@evomap/evolver-core 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/assetstore/provider.js

@@ -1,4 +1,87 @@
-import { computeAssetId, verifyAssetId } from '../wire/index.js';
+import { canonicalize, computeAssetId, verifyAssetId } from '../wire/index.js';
+export class FrozenAssetIdCollisionError extends Error {
+    assetId;
+    code = 'FROZEN_ASSET_ID_COLLISION';
+    constructor(assetId) {
+        super('frozen asset_id already exists with different content');
+        this.assetId = assetId;
+        this.name = 'FrozenAssetIdCollisionError';
+    }
+}
+export class InvalidFrozenPutResultError extends Error {
+    code = 'INVALID_FROZEN_PUT_RESULT';
+    constructor() {
+        super('invalid frozen put result');
+        this.name = 'InvalidFrozenPutResultError';
+    }
+}
+export function frozenAssetRecordsEqual(left, right) {
+    return canonicalize(left) === canonicalize(right);
+}
+export function validateFrozenPutResult(value, expectedAssetId) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new InvalidFrozenPutResultError();
+    const result = value;
+    if (result['asset_id'] !== expectedAssetId
+        || typeof result['stored'] !== 'boolean'
+        || result['verified'] !== false) {
+        throw new InvalidFrozenPutResultError();
+    }
+    return value;
+}
+export class InvalidConditionalPutResultError extends Error {
+    reason;
+    code = 'INVALID_CONDITIONAL_PUT_RESULT';
+    constructor(reason) {
+        super(`invalid conditional put result: ${reason}`);
+        this.reason = reason;
+        this.name = 'InvalidConditionalPutResultError';
+    }
+}
+/** Validate an injected provider response before callers treat it as an explicit write/no-write decision. */
+export function validateConditionalPutResult(value, expectedAssetId, options) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new InvalidConditionalPutResultError('malformed_result');
+    }
+    const result = value;
+    const status = result['status'];
+    const collisionWithAssetId = result['collisionWithAssetId'];
+    if (typeof result['asset_id'] !== 'string'
+        || typeof result['stored'] !== 'boolean'
+        || typeof result['verified'] !== 'boolean'
+        || (status !== 'stored' && status !== 'already_exists' && status !== 'logical_collision')
+        || (result['logicalId'] !== undefined
+            && (typeof result['logicalId'] !== 'string'
+                || !result['logicalId'].trim()
+                || result['logicalId'] !== result['logicalId'].trim()))
+        || (collisionWithAssetId !== undefined
+            && (typeof collisionWithAssetId !== 'string'
+                || !collisionWithAssetId.trim()
+                || collisionWithAssetId !== collisionWithAssetId.trim()))) {
+        throw new InvalidConditionalPutResultError('malformed_result');
+    }
+    if (result['asset_id'] !== expectedAssetId) {
+        throw new InvalidConditionalPutResultError('asset_id_mismatch');
+    }
+    if (result['stored'] !== (status === 'stored')) {
+        throw new InvalidConditionalPutResultError('inconsistent_status');
+    }
+    const allowLogicalCollision = options?.allowLogicalCollision === true;
+    if (status === 'logical_collision'
+        && (!collisionWithAssetId || collisionWithAssetId === expectedAssetId || allowLogicalCollision)) {
+        throw new InvalidConditionalPutResultError('invalid_collision');
+    }
+    if (status === 'stored' && collisionWithAssetId && !allowLogicalCollision) {
+        throw new InvalidConditionalPutResultError('collision_bypass');
+    }
+    return value;
+}
+export function supportsAtomicConditionalPut(provider) {
+    return typeof provider.putConditional === 'function';
+}
+export function supportsAtomicFrozenConditionalPut(provider) {
+    return typeof provider.putFrozenConditional === 'function';
+}
 export class AssetIdMismatchError extends Error {
     claimed;
     actual;
@@ -12,6 +95,18 @@ export class AssetIdMismatchError extends Error {
 export class CapsuleGeneBindingError extends Error {
     constructor() { super('Capsule.gene 必须非空或显式 "ad-hoc" 哨兵 (批注#28/M3-4)'); this.name = 'CapsuleGeneBindingError'; }
 }
+/**
+ * M3-4 强绑定校验: Capsule.gene 必须非空(否则一条无来源基因的经验会污染选择池).
+ * 抽成独立 helper 以便 normalizeForPut(校验落库路径)与 ingestUnverified(冻结落库路径,
+ * 绕过 normalizeForPut)共用同一条不变量,不让降级路径把绑定校验漏掉.
+ */
+export function assertCapsuleGeneBinding(asset) {
+    if (asset.type !== 'Capsule')
+        return;
+    const gene = asset.gene;
+    if (typeof gene !== 'string' || gene.length === 0)
+        throw new CapsuleGeneBindingError();
+}
 /**
  * 落库前规范化(共享给各 provider): 计算/校验 asset_id + 强绑定校验.
  * - 缺 asset_id → 计算填入(verified=false 表示非入参自带).
@@ -19,11 +114,7 @@ export class CapsuleGeneBindingError extends Error {
  * - Capsule.gene 必须非空(M3-4 强绑定).
  */
 export function normalizeForPut(asset) {
-    if (asset.type === 'Capsule') {
-        const gene = asset.gene;
-        if (typeof gene !== 'string' || gene.length === 0)
-            throw new CapsuleGeneBindingError();
-    }
+    assertCapsuleGeneBinding(asset);
     const actual = computeAssetId(asset);
     if (actual === null)
         throw new Error('computeAssetId 失败: 资产非对象');

