@tachikomagundam/abathur 0.2.5 → 0.2.6

package/dist/commands/genome.js

@@ -53,7 +53,7 @@ function genomeSeals(configDir, label) {
     for (const warning of scan.warnings)
         writeStdout(`warning: ${warning}`);
     for (const entry of scan.entries) {
-        writeStdout(`# effective seal globs for '${entry.label}' (${entry.fingerprint}) under ${entry.spec.repoPath}`);
+        writeStdout(`# effective seal globs for '${entry.label}' (${entry.fingerprint}) under ${entry.spec.repoPath}`); // raw-repoPath: display string only; no FS access
         for (const glob of entry.spec.kernel.immutableGlobs)
             writeStdout(glob);
     }
@@ -61,7 +61,7 @@ function genomeSeals(configDir, label) {
 }
 function genomeRm(configDir, label) {
     const entry = resolveUniqueEntry(configDir, label, "genome rm");
-    const file = ledgerPath(entry.spec.repoPath);
+    const file = ledgerPath(entry.spec.repoPath); // raw-repoPath: ledgerPath() resolves env literals at the FS seam (ledger.ts)
     if (existsSync(file) && readFileSync(file, "utf8").trim().length > 0) {
         blocked(`genome rm refused: '${entry.label}' (${entry.fingerprint}) has ledger history — archive instead`, `lineage lives in ${file}; unregistering a lived genome would orphan its evidence. Keep it registered or move the repo aside.`);
     }

package/dist/commands/graft.js

@@ -43,7 +43,7 @@ function entryForLabel(configDir, label) {
     const matches = readRegistry(configDir).entries.filter((entry) => entry.label === label);
     if (matches.length > 1) {
         cannotAnswer(`graft: label '${label}' is ambiguous — ${String(matches.length)} genomes share it: ${matches
-            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`)
+            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`) // raw-repoPath: display string only; no FS access
             .join(", ")}`, "give the specs distinct labels; the fingerprint is the identity");
     }
     return matches[0] ?? null;

package/dist/commands/run.js

@@ -69,7 +69,7 @@ export function resolveUniqueEntry(configDir, label, who = "run") {
     const scan = requireGenomesByLabel(configDir, label);
     if (scan.entries.length > 1) {
         cannotAnswer(`${who}: label '${label}' is ambiguous — ${String(scan.entries.length)} genomes share it: ${scan.entries
-            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`)
+            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`) // raw-repoPath: display string only; no FS access
             .join(", ")}`, "give the specs distinct labels; the fingerprint is the identity");
     }
     const entry = scan.entries[0];

package/dist/commands/self-eval.js

@@ -110,7 +110,7 @@ async function selfEvalHandler(context) {
     for (const warning of readRegistry(configDir).warnings)
         writeStdout(`warning: ${warning}`);
     const entry = resolveUniqueEntry(configDir, flags.label, "self-eval");
-    if (!isEnvRepoLiteral(entry.spec.repoPath)) {
+    if (!isEnvRepoLiteral(entry.spec.repoPath)) { // raw-repoPath: self-mode detection must inspect the STORED literal, not the resolved path
         cannotAnswer(`self-eval: '${entry.spec.label}' is not a self genome — repoPath must be the \${ABATHUR_SELF_REPO} literal`, "self-eval grades the harness against its own sealed kernel; see genomes/abathur-self.jsonc");
     }
     const audit = auditKernel(entry, configDir);

package/dist/commands/tombstone.js

@@ -4,6 +4,7 @@
 // bytes) but NEVER echoed raw — the confirmation line is sanitized like todo-8's
 // sealMessage so untrusted text cannot forge terminal output.
 import { Ledger } from "../core/ledger.js";
+import { effectiveRepoPath } from "../core/spec.js";
 import { resolveConfigDir } from "../config.js";
 import { EXIT_OK, blocked, cannotAnswer } from "../exit.js";
 import { writeStdout } from "../out.js";
@@ -48,7 +49,7 @@ function runTombstone(args) {
     const { label, genId, reason } = parseArgs(args);
     const configDir = resolveConfigDir();
     const entry = resolveUniqueEntry(configDir, label, "tombstone");
-    const ledger = Ledger.open(entry.spec.repoPath);
+    const ledger = Ledger.open(effectiveRepoPath(entry.spec.repoPath));
     const records = ledger.readAll();
     if (!records.some((r) => r.kind === "generation_complete" && r.genId === genId)) {
         blocked(`tombstone: no generation_complete ledger row for gen '${genId}' of '${label}' — nothing to bury`);

