@tachikomagundam/abathur 0.2.5 → 0.2.7

package/README.md

@@ -30,7 +30,7 @@ instance learn from another's evidence; nothing in v1 talks to a network.
   `peerClaim` metadata and never feed nomination math.
 - **run loop** — incumbent → brief (failure observations) → mutator session →
   candidate diffs → seal → re-bench → verdicts. Nominated generations sit in
-  the quarantine queue until a human runs `promote`; `tombstone` buries them.
+  the quarantine queue until a human runs `promote`; `tombstone` buries them; `retract` undoes a promote (LIFO, descendant-guarded).
   Both are append-only ledger decisions; nothing is ever deleted.
 
 ### Install
@@ -289,7 +289,7 @@ table are [docs/federation.md](docs/federation.md).
   same historian genome against one wiki will clobber each other mid-run.
   Cross-machine serialization of historian benches is the operator's
   responsibility (schedule, lockbox, one-wiki-one-bench rule — your call).
-- Promotion and burial are yours alone: `promote`/`tombstone` carry no
+- Promotion, burial and retraction are yours alone: `promote`/`tombstone`/`retract` carry no
   `--confirm` because the CLI invocation **is** the gate; there is no
   `--force` anywhere in the binary. Review `abathur status` quarantine depth
   and the `graft decisions` rows before promoting.
@@ -476,7 +476,7 @@ opencode 会在启动时自行从 npm 把包下载到它自己的缓存
   `self-eval`、`kernel`、`--help`），120 秒超时、64 KB 输出封顶。二进制从
   `PATH` 解析，除非用 `ABATHUR_BIN` 覆盖。诚实的权限说明：该工具具备与
   bash 等同的权限——`run` 与 `genome` 按设计就会 spawn 变异器/引擎二进制——
-  所以允许清单限制的是笔误与体验，而非能力。`promote` 与 `tombstone` 刻意
+  所以允许清单限制的是笔误与体验，而非能力。`promote`、`tombstone` 与 `retract` 刻意
   不可经由工具触达：它们是人类闸门，必须在终端里运行。
 - 用户命令 **`/abathur <参数…>`**——斜杠命令，指示智能体把参数
   翻译成工具调用并回报退出码。路线 A 由复制的 `commands/abathur.md`

package/dist/cli.js

@@ -12,10 +12,12 @@ import { graftCommand } from "./commands/graft.js";
 import { kernelCommand } from "./commands/kernel.js";
 import { opencodeCommand } from "./commands/opencode.js";
 import { promoteCommand } from "./commands/promote.js";
+import { readjudicateCommand } from "./commands/readjudicate.js";
 import { runCommand } from "./commands/run.js";
 import { selfEvalCommand } from "./commands/self-eval.js";
 import { statusCommand } from "./commands/status.js";
 import { tombstoneCommand } from "./commands/tombstone.js";
+import { retractCommand } from "./commands/retract.js";
 import { ConfigError, loadConfig } from "./config.js";
 import { EXIT_CANNOT_ANSWER, EXIT_OK, ExitSignal, cannotAnswer, renderExitSignal, } from "./exit.js";
 // Router order mirrors the plan; summaries appear verbatim in --help.
@@ -24,7 +26,9 @@ export const COMMANDS = [
     runCommand,
     statusCommand,
     promoteCommand,
+    readjudicateCommand,
     tombstoneCommand,
+    retractCommand,
     bundleCommand,
     graftCommand,
     selfEvalCommand,