package/dist/assetstore/reviewFilter.d.ts

@@ -1,5 +1,5 @@
 import type { AssetStoreProvider, AssetRecord } from './provider.js';
-import { ReviewLedger } from './reviewLedger.js';
+import { ReviewLedger, type ReviewRecord } from './reviewLedger.js';
 import { ProvenanceStore } from './provenance.js';
 /**
  * The ReviewLedger CO-LOCATED with a store — its quarantine/approve records live in the SAME dir as the genes.
@@ -17,4 +17,22 @@ export declare function provenanceStoreForStore(store: AssetStoreProvider): Prov
  * quarantined or rejected draft is withheld. A gene with NO provenance record is trusted; hub-ingested genes are
  * withheld until promotion. This mirrors candidateAssembly's trust-first + review-first filters.
  */
+/**
+ * Authoritative pending-review queue: quarantined ledger records, oldest first.
+ * Callers that display a human queue MUST start here instead of `store.list`, or a
+ * draft sitting past the newest-N cutoff is invisible even though it is still blocked.
+ */
+export declare function pendingReviewRecords(review: ReviewLedger, excludeAssetIds?: ReadonlySet<string>): ReviewRecord[];
+/**
+ * Pending Gene queue with the asset store as the type/existence authority.
+ *
+ * ReviewLedger is intentionally generic because the same sidecar also records
+ * AntiGene decisions. A quarantined row can also outlive its asset after a
+ * repair or a truncated migration. Human Gene queues must therefore resolve
+ * every row through the provider instead of treating the ledger alone as a
+ * complete inventory. The lookups are deliberately sequential so a malformed
+ * or unexpectedly large ledger cannot fan out an unbounded request burst to a
+ * remote provider.
+ */
+export declare function pendingGeneReviewRecords(store: AssetStoreProvider, review: ReviewLedger): Promise<ReviewRecord[]>;
 export declare function listApprovedGenes(store: AssetStoreProvider, review: ReviewLedger, maxGenes: number, provenance?: ProvenanceStore): Promise<AssetRecord[]>;