package/dist/core/evolve/run-loop.js

@@ -38,6 +38,7 @@ import { buildBrief } from "./brief.js";
 import { startRunFriction } from "./run-friction.js";
 import { runMutatorSession } from "./reflect.js";
 import { asReplicates, benchTarget, cloneMatrixRow, copyProvenance } from "./run-bench.js";
+import { loadScoreBank } from "./score-bank.js";
 import { selfGuardVerdict } from "./self-snapshot.js";
 import { effectiveCaps, planLines } from "./run-plan.js";
 import { addCounters, readResume, } from "./run-rows.js";
@@ -167,6 +168,18 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
         incUnits = out.units;
         lines.push(`incumbent baseline: ${String(out.units.length)} units x ${String(reps)} reps${out.complete ? "" : " (BUDGET-TRUNCATED)"}`);
     }
+    // ---- score bank for acceptance-semantics gates (loaded after the incumbent
+    // row commit so this campaign's baseline reps price the bank — gate-time view;
+    // candidate rows land only after evaluate, never feeding their own verdict).
+    const scoreBank = loadScoreBank(genomeRepo);
+    if (scoreBank === null) {
+        lines.push("score bank: none — legacy cross-arm gate");
+    }
+    else {
+        lines.push(`score bank: ${String(scoreBank.units.size)} unit(s), prior sigma ${scoreBank.priorSigma.toFixed(4)}, pooled df ${String(scoreBank.totalDf)}`);
+        for (const notice of scoreBank.notices)
+            lines.push(`score bank: ${notice}`);
+    }
     // ---- candidate generation session
     const remaining = caps.maxCandidates - counters.candidates;
     const considered = [];
@@ -242,6 +255,7 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
                 stats: spec.bench.stats,
                 budgetCaps: caps,
                 nPairs,
+                ...(scoreBank === null ? {} : { bank: scoreBank.units }),
             });
             const guarded = selfMode ? selfGuardVerdict(out.failures, verdict.verdict) : verdict.verdict;
             const finalVerdict = guarded;