package/dist/commands/genome.js

@@ -53,7 +53,7 @@ function genomeSeals(configDir, label) {
     for (const warning of scan.warnings)
         writeStdout(`warning: ${warning}`);
     for (const entry of scan.entries) {
-        writeStdout(`# effective seal globs for '${entry.label}' (${entry.fingerprint}) under ${entry.spec.repoPath}`);
+        writeStdout(`# effective seal globs for '${entry.label}' (${entry.fingerprint}) under ${entry.spec.repoPath}`); // raw-repoPath: display string only; no FS access
         for (const glob of entry.spec.kernel.immutableGlobs)
             writeStdout(glob);
     }
@@ -61,7 +61,7 @@ function genomeSeals(configDir, label) {
 }
 function genomeRm(configDir, label) {
     const entry = resolveUniqueEntry(configDir, label, "genome rm");
-    const file = ledgerPath(entry.spec.repoPath);
+    const file = ledgerPath(entry.spec.repoPath); // raw-repoPath: ledgerPath() resolves env literals at the FS seam (ledger.ts)
     if (existsSync(file) && readFileSync(file, "utf8").trim().length > 0) {
         blocked(`genome rm refused: '${entry.label}' (${entry.fingerprint}) has ledger history — archive instead`, `lineage lives in ${file}; unregistering a lived genome would orphan its evidence. Keep it registered or move the repo aside.`);
     }

package/dist/commands/graft.js

@@ -43,7 +43,7 @@ function entryForLabel(configDir, label) {
     const matches = readRegistry(configDir).entries.filter((entry) => entry.label === label);
     if (matches.length > 1) {
         cannotAnswer(`graft: label '${label}' is ambiguous — ${String(matches.length)} genomes share it: ${matches
-            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`)
+            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`) // raw-repoPath: display string only; no FS access
             .join(", ")}`, "give the specs distinct labels; the fingerprint is the identity");
     }
     return matches[0] ?? null;

package/dist/commands/readjudicate.js

@@ -0,0 +1,28 @@
+// `abathur re-adjudicate <label> <genId>` — replay the CURRENT gate over an epoch's
+// archived rows and append a corrected verdict row (with provenance). Re-judges, never
+// flips by hand; promote continues to read the LAST row. See core/readjudicate.ts for
+// the replay contract (counters minus own slot, bank excludes this candidate's trees).
+import { resolveConfigDir } from "../config.js";
+import { EXIT_OK, EXIT_CANNOT_ANSWER, cannotAnswer } from "../exit.js";
+import { readjudicateGeneration } from "../core/readjudicate.js";
+import { writeStdout } from "../out.js";
+import { resolveUniqueEntry } from "./run.js";
+const USAGE = "usage: abathur re-adjudicate <label> <genId>";
+function runReadjudicate(args) {
+    const [label, genId] = args;
+    if (label === undefined || genId === undefined || args.length !== 2)
+        cannotAnswer(`re-adjudicate: expected exactly <label> <genId>`, USAGE);
+    const configDir = resolveConfigDir();
+    const entry = resolveUniqueEntry(configDir, label, "re-adjudicate");
+    const outcome = readjudicateGeneration({ entry, configDir, genId, now: () => new Date() });
+    for (const line of outcome.lines)
+        writeStdout(line);
+    // an inconclusive replay means the gate cannot answer — surface it in the exit code,
+    // matching the VERDICT_EXIT semantics of run/promote consumers.
+    return outcome.verdict === "inconclusive" ? EXIT_CANNOT_ANSWER : EXIT_OK;
+}
+export const readjudicateCommand = {
+    name: "re-adjudicate",
+    summary: "replay the current gate over a gen's archived rows; append corrected verdict + provenance (files stay immutable)",
+    run: ({ args }) => Promise.resolve(runReadjudicate(args)),
+};