package/dist/assetstore/reviewFilter.js

@@ -28,14 +28,52 @@ export function provenanceStoreForStore(store) {
  * quarantined or rejected draft is withheld. A gene with NO provenance record is trusted; hub-ingested genes are
  * withheld until promotion. This mirrors candidateAssembly's trust-first + review-first filters.
  */
+/**
+ * Authoritative pending-review queue: quarantined ledger records, oldest first.
+ * Callers that display a human queue MUST start here instead of `store.list`, or a
+ * draft sitting past the newest-N cutoff is invisible even though it is still blocked.
+ */
+export function pendingReviewRecords(review, excludeAssetIds = new Set()) {
+    return review.records()
+        .filter((record) => record.state === 'quarantined' && !excludeAssetIds.has(record.assetId))
+        .sort((a, b) => a.at.localeCompare(b.at));
+}
+/**
+ * Pending Gene queue with the asset store as the type/existence authority.
+ *
+ * ReviewLedger is intentionally generic because the same sidecar also records
+ * AntiGene decisions. A quarantined row can also outlive its asset after a
+ * repair or a truncated migration. Human Gene queues must therefore resolve
+ * every row through the provider instead of treating the ledger alone as a
+ * complete inventory. The lookups are deliberately sequential so a malformed
+ * or unexpectedly large ledger cannot fan out an unbounded request burst to a
+ * remote provider.
+ */
+export async function pendingGeneReviewRecords(store, review) {
+    const pending = pendingReviewRecords(review);
+    // LocalJsonlProvider 可直接使用内存索引精确回答，避免 sidecar 变大后逐行等待查询。
+    if (store instanceof LocalJsonlProvider) {
+        const geneIds = new Set(store.listAll('Gene').map((asset) => asset.asset_id));
+        return pending.filter((record) => geneIds.has(record.assetId));
+    }
+    const genes = [];
+    for (const record of pending) {
+        const asset = await store.get(record.assetId);
+        if (asset?.type === 'Gene')
+            genes.push(record);
+    }
+    return genes;
+}
 export async function listApprovedGenes(store, review, maxGenes, provenance = provenanceStoreForStore(store)) {
     const all = await store.list('Gene', GENE_SCAN_LIMIT);
     const trust = provenance.snapshot();
+    const reviewed = review.snapshot();
     const approved = [];
     for (const g of all) {
         if (trust.get(String(g.asset_id))?.trusted === false)
             continue; // hub-untrusted → withhold until promoted
-        if (!review.isApproved(String(g.asset_id)))
+        const reviewRecord = reviewed.get(String(g.asset_id));
+        if (reviewRecord !== undefined && reviewRecord.state !== 'approved')
             continue; // quarantined/rejected draft → withhold
         approved.push(g);
         if (approved.length >= maxGenes)

package/dist/assetstore/reviewLedger.d.ts

@@ -18,13 +18,17 @@ export interface ReviewRecord {
 export declare class ReviewLedger {
     private readonly now;
     private readonly path;
+    private readonly lockPath;
     private readonly index;
-    private sig;
+    private fileState;
     constructor(baseDir: string, now?: () => number);
     private static isHuman;
     /** Which record wins for an asset_id: a human decision beats a quarantine; otherwise the later one wins. */
     private static keep;
-    private load;
+    private rebuildIndex;
+    private refreshUnderLock;
+    private withFreshRead;
+    private appendUnderLock;
     /** Record a review-state for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec: Omit<ReviewRecord, 'at'> & {
         at?: string;
@@ -50,6 +54,8 @@ export declare class ReviewLedger {
      * asset list, so a draft awaiting approval is never missed behind a store-list cutoff.
      */
     records(): ReviewRecord[];
+    /** One linearizable review snapshot for bounded batch readers. */
+    snapshot(): ReadonlyMap<string, ReviewRecord>;
     /** No record → approved (default eligible); a record → approved only when its state is 'approved'. */
     isApproved(assetId: string): boolean;
     /**