package/dist/core/evolve/score-bank.js

@@ -0,0 +1,214 @@
+// Historical per-unit variance bank for the acceptance-semantics gate
+// (engine redesign 2026-09-24; the design doc + power analysis live in the
+// target genome repo's evidence folder, not shipped here).
+//
+// WHAT IT IS: for every unit, σ pooled from the within-group replicate scatter
+// of ALL generation_complete rows in <genomeRepo>/.state/abathur/ledger*.jsonl
+// (live ledger + campaign archives + pilot). A group = one bench event on one
+// arm (one row's scores array for that unit), so its mean is that doc's mean:
+// pooling mean-removed sums of squares across doc lineages is the classical
+// ANOVA pooled within-group variance — champion-doc changes (the campaign-3
+// promote at 7ca80d7 moved the incumbent head 6ca3ff68→556e1350→062a9fdb→
+// 8fe7e34a→de607dab) shift group MEANS, never this estimate. Pooling raw
+// scores/means across lineages would poison the bank and is what the per-group
+// mean removal exists to prevent.
+//
+// SHIELDING: σ² = (df·σ̂² + ν₀·σ²_glob)/(df+ν₀) with ν₀ = BANK_PRIOR_DF = 2 —
+// [0.5, 0.5] is two reps that failed to observe noise, not proof of σ=0. Thin
+// history (df < BANK_THIN_DF) additionally floors σ at BANK_QUANTUM = 0.125/√2:
+// unit scores are fractions of checklist items on a ~1/8 grid, so two reps one
+// flipped item apart differ by exactly 0.125 and a one-step-pair has sd
+// 0.125/√2; a unit quieter than that has only been lucky, not measured.
+// Proven-quiet units (df ≥ BANK_THIN_DF, e.g. the guards with 12–14 zero-SS
+// df) keep their tight shrunk σ — earned across independent benches.
+//
+// READ-ONLY AND FAIL-CLOSED: never Ledger.open (that mkdirs .state — the same
+// discipline as peekPlanState in run-rows.ts), never writes, never exits the
+// process. A row that fails schema validation contributes nothing and only
+// adds a notice (archives may legitimately predate schema evolutions). No
+// files / no readable rows / zero pooled df ⇒ null ⇒ the caller must run the
+// legacy cross-arm gate verbatim: the bank can only inform, absence can never
+// invent a nomination or a cull.
+//
+// ACTIVATION REQUIRES A ROTATED ARCHIVE: with only the live ledger.jsonl
+// present the bank stays null. A lone live file may be one campaign young
+// (gate-time df=1 per unit — zero cross-doc information) or, worse, the fresh
+// .state of any toy/fixture genome whose very first run would silently switch
+// gates mid-test. Rotation (ledger.campaign<N>-*.jsonl) is the operator's own
+// mark that a genome has earned lifetime history, so it is also the mark that
+// entitles the acceptance gate to override the proven legacy default.
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { LEDGER_KIND_GENERATION_COMPLETE, ledgerPath, ledgerRecordSchema } from "../ledger.js";
+import { generationRowDataSchema } from "./run-rows.js";
+// ------------------------------------------------------------- bank epoch
+// Lineage-restart quarantine (institutional addition 2026-09-25, born of the
+// s19 pin era + the s16 churn window): an operator-ruled epoch start for a
+// unit voids every bank group whose row.ts predates it — a broken or polluted
+// measurement era must not teach the gate the wrong noise level. The LEDGER
+// FILES STAY IMMUTABLE (doctrine): the verdict on which rows count lives in
+// this sidecar, beside its prose provenance (rotation NOTEs / evidence pages).
+// FAIL-CLOSED IN BOTH DIRECTIONS: absent sidecar ⇒ no quarantine; present but
+// malformed/unreadable/unparsable-dates ⇒ the WHOLE bank returns null and the
+// caller runs the legacy gate verbatim — a quarantine we cannot read honestly
+// is a quarantine we cannot silently ignore.
+const BANK_EPOCH_FILE = "bank-epoch.json";
+const bankEpochSchema = z.record(z.string().min(1), z
+    .object({ sinceIso: z.string().min(1), why: z.string().optional() })
+    .strict());
+function loadBankEpoch(dir, note) {
+    let raw;
+    try {
+        raw = readFileSync(path.join(dir, BANK_EPOCH_FILE), "utf8");
+    }
+    catch (cause) {
+        const code = cause?.code;
+        if (code === "ENOENT")
+            return undefined; // absent: nothing quarantined
+        note(`${BANK_EPOCH_FILE}: unreadable (${String(cause)}) — bank disabled, legacy gate`);
+        return null;
+    }
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch (cause) {
+        note(`${BANK_EPOCH_FILE}: invalid JSON (${String(cause)}) — bank disabled, legacy gate`);
+        return null;
+    }
+    const parsed = bankEpochSchema.safeParse(doc);
+    if (!parsed.success) {
+        note(`${BANK_EPOCH_FILE}: schema violation (${parsed.error.issues[0]?.message ?? "?"}) — bank disabled, legacy gate`);
+        return null;
+    }
+    const out = new Map();
+    for (const [unitId, rule] of Object.entries(parsed.data)) {
+        const sinceMs = Date.parse(rule.sinceIso);
+        if (!Number.isFinite(sinceMs)) {
+            note(`${BANK_EPOCH_FILE}: bad sinceIso for '${unitId}' — bank disabled, legacy gate`);
+            return null;
+        }
+        out.set(unitId, { sinceIso: rule.sinceIso, sinceMs, why: rule.why ?? "" });
