 /**
  * The exact heading Step 5 asks for, and the exact heading the check looks for — ONE constant, so
@@ -306,7 +325,22 @@ function normaliseGradeSign(grade: string): string {
   return grade.replace('\u2212', '-');
 }
 
-export type GradeReadStatus = 'unique' | 'ambiguous' | 'none';
+/**
+ * fix-round-1 (codex-r1-verdict finding 2): `'invalid'` is a report that ATTEMPTED a machine verdict
+ * (a line starting `QE-VERDICT`, any case/spacing) and got the grammar wrong — `QE-VERDICT: B – final`
+ * (en dash + trailing prose), wrong case, no colon, a grade outside A-D. That is a DIFFERENT fact from
+ * `'none'` (no attempt at all, legacy prose scan still applies): a malformed attempt must never fall
+ * back to guessing a grade from prose — the malformed line is itself evidence the report is unreliable
+ * here, and guessing past it would silently launder that unreliability into a confident number.
+ */
+export type GradeReadStatus = 'unique' | 'ambiguous' | 'none' | 'invalid';
+
+/**
+ * qe-findings-record (ADR-001 D1): where the grade came from. `'verdict-line'` — a machine-written
+ * `QE-VERDICT:` line, the source of truth when present. `'prose'` — the pre-existing GRADE_RE scan,
+ * unchanged, used only when NO verdict line exists. `'none'` — neither surface names a grade.
+ */
+export type GradeSource = 'verdict-line' | 'prose' | 'none';
 
 export interface GradeReading {
   readonly status: GradeReadStatus;
@@ -314,6 +348,7 @@ export interface GradeReading {
   readonly grade: string | null;
   /** Every distinct grade found, normalised — what makes an `ambiguous` verdict inspectable. */
   readonly found: readonly string[];
+  readonly source: GradeSource;
 }
 
 /**
@@ -329,6 +364,44 @@ export interface GradeReading {
  * report is ambiguous, which is a fact about the report, not a missing number.
  */
 export function readQeGrade(qeText: string): GradeReading {
+  // ADR-001 D1: a machine-written verdict line is the source of truth WHEN it exists — checked
+  // first, and the prose scan below never runs when it does. Exactly one -> unique; more than one
+  // -> ambiguous ("две строки — ambiguous, никогда «последняя побеждает»", even if both name the
+  // SAME grade — two lines is a fact about the report, not a number to reconcile); zero -> the
+  // prose scan runs exactly as it always has (NFR-1: 406 pre-existing reports are unaffected) —
+  // UNLESS a malformed attempt exists (fix-round-1 finding 2, checked next): the report is `invalid`
+  // and the prose fallback is refused, never silently reached.
+  const verdictLines = readQeVerdictLines(qeText);
+  // Lead delta after Codex r2 (new HIGH #1): a malformed declaration next to a valid one is NOT a
+  // unique verdict — `QE-VERDICT: A` + `qe-verdict: D` used to read as unique A. Invalid lines are
+  // checked FIRST, whatever the count of valid ones.
+  const invalidFirst = findInvalidQeVerdictLines(qeText);
+  if (invalidFirst.length > 0) {
+    const reasons = invalidFirst.map(
+      (l) => `line ${l.line}: ${JSON.stringify(l.text.trim())} does not match "QE-VERDICT: <A|B|C|D><+|-> "`,
+    );
+    return { status: 'invalid', grade: null, found: [...verdictLines, ...reasons], source: 'verdict-line' };
+  }
+  if (verdictLines.length === 1) {
+    return { status: 'unique', grade: verdictLines[0] as string, found: verdictLines, source: 'verdict-line' };
+  }
+  if (verdictLines.length > 1) {
+    const distinct: string[] = [];
+    for (const g of verdictLines) if (!distinct.includes(g)) distinct.push(g);
+    return { status: 'ambiguous', grade: null, found: distinct, source: 'verdict-line' };
+  }
+
+  // fix-round-1 finding 2: zero GRAMMATICALLY VALID verdict lines is not yet "no attempt" — a line
+  // that clearly opens a verdict declaration but botches the grammar (wrong dash, wrong case, no
+  // colon, a grade outside A-D) is `invalid`, and the legacy prose scan below is FORBIDDEN for it.
+  // The reason lives inside `found` (GradeReading keeps the same 4-field shape for every status).
+  // Lead delta after Codex r2 (#2 PARTIAL): the prose fallback is for LEGACY reports only. A report
+  // that already carries the new-format ledger heading but no verdict line is a NEW-format report
+  // missing its verdict — `invalid`, never a prose guess.
+  if (/^## Findings ledger\s*$/m.test(qeText)) {
+    return { status: 'invalid', grade: null, found: ['new-format report (has "## Findings ledger") without a QE-VERDICT line'], source: 'verdict-line' };
+  }
+
   const found: string[] = [];
   const lines = qeText.split('\n');
   // Line offsets once, so each match maps to ITS line for the negation screen (67d7883d: the
@@ -352,9 +425,9 @@ export function readQeGrade(qeText: string): GradeReading {
     const g = normaliseGradeSign(m[1] as string);
     if (!found.includes(g)) found.push(g);
   }
-  if (found.length === 0) return { status: 'none', grade: null, found: [] };
-  if (found.length === 1) return { status: 'unique', grade: found[0] as string, found };
-  return { status: 'ambiguous', grade: null, found };
+  if (found.length === 0) return { status: 'none', grade: null, found: [], source: 'none' };
+  if (found.length === 1) return { status: 'unique', grade: found[0] as string, found, source: 'prose' };
+  return { status: 'ambiguous', grade: null, found, source: 'prose' };
 }
 