package/dist/assetstore/reviewLedger.js

@@ -8,8 +8,12 @@
 //
 // Default (no record) = approved/eligible: the only writer of quarantine records is `--distill`; cycle-self-
 // produced and v1-migrated genes are never quarantined, so the explore→prove loop is untouched for them.
-import { appendFileSync, existsSync, readFileSync, mkdirSync, statSync } from 'node:fs';
 import { join, dirname } from 'node:path';
+import { appendUtf8Durable, assertAssetStoreDirectory, ensureAssetStoreDirectory, readUtf8Regular, regularFileFingerprint, withAssetStoreLock, } from './assetStoreStorage.js';
+import { assertTrustSidecarHealthy, parseReviewRecord, parseSidecarJsonl, } from './assetSidecarRecords.js';
+function immutableRecord(record) {
+    return Object.freeze({ ...record });
+}
 /**
  * Append-only JSONL sidecar at <baseDir>/review.jsonl. Default for an asset with NO record = approved (eligible):
  * only auto-distilled drafts are quarantined here; everything else is eligible by default.
@@ -22,11 +26,14 @@ import { join, dirname } from 'node:path';
 export class ReviewLedger {
     now;
     path;
+    lockPath;
     index = new Map();
-    sig = ''; // `${mtimeMs}:${size}` of review.jsonl at the last index build; '' = never loaded / file absent
+    fileState = null;
     constructor(baseDir, now = Date.now) {
         this.now = now;
+        ensureAssetStoreDirectory(baseDir);
         this.path = join(baseDir, 'review.jsonl');
+        this.lockPath = join(baseDir, '.assetstore.lock');
     }
     static isHuman(s) { return s === 'approved' || s === 'rejected'; }
     /** Which record wins for an asset_id: a human decision beats a quarantine; otherwise the later one wins. */
@@ -37,43 +44,50 @@ export class ReviewLedger {
             return r; // human decision always wins (and later human beats earlier)
         return ReviewLedger.isHuman(existing.state) ? existing : r; // a quarantine replaces only a prior quarantine
     }
-    // Reload-aware (not load-once): the resident `autoexec` daemon holds ONE ReviewLedger, yet an operator runs
-    // `evolver review --approve` in a SEPARATE process. Re-read review.jsonl whenever its mtime+size changed, so a
-    // live approval lifts a quarantined gene without restarting the daemon. The file is small and queried at most
-    // once per cycle, so a statSync per query is cheap. (mtime alone can collide within one ms → pair it with size.)
-    load() {
-        if (!existsSync(this.path)) {
-            this.index.clear();
-            this.sig = '';
-            return;
-        }
-        const st = statSync(this.path);
-        const sig = `${st.mtimeMs}:${st.size}`;
-        if (sig === this.sig)
-            return; // unchanged since last read → cached index is current
-        this.index.clear();
-        for (const line of readFileSync(this.path, 'utf8').split('\n')) {
-            if (!line.trim())
-                continue;
-            try {
-                const r = JSON.parse(line);
-                if (r.assetId)
-                    this.index.set(r.assetId, ReviewLedger.keep(this.index.get(r.assetId), r));
+    rebuildIndex(state) {
+        const next = new Map();
+        const raw = state === 'missing' ? null : readUtf8Regular(this.path);
+        if (raw !== null) {
+            const parsed = parseSidecarJsonl(raw, parseReviewRecord);
+            assertTrustSidecarHealthy('review', parsed);
+            for (const record of parsed.records) {
+                const frozen = immutableRecord(record);
+                next.set(record.assetId, ReviewLedger.keep(next.get(record.assetId), frozen));
             }
-            catch { /* skip corrupt line */ }
         }
-        this.sig = sig;
+        this.index.clear();
+        for (const [assetId, record] of next)
+            this.index.set(assetId, record);
+        this.fileState = state;
+    }
+    refreshUnderLock() {
+        const state = regularFileFingerprint(this.path);
+        if (state !== this.fileState)
+            this.rebuildIndex(state);
+    }
+    withFreshRead(read) {
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            return read(this.index);