+    }
+    return out;
+}
+/** Half of one 1/8-grid checklist step between two reps — the sd of that pair. */
+export const BANK_QUANTUM = 0.125 / Math.SQRT2;
+/** Phantom df of the bank-wide pooled prior used to shrink each unit's σ̂². */
+export const BANK_PRIOR_DF = 2;
+/** Below this pooled df a unit's history counts as thin and the quantum floor binds. */
+export const BANK_THIN_DF = 6;
+/** Notices stop accumulating past this many lines (a corrupt archive must not flood run output). */
+const NOTICE_CAP = 20;
+/** One group = one row × unit; a multi-rep scores array contributes n−1 df of within-mean scatter. */
+function accumulate(acc, unitId, scores) {
+    const n = scores.length;
+    if (n < 2)
+        return;
+    let sum = 0;
+    for (const s of scores)
+        sum += s;
+    const mean = sum / n;
+    let ss = 0;
+    for (const s of scores) {
+        const d = s - mean;
+        ss += d * d;
+    }
+    const cur = acc.get(unitId) ?? { df: 0, ss: 0 };
+    acc.set(unitId, { df: cur.df + (n - 1), ss: cur.ss + ss });
+}
+const LIVE_LEDGER = "ledger.jsonl";
+function isRotatedArchive(name) {
+    return name.startsWith("ledger.") && name.endsWith(".jsonl") && name !== LIVE_LEDGER && !name.startsWith("ledger.corrupt-");
+}
+export function loadScoreBank(genomeRepo, opts = {}) {
+    const dir = path.dirname(ledgerPath(genomeRepo));
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return null; // no .state/abathur at all — fresh genome, legacy gate
+    }
+    const excluded = new Set(opts.excludeCandidateTrees ?? []);
+    const excludedFiles = new Set(opts.excludeFiles ?? []);
+    const files = names.filter((n) => (n === LIVE_LEDGER || isRotatedArchive(n)) && !excludedFiles.has(n)).sort();
+    if (!files.some(isRotatedArchive))
+        return null; // activation law: rotated history or legacy gate
+    const notices = [];
+    const note = (line) => {
+        if (notices.length < NOTICE_CAP)
+            notices.push(line);
+        else if (notices.length === NOTICE_CAP)
+            notices.push("score bank: further notices suppressed");
+    };
+    const bankEpoch = loadBankEpoch(dir, note);
+    if (bankEpoch === null)
+        return null; // malformed quarantine ⇒ legacy gate, never a silently ignored one
+    const quarantined = new Map();
+    const acc = new Map();
+    for (const file of files) {
+        let text;
+        try {
+            text = readFileSync(path.join(dir, file), "utf8");
+        }
+        catch {
+            note(`${file}: unreadable — archive skipped`);
+            continue;
+        }
+        const lines = text.split("\n");
+        lines.forEach((raw, index) => {
+            const line = raw.trim();
+            if (line.length === 0)
+                return;
+            let record;
+            try {
+                record = JSON.parse(line);
+            }
+            catch {
+                note(`${file}:${String(index + 1)}: not JSON — row skipped`);
+                return;
+            }
+            const parsed = ledgerRecordSchema.safeParse(record);
+            if (!parsed.success || parsed.data.kind !== LEDGER_KIND_GENERATION_COMPLETE)
+                return;
+            const row = generationRowDataSchema.safeParse(parsed.data.data);
+            if (!row.success) {
+                note(`${file}:${String(index + 1)}: generation_complete row unreadable — row skipped`);
+                return;
+            }
+            if (row.data.source === "candidate" && row.data.treeSha !== undefined && excluded.has(row.data.treeSha))
+                return;
+            const rowMs = Date.parse(parsed.data.ts);
+            for (const u of row.data.units) {
+                const rule = bankEpoch?.get(u.unitId);
+                if (rule !== undefined && !(Number.isFinite(rowMs) && rowMs >= rule.sinceMs)) {
+                    quarantined.set(u.unitId, (quarantined.get(u.unitId) ?? 0) + 1);
+                    continue; // only rows provably at/after the epoch start count; unreadable ts fails closed
+                }
+                accumulate(acc, u.unitId, u.scores);
+            }
+        });
+    }
+    for (const [unitId, rule] of [...(bankEpoch ?? new Map()).entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+        note(`bank-epoch '${unitId}' since ${rule.sinceIso}: ${String(quarantined.get(unitId) ?? 0)} group(s) quarantined${rule.why === "" ? "" : ` — ${rule.why}`}`);
+    }
+    let totalDf = 0;
+    let totalSs = 0;
+    for (const { df, ss } of acc.values()) {
+        totalDf += df;
+        totalSs += ss;
+    }
+    if (totalDf === 0)
+        return null;
+    const priorVar = totalSs / totalDf;
+    const units = new Map();
+    for (const [unitId, { df, ss }] of [...acc.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+        const within = ss / df;
+        const shrunk = (df * within + BANK_PRIOR_DF * priorVar) / (df + BANK_PRIOR_DF);
+        const sigma = Math.sqrt(shrunk);
+        units.set(unitId, { sigma: df >= BANK_THIN_DF ? sigma : Math.max(sigma, BANK_QUANTUM), df });
+    }
+    return { units, priorSigma: Math.sqrt(priorVar), totalDf, notices };
+}