package/dist/commands/retract.js

@@ -0,0 +1,53 @@
+// `abathur retract <label> <genId> --reason <text>` — the human gate that
+// undoes a promote (core in core/retract.ts, imported ONLY here — the
+// import-policy pin lives in src/test/promote.test.ts). Terminal-only like
+// promote/tombstone: the opencode plugin tool must never reach it. No --force:
+// every refusal is a bug report, not a flag.
+import { resolveConfigDir } from "../config.js";
+import { EXIT_OK, cannotAnswer } from "../exit.js";
+import { retractGeneration } from "../core/retract.js";
+import { writeStdout } from "../out.js";
+import { resolveUniqueEntry } from "./run.js";
+const USAGE = "usage: abathur retract <label> <genId> --reason <text>";
+const MAX_REASON_CHARS = 500;
+async function runRetract(args) {
+    const positional = [];
+    let reason = null;
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--reason") {
+            const value = args[(i += 1)];
+            if (value === undefined || value.startsWith("--"))
+                cannotAnswer("retract: --reason requires a value", USAGE);
+            if (reason !== null)
+                cannotAnswer("retract: --reason given twice", USAGE);
+            reason = value;
+        }
+        else if (arg.startsWith("--")) {
+            cannotAnswer(`retract: unknown flag ${arg}`, USAGE);
+        }
+        else {
+            positional.push(arg);
+        }
+    }
+    const [label, genId] = positional;
+    if (label === undefined || genId === undefined || positional.length !== 2) {
+        cannotAnswer("retract: expected exactly <label> <genId> --reason <text>", USAGE);
+    }
+    if (reason === null || reason.trim().length === 0) {
+        cannotAnswer("retract: --reason <text> is required (why is this promote being undone?)", USAGE);
+    }
+    if (reason.length > MAX_REASON_CHARS)
+        cannotAnswer(`retract: --reason exceeds ${String(MAX_REASON_CHARS)} chars`, USAGE);
+    const configDir = resolveConfigDir();
+    const entry = resolveUniqueEntry(configDir, label, "retract");
+    const outcome = await retractGeneration({ entry, configDir, genId, reason });
+    for (const line of outcome.lines)
+        writeStdout(line);
+    return EXIT_OK;
+}
+export const retractCommand = {
+    name: "retract",
+    summary: "human gate: undo a promote (LIFO, descendant-guarded; append-only row, ref deleted, manifest cleared)",
+    run: ({ args }) => runRetract(args),
+};

package/dist/commands/run.js

@@ -69,7 +69,7 @@ export function resolveUniqueEntry(configDir, label, who = "run") {
     const scan = requireGenomesByLabel(configDir, label);
     if (scan.entries.length > 1) {
         cannotAnswer(`${who}: label '${label}' is ambiguous — ${String(scan.entries.length)} genomes share it: ${scan.entries
-            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`)
+            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`) // raw-repoPath: display string only; no FS access
             .join(", ")}`, "give the specs distinct labels; the fingerprint is the identity");
     }
     const entry = scan.entries[0];

package/dist/commands/self-eval.js

@@ -110,7 +110,7 @@ async function selfEvalHandler(context) {
     for (const warning of readRegistry(configDir).warnings)
         writeStdout(`warning: ${warning}`);
     const entry = resolveUniqueEntry(configDir, flags.label, "self-eval");
-    if (!isEnvRepoLiteral(entry.spec.repoPath)) {
+    if (!isEnvRepoLiteral(entry.spec.repoPath)) { // raw-repoPath: self-mode detection must inspect the STORED literal, not the resolved path
         cannotAnswer(`self-eval: '${entry.spec.label}' is not a self genome — repoPath must be the \${ABATHUR_SELF_REPO} literal`, "self-eval grades the harness against its own sealed kernel; see genomes/abathur-self.jsonc");
     }
     const audit = auditKernel(entry, configDir);