+        });
+    }
+    appendUnderLock(full) {
+        appendUtf8Durable(this.path, `${JSON.stringify(full)}\n`);
+        const frozen = immutableRecord(full);
+        this.index.set(full.assetId, ReviewLedger.keep(this.index.get(full.assetId), frozen));
+        this.fileState = regularFileFingerprint(this.path);
+        return this.index.get(full.assetId);
     }
     /** Record a review-state for an asset_id (append-only; the JSONL history is the audit trail). */
     mark(rec) {
-        this.load();
         const full = { ...rec, at: rec.at ?? new Date(this.now()).toISOString() };
-        mkdirSync(dirname(this.path), { recursive: true });
-        appendFileSync(this.path, `${JSON.stringify(full)}\n`);
-        this.index.set(full.assetId, ReviewLedger.keep(this.index.get(full.assetId), full));
-        const st = statSync(this.path); // single stat: two separate calls could straddle a concurrent same-ms append
-        this.sig = `${st.mtimeMs}:${st.size}`; // our own write is already indexed; don't force a re-read
-        return full;
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            this.appendUnderLock(full);
+            return immutableRecord(full);
+        });
     }
     /** Quarantine an auto-distilled draft: its strategy must not enter a real run until reviewed. */
     quarantine(assetId, reason = 'auto-distilled — review before use') {
@@ -87,9 +101,19 @@ export class ReviewLedger {
      * approval is inert. Returns the surviving record (the existing decision, or the new quarantine).
      */
     quarantineIfAbsent(assetId, reason = 'auto-distilled — review before use') {
-        this.load();
-        const existing = this.index.get(assetId);
-        return existing ?? this.quarantine(assetId, reason);
+        assertAssetStoreDirectory(dirname(this.path));
+        return withAssetStoreLock(this.lockPath, () => {
+            this.refreshUnderLock();
+            const existing = this.index.get(assetId);
+            if (existing)
+                return existing;
+            return this.appendUnderLock({
+                assetId,
+                state: 'quarantined',
+                reason,
+                at: new Date(this.now()).toISOString(),
+            });
+        });
     }
     /** Explicit, audited approval (who/why) — flips a draft to eligible. */
     approve(assetId, by, reason) {
@@ -100,8 +124,7 @@ export class ReviewLedger {
         return this.mark({ assetId, state: 'rejected', by, reason });
     }
     get(assetId) {
-        this.load();
-        return this.index.get(assetId) ?? null;
+        return this.withFreshRead((index) => index.get(assetId) ?? null);
     }
     /**
      * Every recorded review decision (resolved, reload-aware). The authoritative source of which assets are
@@ -109,14 +132,18 @@ export class ReviewLedger {
      * asset list, so a draft awaiting approval is never missed behind a store-list cutoff.
      */
     records() {
-        this.load();
-        return [...this.index.values()];
+        return [...this.snapshot().values()];
+    }
+    /** One linearizable review snapshot for bounded batch readers. */
+    snapshot() {
+        return this.withFreshRead((index) => new Map(index));
     }
     /** No record → approved (default eligible); a record → approved only when its state is 'approved'. */
     isApproved(assetId) {
-        this.load();
-        const r = this.index.get(assetId);
-        return r ? r.state === 'approved' : true;
+        return this.withFreshRead((index) => {
+            const r = index.get(assetId);
+            return r ? r.state === 'approved' : true;
+        });
     }
     /**
      * True only when a human approval record exists. Safety-sensitive consumers such as AntiGene warning
@@ -124,7 +151,6 @@ export class ReviewLedger {
      * negative-memory asset must never inherit the ledger's backward-compatible "no record = eligible" default.
      */
     isExplicitlyApproved(assetId) {
-        this.load();
-        return this.index.get(assetId)?.state === 'approved';
+        return this.withFreshRead((index) => index.get(assetId)?.state === 'approved');
     }
 }