package/dist/core/graft-rebench.js

@@ -13,6 +13,7 @@ import { LEDGER_KIND_GENERATION_COMPLETE } from "./ledger.js";
 import { newGeneration, openGenome, sealGeneration, snapshotCommit } from "./worktree.js";
 import { git, tryGit } from "../util/git.js";
 import { asReplicates, benchTarget, cloneMatrixRow, copyProvenance } from "./evolve/run-bench.js";
+import { loadScoreBank } from "./evolve/score-bank.js";
 import { addCounters, readResume } from "./evolve/run-rows.js";
 import { ChildTracker, reapOrphans } from "./evolve/child-track.js";
 import { clampReps, evaluate, VERDICT_EXIT } from "./stats.js";
@@ -82,6 +83,7 @@ export async function graftAndBench(req, ctx) {
         ledger.append({ kind: LEDGER_KIND_GENERATION_COMPLETE, genId: incGen, data });
         incUnits = out.units;
     }
+    const scoreBank = loadScoreBank(spec.repoPath);
     const out = await benchTarget({
         spec: { ...spec, repoPath: gen.worktreePath },
         genId: graftGenId,
@@ -103,6 +105,7 @@ export async function graftAndBench(req, ctx) {
         stats: spec.bench.stats,
         budgetCaps: caps,
         nPairs: 1,
+        ...(scoreBank === null ? {} : { bank: scoreBank.units }),
     });
     // EXACTLY ONE graft_import decision row lands BEFORE any further writes.
     ctx.recordDecision(gate.verdict, localScoreReason(gate, manifest, reps), { graftGenId, ...sealed });

package/dist/core/ledger.js

@@ -9,6 +9,7 @@ import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync
 import path from "node:path";
 import { z } from "zod";
 import { canonicalJson, compactUtc } from "./ids.js";
+import { effectiveRepoPath } from "./spec.js";
 import { acquireLock } from "./locks.js";
 export { acquireLock, lockDirFor } from "./locks.js";
 export const LEDGER_KIND_LOCK_TAKEOVER = "lock_takeover";
@@ -30,7 +31,11 @@ export class LedgerError extends Error {
     }
 }
 export function ledgerPath(genomeRepo) {
-    return path.join(genomeRepo, ".state", "abathur", "ledger.jsonl");
+    // FS-seam rule: the stored repoPath may be an unresolved `${VAR}` literal
+    // (0.2.x convention; see 4997618 / 863e6c2). Resolve HERE at the single
+    // ledger seam so no caller can ever read an empty ledger under a literal
+    // path and report a misleading downstream error again.
+    return path.join(effectiveRepoPath(genomeRepo), ".state", "abathur", "ledger.jsonl");
 }
 function buildRecord(input, now) {
     const candidate = {

package/dist/core/promote.js

@@ -9,6 +9,7 @@ import path from "node:path";
 import { ExitSignal, blocked, cannotAnswer } from "../exit.js";
 import { compileGlob } from "./glob.js";
 import { fastForwardIncumbent } from "./incumbent.js";
+import { effectiveRepoPath } from "./spec.js";
 import { buildManifest, kernelsDirOf, manifestPathFor, readManifestFile, serializeManifest, } from "./kernel.js";
 import { Ledger, ledgerPath } from "./ledger.js";
 import { gitOpts, requireSha } from "./genome-paths.js";
@@ -65,7 +66,7 @@ async function sealedPathCheck(genId, nom, matchers, sealedPaths, cwd, opts) {
 }
 export async function promoteGeneration(req) {
     const { entry, configDir } = req;
-    const repo = entry.spec.repoPath;
+    const repo = effectiveRepoPath(entry.spec.repoPath);
     const shown = display(req.genId);
     const opts = req.env === undefined ? {} : { env: req.env };
     const ledger = Ledger.open(repo);