 export function extractQeGrade(qeText: string): string | null {
@@ -451,7 +524,13 @@ export function scoreRun(slug: string, artifacts: RunArtifacts): RunScorecard {
   );
 
   // 3. Cross-model QE — an independent family reviewed it, and a grade exists.
-  const grade = extractQeGrade(qeText);
+  const gradeReading = readQeGrade(qeText);
+  const grade = gradeReading.grade;
+  const findingsParsed = parseQeFindings(qeText);
+  const findings: QeFindingsScoreView =
+    findingsParsed.status === 'absent'
+      ? { status: 'absent' }
+      : { status: 'present', hollow: findingsParsed.hollow, summary: findingsParsed.summary, refused: findingsParsed.refused };
   if (qeText === '') {
     add('cross-model-qe', 'independent cross-model review with a grade', 'absent', 'no 08_qe_report.md artifact');
   } else {
@@ -559,11 +638,36 @@ export function scoreRun(slug: string, artifacts: RunArtifacts): RunScorecard {
     (grade !== null ? ` · QE grade ${grade}` : ' · no QE grade') +
     (worst.length > 0 ? ` · absent: ${worst.join(', ')}` : '');
 
-  return { slug, disciplines, qeGrade: grade, mutationEvidence, passed, total, summary };
+  return { slug, disciplines, qeGrade: grade, gradeSource: gradeReading.source, findings, mutationEvidence, passed, total, summary };
 }
 
 const MARK: Record<DisciplineVerdict, string> = { pass: '✓', partial: '◐', absent: '✗' };
 