package/dist/commands/tombstone.js

@@ -3,12 +3,13 @@
 // row survive; the reason is stored verbatim (canonicalJson escapes control
 // bytes) but NEVER echoed raw — the confirmation line is sanitized like todo-8's
 // sealMessage so untrusted text cannot forge terminal output.
-import { Ledger } from "../core/ledger.js";
+import path from "node:path";
+import { acquireGenomeLock, acquireLock, LEDGER_KIND_TOMBSTONE, Ledger } from "../core/ledger.js";
+import { effectiveRepoPath } from "../core/spec.js";
 import { resolveConfigDir } from "../config.js";
 import { EXIT_OK, blocked, cannotAnswer } from "../exit.js";
 import { writeStdout } from "../out.js";
 import { resolveUniqueEntry } from "./run.js";
-const LEDGER_KIND_TOMBSTONE = "tombstone";
 const MAX_REASON_CHARS = 4000;
 const USAGE = "usage: abathur tombstone <label> <genId> --reason <text>";
 function echoed(reason) {
@@ -48,22 +49,35 @@ function runTombstone(args) {
     const { label, genId, reason } = parseArgs(args);
     const configDir = resolveConfigDir();
     const entry = resolveUniqueEntry(configDir, label, "tombstone");
-    const ledger = Ledger.open(entry.spec.repoPath);
-    const records = ledger.readAll();
-    if (!records.some((r) => r.kind === "generation_complete" && r.genId === genId)) {
-        blocked(`tombstone: no generation_complete ledger row for gen '${genId}' of '${label}' — nothing to bury`);
-    }
-    const promoted = records.find((r) => r.kind === "promote" && r.genId === genId);
-    if (promoted !== undefined) {
-        blocked(`tombstone: gen '${genId}' was already promoted at ${promoted.ts} — cull is for candidates the human never accepted`);
+    const ledger = Ledger.open(effectiveRepoPath(entry.spec.repoPath));
+    // single-flight with the run loop and sibling gates (same postmortem as promote)
+    const lease = acquireGenomeLock({ ledger, configDir, genomeFp: entry.fingerprint });
+    try {
+        const repoLease = acquireLock({ configDir: path.join(effectiveRepoPath(entry.spec.repoPath), ".state", "abathur"), key: "gate", label: "gate lock" });
+        try {
+            const records = ledger.readAll();
+            if (!records.some((r) => r.kind === "generation_complete" && r.genId === genId)) {
+                blocked(`tombstone: no generation_complete ledger row for gen '${genId}' of '${label}' — nothing to bury`);
+            }
+            const promoted = records.find((r) => r.kind === "promote" && r.genId === genId);
+            if (promoted !== undefined) {
+                blocked(`tombstone: gen '${genId}' was already promoted at ${promoted.ts} — cull is for candidates the human never accepted`);
+            }
+            const buried = records.find((r) => r.kind === LEDGER_KIND_TOMBSTONE && r.genId === genId);
+            if (buried !== undefined) {
+                blocked(`tombstone: gen '${genId}' is already tombstoned at ${buried.ts}`);
+            }
+            ledger.append({ kind: LEDGER_KIND_TOMBSTONE, genId, data: { genId, reason, actor: "cli" } });
+            writeStdout(`tombstone recorded: '${genId}' (reason: ${echoed(reason)}) — commits and lineage preserved (cull ≠ delete)`);
+            return EXIT_OK;
+        }
+        finally {
+            repoLease.release();
+        }
     }
-    const buried = records.find((r) => r.kind === LEDGER_KIND_TOMBSTONE && r.genId === genId);
-    if (buried !== undefined) {
-        blocked(`tombstone: gen '${genId}' is already tombstoned at ${buried.ts}`);
+    finally {
+        lease.release();
     }
-    ledger.append({ kind: LEDGER_KIND_TOMBSTONE, genId, data: { genId, reason, actor: "cli" } });
-    writeStdout(`tombstone recorded: '${genId}' (reason: ${echoed(reason)}) — commits and lineage preserved (cull ≠ delete)`);
-    return EXIT_OK;
 }
 export const tombstoneCommand = {
     name: "tombstone",