package/dist/core/stats-math.js

@@ -74,6 +74,45 @@ function betai(a, b, x) {
         return (front * betacf(a, b, x)) / a;
     return 1 - (front * betacf(b, a, 1 - x)) / b;
 }
+/**
+ * Standard normal CDF Φ(x): Abramowitz-Stegun 7.1.26 erf approximation,
+ * |error| < 1.5e-7 — far tighter than the 4-decimal P values the acceptance
+ * gate reports. ±∞ map to 1/0; NaN maps to NaN (callers branch on se===0
+ * before dividing, so 0/0 NaN never reaches here by design).
+ */
+export function normalCdf(x) {
+    if (Number.isNaN(x))
+        return Number.NaN;
+    if (x === Number.POSITIVE_INFINITY)
+        return 1;
+    if (x === Number.NEGATIVE_INFINITY)
+        return 0;
+    const z = Math.abs(x) / Math.SQRT2;
+    const t = 1 / (1 + 0.3275911 * z);
+    const poly = t * (0.254829592 + t * (-0.284496736 + t * (1.421413741 + t * (-1.453152027 + t * 1.061405429))));
+    const erf = 1 - poly * Math.exp(-z * z);
+    return 0.5 * (1 + (x < 0 ? -erf : erf));
+}
+/**
+ * Inverse standard normal Φ⁻¹(p), bisection against normalCdf above — the two
+ * are mutually consistent by construction (a band built from normalQuantile(q)
+ * and tested through normalCdf lands exactly at probability q). Same shape as
+ * studentTQuantile's bisection; |error| < 1e-13.
+ */
+export function normalQuantile(p) {
+    if (!(p > 0 && p < 1))
+        throw new RangeError(`normalQuantile: p=${String(p)} must be in (0, 1)`);
+    let lo = -40;
+    let hi = 40;
+    for (let i = 0; i < 80; i += 1) {
+        const mid = (lo + hi) / 2;
+        if (normalCdf(mid) < p)
+            lo = mid;
+        else
+            hi = mid;
+    }
+    return (lo + hi) / 2;
+}
 /**
  * Two-sided Student-t critical value: the t such that P(|T| ≤ t) = 1 − alpha
  * with T ~ t(df). Planned accuracy: matches t-table values to < 1e-3 for the