+/** qe-findings-record FR-4: the one-line summary `dz score` prints for a report's Findings ledger —
+ *  "findings: 3 HIGH / 2 MEDIUM; 1 refused (line 84: severity "Major" not in dictionary)". Ordered by
+ *  QE_SEVERITIES (BLOCKER first) so the worst finding always reads first. `null` when there is no
+ *  table at all — the common case, which earns no noise (same rule as mutationEvidence above). */
+export function renderFindingsLine(findings: QeFindingsScoreView | undefined): string | null {
+  if (findings === undefined || findings.status === 'absent') return null;
+  // fix-round-1 finding 6: hollow used to short-circuit BEFORE the refused check, so a report whose
+  // real ledger table (with CRITICAL rows) was refused as duplicate/outside-section alongside an
+  // empty accepted table read as pure "EMPTY" — the refused rows vanished from the printed line, not
+  // merely from the tally. Both facts are ALWAYS reported together now; neither hides the other.
+  const refusedSuffix = ((): string => {
+    if (findings.refused.length === 0) return '';
+    const first = findings.refused[0] as QeFindingsRefusedRow;
+    const more = findings.refused.length > 1 ? `, +${findings.refused.length - 1} more` : '';
+    return `; ${findings.refused.length} refused (line ${first.line}: ${first.reason})${more}`;
+  })();
+  if (findings.hollow) {
+    return `findings: table present but EMPTY (hollow) — worse than no table at all${refusedSuffix}`;
+  }
+  const bySev = findings.summary.bySeverity;
+  const parts = QE_SEVERITIES.filter((s) => (bySev[s] ?? 0) > 0).map((s) => `${bySev[s]} ${s}`);
+  const head = parts.length > 0 ? parts.join(' / ') : 'no rows';
+  return `findings: ${head}${refusedSuffix}`;
+}
+
 export function renderScorecard(card: RunScorecard): string {
   const out: string[] = [];
   out.push(`dz score — ${card.slug} (process scorecard; descriptive-only, never a gate)`);
@@ -581,6 +685,11 @@ export function renderScorecard(card: RunScorecard): string {
     out.push('');
     out.push(`  ${card.mutationEvidence.evidence}`);
   }
+  const findingsLine = renderFindingsLine(card.findings);
+  if (findingsLine !== null) {
+    out.push('');
+    out.push(`  ${findingsLine}${card.gradeSource !== undefined && card.gradeSource !== 'none' ? ` (grade source: ${card.gradeSource})` : ''}`);
+  }
   out.push('');
   out.push(`  ${card.summary}`);
   return out.join('\n');

package/src/vector-tier.ts

@@ -1158,13 +1158,87 @@ export interface RankedPattern {
 
 const RRF_K = 60;
 