package/dist/assetstore/unionReadStore.d.ts

@@ -0,0 +1,25 @@
+import type { AssetKind, AssetRecord, AssetStoreProvider, ConditionalPutOptions, ConditionalPutResult, PutResult, SearchQuery } from './provider.js';
+export declare class UnionReadStore implements AssetStoreProvider {
+    private readonly primary;
+    private readonly readOnly;
+    readonly putConditional?: (asset: AssetRecord, options?: ConditionalPutOptions) => Promise<ConditionalPutResult>;
+    readonly putBundle?: (assets: readonly AssetRecord[]) => Promise<PutResult[]>;
+    readonly putFrozen?: (record: AssetRecord) => Promise<PutResult>;
+    readonly putFrozenConditional?: (record: AssetRecord, options?: ConditionalPutOptions) => Promise<ConditionalPutResult>;
+    readonly findByLogicalId?: (id: string, limit?: number, kind?: AssetKind) => Promise<AssetRecord[]>;
+    /**
+     * @param primary the writable pool this engine owns; every mutation lands here
+     * @param readOnly additional pools to read, in precedence order after `primary`
+     */
+    constructor(primary: AssetStoreProvider, readOnly: readonly AssetStoreProvider[]);
+    private get sources();
+    /**
+     * Merge one read across every source: deduplicate by asset_id with earlier sources winning, then fill
+     * the result by {@link interleave} so every source gets a fair share of the cap.
+     */
+    private merged;
+    put(asset: AssetRecord): Promise<PutResult>;
+    get(assetId: string): Promise<AssetRecord | null>;
+    list(kind?: AssetKind, limit?: number): Promise<AssetRecord[]>;
+    search(q: SearchQuery): Promise<AssetRecord[]>;
+}

package/dist/assetstore/unionReadStore.js

@@ -0,0 +1,119 @@
+// Read-union over one writable pool plus any number of read-only ones.
+//
+// Why a provider and not a helper: every evidence consumer already takes an AssetStoreProvider and calls
+// `search`/`list` on it — aggregateLearningHistory, assessGenePublishEvidence, candidateAssembly,
+// probationWouldPromote. Widening what they can see by threading a second store through each of them
+// would fork four call chains and leave the next consumer to remember. Composing at the provider seam
+// instead means they are untouched: whoever builds the store decides how wide the evidence pool is.
+//
+// Writes go to the primary and ONLY the primary. Reads merge, deduplicating by asset_id — records are
+// content-addressed, so the same asset present in two pools is the same asset, and primary wins so a
+// locally-verified record is never shadowed by a foreign copy.
+const DEFAULT_LIMIT = 1000;
+/**
+ * Take from the queues one at a time in source order until `limit` is reached.
+ *
+ * Concatenating instead would let a mature primary fill every slot on its own — at the ~1000-record
+ * limits the real callers pass (candidateAssembly, recall, reviewFilter), a local pool that size returns
+ * ZERO foreign records and the union silently degrades back to the single-store blind spot it exists to
+ * fix. Interleaving also refills: a source that runs out yields its remaining slots to the others, so a
+ * small foreign pool never costs the result its cap.
+ */
+function interleave(queues, limit) {
+    const out = [];
+    for (let cursor = 0; out.length < limit; cursor += 1) {
+        let advanced = false;
+        for (const queue of queues) {
+            const record = queue[cursor];
+            if (record === undefined)
+                continue;
+            advanced = true;
+            out.push(record);
+            if (out.length >= limit)
+                return out;
+        }
+        if (!advanced)
+            return out;
+    }
+    return out;
+}
+export class UnionReadStore {
+    primary;
+    readOnly;
+    // Mirrored as assigned-in-constructor properties rather than plain methods on purpose: the optional
+    // write capabilities are feature-DETECTED by callers (`supportsAtomicConditionalPut`, and
+    // `ingestUnverified`'s `putFrozen` probe). A method declared on the class is always present, so a
+    // union wrapping a primary that lacks the capability would answer "supported" and then throw — the
+    // undeclared-exception failure those probes exist to prevent. Assigning only when the primary has it
+    // keeps the union exactly as capable as the pool it writes to.
+    putConditional;
+    putBundle;
+    putFrozen;
+    putFrozenConditional;
+    // Conditional for the same reason, on the read side: cliContracts.findLogicalAsset and
+    // assetLineage.resolveAsset feature-detect this, and when it is absent fall back to a wide scan that
+    // REPORTS truncation. Answering on behalf of a source that cannot resolve logical ids would strand
+    // those callers on a narrow answer with no truncation signal — a silent "not found" where they would
+    // otherwise have said "lookup is truncated; use an exact asset_id".
+    findByLogicalId;
+    /**
+     * @param primary the writable pool this engine owns; every mutation lands here
+     * @param readOnly additional pools to read, in precedence order after `primary`
+     */
+    constructor(primary, readOnly) {
+        this.primary = primary;
+        this.readOnly = readOnly;
+        if ([primary, ...readOnly].every((source) => source.findByLogicalId)) {
+            this.findByLogicalId = (id, limit = DEFAULT_LIMIT, kind) => this.merged((source) => source.findByLogicalId(id, limit, kind), limit);
+        }
+        const { putBundle, putConditional, putFrozen, putFrozenConditional } = primary;
+        if (putBundle)
+            this.putBundle = (assets) => putBundle.call(primary, assets);
+        if (putConditional)
+            this.putConditional = (asset, options) => putConditional.call(primary, asset, options);
+        if (putFrozen)
+            this.putFrozen = (record) => putFrozen.call(primary, record);
+        if (putFrozenConditional) {
+            this.putFrozenConditional = (record, options) => putFrozenConditional.call(primary, record, options);
+        }
+    }
+    get sources() {
+        return [this.primary, ...this.readOnly];
+    }
+    /**
+     * Merge one read across every source: deduplicate by asset_id with earlier sources winning, then fill
+     * the result by {@link interleave} so every source gets a fair share of the cap.
+     */
+    async merged(read, limit) {
+        const seen = new Set();
+        const queues = [];
+        for (const source of this.sources) {
+            const unique = [];
+            for (const record of await read(source)) {
+                if (seen.has(record.asset_id))
+                    continue;
+                seen.add(record.asset_id);
+                unique.push(record);
+            }
+            queues.push(unique);
+        }
+        return interleave(queues, limit);
+    }
+    async put(asset) {
+        return this.primary.put(asset);
+    }
+    async get(assetId) {
+        for (const source of this.sources) {
+            const found = await source.get(assetId);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    async list(kind, limit = DEFAULT_LIMIT) {
+        return this.merged((source) => source.list(kind, limit), limit);
+    }
+    async search(q) {
+        return this.merged((source) => source.search(q), q.limit ?? DEFAULT_LIMIT);
+    }
+}