package/dist/core/stats.js

@@ -26,15 +26,39 @@
 //  - Pareto over (trainScore, tokens, wallS); budget-truncated generations
 //    (complete:false) never enter the set.
 //
+// ACCEPTANCE SEMANTICS (2026-09-24 redesign; design doc lives in the target
+// genome repo's evidence folder, not shipped here): when EvaluateInput.bank
+// carries the historical per-unit variance bank, precision/regression checks
+// price NOISE
+// with bank σ instead of per-arm t(df=n−1) CIs (the campaign-9/10 resolution
+// floor: t(0.05,1)=12.706 turned a 2-point sample into a 1.5883 half-width).
+// A val unit with bank σ clears when P(Δ ≤ −halfWidth) < q_pair AND the
+// acceptance band Z(q)·σ/√n_candidate ≤ halfWidth; the aggregate additionally
+// requires P(gain shift > 0) = Φ(gain/SE) ≥ q_pair, q_pair = 1−(1−ACCEPT_Q)/nPairs.
+// EVERY fail-closed rule ABOVE the bank path is untouched and can never be
+// bypassed by it: budget⇒inconclusive, one-sided n<2⇒indeterminate,
+// both-unmeasured⇒symmetric exclusion. A unit the bank cannot price falls back
+// to the exact legacy t-CI line; a null/absent bank reproduces the pre-2026-09-24
+// gate verbatim. minEffect 0.1 / halfWidth 0.15 point semantics stand.
+//
 // The inverse Student-t lives in stats-math.ts and the Pareto ranking in
 // stats-pareto.ts; both are re-exported here so the public surface of this
 // module — the one todos 9/10/12 consume — is unchanged. Accuracy: |t − table|
 // < 1e-3 for the t-distribution rows checked in stats.test.ts (df=1..30, α=0.05).
 import { EXIT_BLOCKED, EXIT_CANNOT_ANSWER, EXIT_OK } from "../exit.js";
 /** Per-unit replicate scores (train and val units alike). */
-import { studentTQuantile } from "./stats-math.js";
+import { studentTQuantile, normalCdf, normalQuantile } from "./stats-math.js";
 import { seededRandom, paretoFrontier } from "./stats-pareto.js";
-export { studentTQuantile, seededRandom, paretoFrontier };
+export { studentTQuantile, normalCdf, normalQuantile, seededRandom, paretoFrontier };
+/** Nomination acceptance probability (per finalist pair after Bonferroni). */
+export const ACCEPT_Q = 0.9;
+/** q_pair = 1 − (1 − ACCEPT_Q)/nPairs — Bonferroni on the acceptance ERROR rate. */
+export function bonferroniQ(nPairs) {
+    if (!Number.isInteger(nPairs) || nPairs < 1) {
+        throw new RangeError(`bonferroniQ: nPairs=${String(nPairs)} must be an integer >= 1`);
+    }
+    return Math.min(0.9999, 1 - (1 - ACCEPT_Q) / nPairs);
+}
 /** Family-wise alpha across finalist pairs (bonferroniAlpha divides it). */
 export const FAMILY_ALPHA = 0.05;
 /** Verdict → process exit code. inconclusive = 2 (cannot answer), never 0. */
@@ -165,7 +189,14 @@ export function evaluate(input) {
     const candKept = candidate.units.filter((u) => !excluded.has(u.unitId));
     const incKept = incumbent.units.filter((u) => !excluded.has(u.unitId));
     const candByUnitKept = new Map(candKept.map((u) => [u.unitId, u]));
-    // 3) Per-val-unit comparisons + the two precision gates.
+    // 3) Per-val-unit comparisons + the two precision gates. With a bank that
+    //    knows the unit, acceptance semantics (see module header) replace the
+    //    per-arm t-CI machinery FOR THAT UNIT ONLY; bank-unknown units keep the
+    //    legacy lines verbatim. The fail-closed rules above run before and
+    //    independently of any bank.
+    const bank = input.bank ?? null;
+    const qPair = bonferroniQ(nPairs);
+    const acceptanceUnits = [];
     const unitComparisons = [];
     for (const [unitId, incUnit] of incByUnit) {
         if (incUnit.split !== "val" || excluded.has(unitId))
@@ -173,30 +204,73 @@ export function evaluate(input) {
         const candUnit = candByUnitKept.get(unitId);
         if (candUnit === undefined)
             continue; // excluded/unreachable
-        const cs = summarizeUnit(candUnit.scores, alpha);
         const incumbentMean = summarizeUnit(incUnit.scores).mean;
+        const cs = summarizeUnit(candUnit.scores, alpha);
         const delta = cs.mean - incumbentMean;
-        unitComparisons.push({
-            unitId,
-            candidateMean: cs.mean,
-            incumbentMean,
-            ciHalfWidth: cs.ciHalfWidth,
-            delta,
-            ciPasses: cs.ciHalfWidth <= stats.halfWidth,
-            passes: delta >= -cs.ciHalfWidth, // ties allowed
-        });
-        if (cs.ciHalfWidth > stats.halfWidth) {