+/**
+ * One entry in the total order every post-merge ranking step shares (feature
+ * `recall-parity-tie-break`, FR-1). `evidence` is the SAME three-way rank `mergeHybridHits` has
+ * always used (`both` < lexical-only < semantic-only — lower is stronger), computed once by
+ * {@link evidenceRank} from a hit's `backend`.
+ */
+export interface HybridOrderKey {
+  readonly score: number;
+  readonly evidence: number;
+  readonly dzId: string;
+}
+
+/** `both` outranks lexical-only outranks semantic-only (mergeHybridHits' own rule, ADR-001 AM-4). */
+export function evidenceRank(backend: RecallHit['backend']): number {
+  return backend === 'both' ? 0 : backend === 'vector' ? 2 : 1;
+}
+
+/**
+ * The ONE deterministic total order recall uses at every step where a tie can occur: fused score
+ * DESC, then EVIDENCE (both > lexical-only > semantic-only), then `dzId` ASC. `mergeHybridHits`
+ * always applied exactly this rule inline; it is exported here (FR-1) so `dampQuarantined`,
+ * `orderHitsForReRank` (the pre-sort `enhance()` runs before its reinforcement/bandit re-rank) and
+ * any other post-merge sort can share the SAME tiebreak instead of an ad hoc score-only comparator
+ * that is deterministic only because its input already arrived pre-ordered — a property that
+ * silently breaks the moment an upstream step feeds it hits in a different order
+ * (recall-parity-tie-break T0: MEASURED, `apply-leg-recall-parity.test.ts` AM-4, a racy
+ * reinforcement-signal read, not a comparator defect, actually explained the observed tail swap —
+ * this comparator is hardening kept from that round; the actual causal fix, per fix-round 1, is the
+ * byte-level store snapshot AM-4 now takes, not this comparator and not an awaited flush).
+ *
+ * FINITE-NUMBER INVARIANT (fix-round 1, LOW finding): plain subtraction (`b.score - a.score`) is
+ * NOT total over `number` — `NaN - x` is `NaN`, and the `||` chain treats a `NaN` term as falsy,
+ * silently SKIPPING it and falling through to the next key as if score had never been compared.
+ * Both terms below use explicit `>`/`<` comparisons instead (correct as-is for ±Infinity — IEEE 754
+ * orders infinities correctly) plus an explicit NaN case: a `NaN` score or evidence is the WEAKEST
+ * possible value on its own axis, so it sorts deterministically LAST, never a coincidental tie.
+ */
+function compareScoreDesc(a: number, b: number): number {
+  if (Number.isNaN(a) || Number.isNaN(b)) return Number.isNaN(a) && Number.isNaN(b) ? 0 : Number.isNaN(a) ? 1 : -1;
+  return a > b ? -1 : a < b ? 1 : 0;
+}
+function compareEvidenceAsc(a: number, b: number): number {
+  if (Number.isNaN(a) || Number.isNaN(b)) return Number.isNaN(a) && Number.isNaN(b) ? 0 : Number.isNaN(a) ? 1 : -1;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+export function compareHybridHits(a: HybridOrderKey, b: HybridOrderKey): number {
+  return compareScoreDesc(a.score, b.score)
+    || compareEvidenceAsc(a.evidence, b.evidence)
+    || (a.dzId < b.dzId ? -1 : a.dzId > b.dzId ? 1 : 0);
+}
+
+/**
+ * Sorts `hits` into the shared total order {@link compareHybridHits} defines — used by `enhance()`
+ * BEFORE its reinforcement/bandit re-rank runs (`applyLearningSignalsWithTerms` et al.,
+ * `learning-backend.ts`, out of this fix's edit scope). That re-rank sorts by an ADJUSTED score
+ * with a STABLE tie-break on each hit's ORIGINAL array position — so pre-ordering the input here
+ * makes any tie in the adjusted score resolve in the SAME evidence/dzId order `compareHybridHits`
+ * would give directly, without touching the re-rank's own internals.
+ *
+ * This closes the ordering gap `enhance()` had (recall-parity-tie-break fix-round 1, HIGH finding):
+ * `dampQuarantined` only ran {@link compareHybridHits} when `memory.learning.quarantine` was ON;
+ * with it OFF (the default), `enhance()`'s final order was whatever the re-rank's own
+ * original-index tie-break happened to preserve — invisible from the printed `score` column,
+ * because the re-rank reorders the hit array but never rewrites `.score`. Real (non-tied) score
+ * differences from reinforcement/bandit re-ranking are UNCHANGED by this — it only decides ties.
+ */
+export function orderHitsForReRank(hits: readonly HybridHit[], idOf: (p: PatternRecord) => string): HybridHit[] {
+  return [...hits].sort((a, b) => compareHybridHits(
+    { score: a.score, evidence: evidenceRank(a.backend), dzId: idOf(a.pattern) },