package/dist/benchmark/antiGeneBenchmark.d.ts

@@ -70,6 +70,8 @@ export interface AntiGeneBenchmarkOptions {
     minFailureDelta?: number;
     now?: () => number;
     eventsPath?: string;
+    /** Apply the pre-IDF semantic scorer consistently to both A/B arms. */
+    disableSemanticIdf?: boolean;
 }
 export interface AntiGeneBenchmarkDeps {
     store: AssetStoreProvider;

package/dist/benchmark/antiGeneBenchmark.js

@@ -79,7 +79,7 @@ function executeFor(outcome) {
         },
     });
 }
-async function runOneArm(arm, task, source, sourceReview, rootDir, now) {
+async function runOneArm(arm, task, source, sourceReview, rootDir, now, disableSemanticIdf) {
     const armDir = join(rootDir, arm, task.id);
     const store = new LocalJsonlProvider(join(armDir, 'assets'));
     const review = new ReviewLedger(join(armDir, 'assets'), now);
@@ -105,6 +105,7 @@ async function runOneArm(arm, task, source, sourceReview, rootDir, now) {
         execute: executeFor(spec),
         review,
         consumePendingSignals: false,
+        ...(disableSemanticIdf ? { disableSemanticIdf: true } : {}),
     };
     const result = await runEvolutionCycle(engine, store, opts);
     const observed = observedWarningIds(result.decision);
@@ -168,8 +169,8 @@ export async function runAntiGeneBenchmark(suite, deps, options = {}) {
         for (const task of suite.tasks) {
             taskResults.push({
                 taskId: task.id,
-                baseline: await runOneArm('baseline', task, deps.store, sourceReview, rootDir, now),
-                antiGene: await runOneArm('antiGene', task, deps.store, sourceReview, rootDir, now),
+                baseline: await runOneArm('baseline', task, deps.store, sourceReview, rootDir, now, options.disableSemanticIdf === true),
+                antiGene: await runOneArm('antiGene', task, deps.store, sourceReview, rootDir, now, options.disableSemanticIdf === true),
             });
         }
         const report = buildReport(suite, taskResults, minSamples, minFailureDelta);