-            failures.push(`CI half-width ${fmt(cs.ciHalfWidth)} > halfWidth ${fmt(stats.halfWidth)} on unit '${unitId}'`);
+        const banked = bank?.get(unitId) ?? null;
+        if (banked === null) {
+            unitComparisons.push({
+                unitId,
+                candidateMean: cs.mean,
+                incumbentMean,
+                ciHalfWidth: cs.ciHalfWidth,
+                delta,
+                ciPasses: cs.ciHalfWidth <= stats.halfWidth,
+                passes: delta >= -cs.ciHalfWidth, // ties allowed
+            });
+            if (cs.ciHalfWidth > stats.halfWidth) {
+                failures.push(`CI half-width ${fmt(cs.ciHalfWidth)} > halfWidth ${fmt(stats.halfWidth)} on unit '${unitId}'`);
+            }
+            if (delta < -cs.ciHalfWidth) {
+                failures.push(`regression on unit '${unitId}': delta ${fmt(delta)} < ${fmt(-cs.ciHalfWidth)} (mean ${fmt(cs.mean)} < ${fmt(incumbentMean)} - ${fmt(cs.ciHalfWidth)})`);
+            }
+            continue;
+        }
+        const se = banked.sigma * Math.sqrt(1 / candUnit.scores.length + 1 / incUnit.scores.length);
+        const band = (normalQuantile(qPair) * banked.sigma) / Math.sqrt(candUnit.scores.length);
+        const pRegression = se === 0 ? (delta <= -stats.halfWidth ? 1 : 0) : normalCdf((-stats.halfWidth - delta) / se);
+        const ciPasses = band <= stats.halfWidth;
+        const passes = pRegression < qPair; // ties at −halfWidth sit at Φ(0)=0.5 < q ⇒ still pass
+        unitComparisons.push({ unitId, candidateMean: cs.mean, incumbentMean, ciHalfWidth: band, delta, ciPasses, passes });
+        acceptanceUnits.push({ unitId, sigma: banked.sigma, df: banked.df, delta, se, band, pRegression });
+        if (!ciPasses) {
+            failures.push(`acceptance band ${fmt(band)} > halfWidth ${fmt(stats.halfWidth)} on unit '${unitId}' (bank sigma ${fmt(banked.sigma)}, df ${String(banked.df)})`);
         }
-        if (delta < -cs.ciHalfWidth) {
-            failures.push(`regression on unit '${unitId}': delta ${fmt(delta)} < ${fmt(-cs.ciHalfWidth)} (mean ${fmt(cs.mean)} < ${fmt(incumbentMean)} - ${fmt(cs.ciHalfWidth)})`);
+        else if (!passes) {
+            failures.push(`regression on unit '${unitId}': delta ${fmt(delta)} — P(Δ ≤ −${fmt(stats.halfWidth)}) = ${fmt(pRegression)} ≥ q ${fmt(qPair)} (bank sigma ${fmt(banked.sigma)})`);
         }
     }
-    // 4) Effect-size floor on the aggregate gain (shared, symmetric pool).
+    // 4) Effect-size floor on the aggregate gain (shared, symmetric pool) —
+    //    unchanged — plus the acceptance gate: when the bank can price EVERY
+    //    unit of the gain pool, nomination additionally requires P(Δ>0) ≥ q.
+    //    A bank-priced point mass exactly at 0 (se=0, gain=0) fails (pShift=0):
+    //    demonstrated-identical arms are never nominated on a tie.
     const gain = aggregateScore(candKept) - aggregateScore(incKept);
     if (gain < stats.minEffect) {
         failures.push(`gain ${fmt(gain)} < minEffect ${fmt(stats.minEffect)}`);
     }
+    let gainSe = null;
+    let pShift = null;
+    if (bank !== null) {
+        const train = candKept.filter((u) => u.split === "train");
+        const pool = train.length > 0 ? train : candKept;
+        const incCounts = new Map(incKept.map((u) => [u.unitId, u.scores.length]));
+        const priced = pool.map((u) => bank.get(u.unitId) ?? null);
+        if (priced.every((s) => s !== null)) {
+            const k = pool.length;
+            let variance = 0;
+            pool.forEach((u, index) => {
+                const s = priced[index];
+                variance += ((s.sigma * s.sigma) * (1 / u.scores.length + 1 / (incCounts.get(u.unitId) ?? 0))) / (k * k);
+            });
+            gainSe = Math.sqrt(variance);
+            pShift = gainSe === 0 ? (gain > 0 ? 1 : 0) : normalCdf(gain / gainSe);
+            if (pShift < qPair) {
+                failures.push(`acceptance: P(gain shift > 0) = ${fmt(pShift)} < q ${fmt(qPair)} (se ${fmt(gainSe)}, gain ${fmt(gain)})`);
+            }
+        }
+    }
     const verdict = failures.length === 0 ? "nominated" : "culled";
-    return { ...base, verdict, exitCode: needsExit(verdict), gain, unitComparisons, failures };
+    const acceptance = bank === null ? undefined : { q: qPair, gainSe, pShift, units: acceptanceUnits };
+    return { ...base, verdict, exitCode: needsExit(verdict), gain, unitComparisons, failures, ...(acceptance === undefined ? {} : { acceptance }) };
 }