+    { score: b.score, evidence: evidenceRank(b.backend), dzId: idOf(b.pattern) },
+  ));
+}
+
 /**
  * Reciprocal Rank Fusion merge: `score(p) = Σ 1/(60 + rank)` over the lists containing `p`
  * (semantic ranks weighted by `semanticWeight`). Dedup by id; `backend: 'both'` when a pattern
  *
- * Ordering: fused score, then EVIDENCE (`both` before lexical-only before semantic-only), then id.
- * When `semanticWeight > 1` the lexical top-1 is guaranteed a place in the result, taken from the
- * last seat unless that seat holds a `both` hit. See `features/semantic-keeps-exact-hits`.
+ * Ordering: fused score, then EVIDENCE (`both` before lexical-only before semantic-only), then id
+ * — {@link compareHybridHits}. When `semanticWeight > 1` the lexical top-1 is guaranteed a place in
+ * the result, taken from the last seat unless that seat holds a `both` hit. See
+ * `features/semantic-keeps-exact-hits`.
  *
  * appears in both lists. DETERMINISTIC (AC-6): ties break on id, so fixed inputs always yield
  * the same ordering. Pure — no I/O.
@@ -1196,12 +1270,14 @@ export function mergeHybridHits(
   });
   // Ties break by EVIDENCE, not by the id alphabet: a hit both legs found outranks one only a single
   // leg found. Before this, an exact-term match lost a tie to an arbitrary semantic hit purely
-  // because its id sorted later (ADR-001 AM-4).
-  const evidence = (v: Acc): number => (v.lex !== undefined && v.sem ? 0 : v.lex !== undefined ? 1 : 2);
+  // because its id sorted later (ADR-001 AM-4). Now routed through the shared {@link
+  // compareHybridHits} (FR-1) — same three-part rule, no behaviour change.
+  const evidenceOfAcc = (v: Acc): number => evidenceRank(v.lex !== undefined && v.sem ? 'both' : v.lex ?? 'vector');
   const ordered = [...acc.entries()]
-    .sort((a, b) => b[1].score - a[1].score
-      || evidence(a[1]) - evidence(b[1])
-      || (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+    .sort((a, b) => compareHybridHits(
+      { score: a[1].score, evidence: evidenceOfAcc(a[1]), dzId: a[0] },
+      { score: b[1].score, evidence: evidenceOfAcc(b[1]), dzId: b[0] },
+    ));
   const toHit = ([, v]: [string, Acc]): HybridHit => ({
     pattern: v.pattern,
     backend: v.lex !== undefined && v.sem ? ('both' as const) : v.lex ?? ('vector' as const),
@@ -1256,6 +1332,27 @@ export function mergeHybridHits(
  *
  * `bandit` is passed ONLY when `memory.learning.banditRerank` is armed; when it is absent this
  * function is byte-identical to its pre-feature self — no state file, no lock, no allocation.
+ *
+ * `backend.train()` fires FIRE-AND-FORGET (`void backend.train().catch(() => undefined)`) — this is
+ * a REVERT (recall-parity-tie-break, fix-round 1, MEDIUM finding). An intermediate version of this
+ * fix AWAITED the flush, on the theory that a caller's own reinforcement write landing before it got
+ * an answer would remove the race `apply-leg-recall-parity.test.ts` AM-4 was catching (two tail hits
+ * swapping order between the daemon's `op:recall` reply and a `dz recall --json` invoked a moment
+ * later — MEASURED byte-identical `score` fields, only `uses` differed, so the merge/comparator was
+ * never the cause). MEASURED (lead, 2026-09-15 15:57, temp project, 8 lexical hits, 5 warm runs):
+ * `recallHybrid` took 2 ms with `onRecallHits:false` (no flush at all) vs 57–131 ms with the flush
+ * AWAITED — landing INSIDE the hook's 500 ms `HOOK_RECALL_BUDGET_MS` but a real, avoidable tax on
+ * every recall, for a property the await did not even fully deliver: the awaited write still let a
+ * CLI invoked immediately after the daemon see the DAEMON'S OWN just-computed exposure for that same
+ * query, answering a subtly different question than the daemon had. AM-4 now proves parity by taking
+ * a byte-level SNAPSHOT of the store BEFORE each query's daemon call and pointing `dz recall --json`
+ * at the frozen snapshot (`--project <snapshot>`) — both sides then answer the identical question
+ * from the identical state under PRODUCTION defaults (`onRecallHits` ON), and no write, awaited or
+ * not, can reach the CLI's read. That snapshot is what actually closes the race; this function stays
+ * fire-and-forget, exactly as it always was, because the snapshot makes its timing irrelevant to the
+ * test. `test/lesson-bandit-byte-identity.test.ts` documents the same underlying race in its own
+ * fixture comment and works around it with `onRecallHits: false` there — a narrower, still-valid