package/dist/benchmark/antiGeneRollout.d.ts

@@ -75,6 +75,8 @@ export interface AntiGeneRolloutOptions {
     minFailureDelta?: number;
     now?: () => number;
     eventsPath?: string;
+    /** Apply the pre-IDF semantic scorer consistently to both A/B arms. */
+    disableSemanticIdf?: boolean;
 }
 export declare function runAntiGeneRollout(suite: AntiGeneRolloutSuite, deps: AntiGeneRolloutDeps, options?: AntiGeneRolloutOptions): Promise<AntiGeneRolloutReport>;
 export declare function writeAntiGeneRolloutResult(report: AntiGeneRolloutReport, eventsPath: string, now?: () => number): Promise<void>;

package/dist/benchmark/antiGeneRollout.js

@@ -82,7 +82,7 @@ function scoreFromResult(result, status) {
     const score = result.capsule?.outcome?.score;
     return typeof score === 'number' && Number.isFinite(score) ? score : status === 'success' ? 0.9 : 0.2;
 }
-async function runOneArm(arm, task, source, sourceReview, makeExecute, rootDir, now) {
+async function runOneArm(arm, task, source, sourceReview, makeExecute, rootDir, now, disableSemanticIdf) {
     const armDir = join(rootDir, arm, task.id);
     const store = new LocalJsonlProvider(join(armDir, 'assets'));
     const review = new ReviewLedger(join(armDir, 'assets'), now);
@@ -107,6 +107,7 @@ async function runOneArm(arm, task, source, sourceReview, makeExecute, rootDir,
         execute: makeExecute({ arm, task, store, review, armDir }),
         review,
         consumePendingSignals: false,
+        ...(disableSemanticIdf ? { disableSemanticIdf: true } : {}),
     };
     const result = await runEvolutionCycle(engine, store, opts);
     const status = statusFromResult(result);
@@ -183,8 +184,8 @@ export async function runAntiGeneRollout(suite, deps, options = {}) {
         for (const task of suite.tasks) {
             taskResults.push({
                 taskId: task.id,
-                baseline: await runOneArm('baseline', task, deps.store, sourceReview, deps.makeExecute, rootDir, now),
-                antiGene: await runOneArm('antiGene', task, deps.store, sourceReview, deps.makeExecute, rootDir, now),
+                baseline: await runOneArm('baseline', task, deps.store, sourceReview, deps.makeExecute, rootDir, now, options.disableSemanticIdf === true),
+                antiGene: await runOneArm('antiGene', task, deps.store, sourceReview, deps.makeExecute, rootDir, now, options.disableSemanticIdf === true),
             });
         }
         const report = buildReport(suite, taskResults, minSamples, minFailureDelta);

package/dist/benchmark/index.d.ts

@@ -2,4 +2,6 @@ export * from './benchmark.js';
 export * from './thesis.js';
 export * from './evolutionThesisSolver.js';
 export * from './antiGeneBenchmark.js';
-export * from './antiGeneRollout.js';
+export * from './antiGeneRollout.js';
+export * from './triggerShift.js';
+export * from './selectionFlatAbstention.js';

package/dist/benchmark/index.js

@@ -2,4 +2,6 @@ export * from './benchmark.js';
 export * from './thesis.js';
 export * from './evolutionThesisSolver.js';
 export * from './antiGeneBenchmark.js';
-export * from './antiGeneRollout.js';
+export * from './antiGeneRollout.js';
+export * from './triggerShift.js';
+export * from './selectionFlatAbstention.js';