+ * isolation for a different test's needs.
  */
 function markRecallHits(
   projectRoot: string,
@@ -1356,7 +1453,15 @@ export async function recallHybrid(
         const q = rec !== undefined && readQuarantineState(rec).quarantined;
         return q ? { ...h, score: h.score * memCfg.quarantineDamp, quarantined: true as const } : h;
       })
-      .sort((a, b) => b.score - a.score);
+      // FR-1 (recall-parity-tie-break): score-only used to rely on the INCOMING array already
+      // being pre-ordered (native Array.sort is stable, so a genuine tie only stayed put by
+      // accident of arrival order). Routed through the same {@link compareHybridHits} the merge
+      // uses, so damping two equally-scored hits can never reorder them differently from how the
+      // merge itself would have.
+      .sort((a, b) => compareHybridHits(
+        { score: a.score, evidence: evidenceRank(a.backend), dzId: idOf(a.pattern) },
+        { score: b.score, evidence: evidenceRank(b.backend), dzId: idOf(b.pattern) },
+      ));
   };
   // lesson-bandit-rerank (ADR-001): the payoff axis. Resolved ONCE per recall; `enabled:false` ⇒
   // the Lesson Payoff context is NEVER CONSTRUCTED — the branch is taken BEFORE any work, so the
@@ -1366,7 +1471,15 @@ export async function recallHybrid(
   let banditReport: BanditRecallReport | undefined;
   let banditExplored: readonly string[] = [];
   const enhance = (hits: readonly HybridHit[]): HybridHit[] => {
-    const candidates = hits.map((h) => {
+    // FR-1 (recall-parity-tie-break, fix-round 1, HIGH finding): pre-sort into the shared total
+    // order BEFORE the reinforcement/bandit re-rank runs — see {@link orderHitsForReRank}.
+    // Why the pre-sort is sufficient and not "reliance on a stable sort" (Codex round 2): the
+    // re-rank's own sort in learning-backend.ts is `b.adjusted - a.adjusted || a.i - b.i` — an
+    // EXPLICIT tie-break on the incoming index, so an adjusted-score tie resolves to exactly the
+    // order built here (score → evidence → dzId), by construction, on any engine. That generic
+    // function only knows `score`, so it cannot call compareHybridHits itself.
+    const ordered = orderHitsForReRank(hits, idOf);
+    const candidates = ordered.map((h) => {
       const dzId = idOf(h.pattern);
       const rec = idToRecord.get(dzId);
       return { dzId, score: h.score, reinforcement: rec !== undefined ? readReinforcementState(rec) : undefined };
@@ -1392,8 +1505,8 @@ export async function recallHybrid(
         ? []
         : [{ id: 'delta', byIndex: candidates.map((c) => deltaMap.get(c.dzId) ?? 0), cap: REINFORCE_RRF_CAP }];
       // The SAME ranking without the payoff term — the only honest way to say what the term moved.
-      const before = dampQuarantined(applyLearningSignalsWithTerms(hits, learning, candidates, REINFORCE_RRF_CAP, baseTerms));
-      const after = dampQuarantined(applyLearningSignalsWithTerms(hits, learning, candidates, REINFORCE_RRF_CAP, [
+      const before = dampQuarantined(applyLearningSignalsWithTerms(ordered, learning, candidates, REINFORCE_RRF_CAP, baseTerms));
+      const after = dampQuarantined(applyLearningSignalsWithTerms(ordered, learning, candidates, REINFORCE_RRF_CAP, [
         ...baseTerms,
         // ADDED, never assigned, and pre-bounded to [-1,+1] by the ACL — so `squash` is identity and
         // `cap` is an EXACT bound on this term's contribution (INV-4).
@@ -1423,9 +1536,9 @@ export async function recallHybrid(
     }
     if (deltaMap !== undefined) {
       const deltaByIndex = candidates.map((c) => deltaMap.get(c.dzId) ?? 0);
-      return dampQuarantined(applyLearningSignalsWithDelta(hits, learning, candidates, REINFORCE_RRF_CAP, deltaByIndex, REINFORCE_RRF_CAP));
+      return dampQuarantined(applyLearningSignalsWithDelta(ordered, learning, candidates, REINFORCE_RRF_CAP, deltaByIndex, REINFORCE_RRF_CAP));
     }
-    return dampQuarantined(applyLearningSignals(hits, learning, candidates, REINFORCE_RRF_CAP));
+    return dampQuarantined(applyLearningSignals(ordered, learning, candidates, REINFORCE_RRF_CAP));
   };
   /** The exposure/telemetry payload for `markRecallHits` — `undefined` while disarmed (INV-1). */
   const banditEmission = (): { readonly contextKey: string; readonly explored: readonly string[]; readonly moved: number; readonly arms: number; readonly deferred?: boolean } | undefined =>