package/dist/core/evolve/run-loop.js

@@ -38,6 +38,7 @@ import { buildBrief } from "./brief.js";
 import { startRunFriction } from "./run-friction.js";
 import { runMutatorSession } from "./reflect.js";
 import { asReplicates, benchTarget, cloneMatrixRow, copyProvenance } from "./run-bench.js";
+import { loadScoreBank } from "./score-bank.js";
 import { selfGuardVerdict } from "./self-snapshot.js";
 import { effectiveCaps, planLines } from "./run-plan.js";
 import { addCounters, readResume, } from "./run-rows.js";
@@ -167,6 +168,18 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
         incUnits = out.units;
         lines.push(`incumbent baseline: ${String(out.units.length)} units x ${String(reps)} reps${out.complete ? "" : " (BUDGET-TRUNCATED)"}`);
     }
+    // ---- score bank for acceptance-semantics gates (loaded after the incumbent
+    // row commit so this campaign's baseline reps price the bank — gate-time view;
+    // candidate rows land only after evaluate, never feeding their own verdict).
+    const scoreBank = loadScoreBank(genomeRepo);
+    if (scoreBank === null) {
+        lines.push("score bank: none — legacy cross-arm gate");
+    }
+    else {
+        lines.push(`score bank: ${String(scoreBank.units.size)} unit(s), prior sigma ${scoreBank.priorSigma.toFixed(4)}, pooled df ${String(scoreBank.totalDf)}`);
+        for (const notice of scoreBank.notices)
+            lines.push(`score bank: ${notice}`);
+    }
     // ---- candidate generation session
     const remaining = caps.maxCandidates - counters.candidates;
     const considered = [];
@@ -242,6 +255,7 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
                 stats: spec.bench.stats,
                 budgetCaps: caps,
                 nPairs,
+                ...(scoreBank === null ? {} : { bank: scoreBank.units }),
             });
             const guarded = selfMode ? selfGuardVerdict(out.failures, verdict.verdict) : verdict.verdict;
             const finalVerdict = guarded;

package/dist/core/evolve/run-rows.js

@@ -49,6 +49,20 @@ export const generationRowDataSchema = z
     gateFailures: z.array(z.string()).optional(),
     /** Unrelated worktree dirtiness notices (todo 3 contract: todo 9 books them). */
     dirtyWorktree: z.array(z.strictObject({ xy: z.string(), file: z.string() })).optional(),
+    /** Present only on rows appended by `abathur re-adjudicate`: the corrected verdict with
+     *  full replay provenance (source rows, bank state, replaced verdict). The original row
+     *  stays in the files untouched — this field documents the amendment, never hides it. */
+    readjudication: z.strictObject({
+        at: z.string().min(1),
+        specFingerprint: z.string().min(1),
+        gate: z.enum(["legacy", "acceptance"]),
+        bank: z.strictObject({ units: z.number().int().nonnegative(), priorSigma: z.number(), pooledDf: z.number() }).nullable(),
+        sourceRows: z.strictObject({
+            candidate: z.strictObject({ file: z.string().min(1), ts: z.string().min(1) }),
+            incumbent: z.strictObject({ file: z.string().min(1), ts: z.string().min(1) }),
+        }),
+        replacedVerdict: z.string().min(1),
+    }).optional(),
     benchProvenance: z.strictObject({
         benchType: z.enum(["toy", "opencode-fixture-scenarios"]),
         versions: z.array(z.strictObject({ bin: z.string().min(1), version: z.string() })),

package/dist/core/evolve/score-bank.js

@@ -0,0 +1,214 @@
+// Historical per-unit variance bank for the acceptance-semantics gate
+// (engine redesign 2026-09-24; the design doc + power analysis live in the
+// target genome repo's evidence folder, not shipped here).
+//
+// WHAT IT IS: for every unit, σ pooled from the within-group replicate scatter
+// of ALL generation_complete rows in <genomeRepo>/.state/abathur/ledger*.jsonl
+// (live ledger + campaign archives + pilot). A group = one bench event on one
+// arm (one row's scores array for that unit), so its mean is that doc's mean:
+// pooling mean-removed sums of squares across doc lineages is the classical
+// ANOVA pooled within-group variance — champion-doc changes (the campaign-3
+// promote at 7ca80d7 moved the incumbent head 6ca3ff68→556e1350→062a9fdb→
+// 8fe7e34a→de607dab) shift group MEANS, never this estimate. Pooling raw
+// scores/means across lineages would poison the bank and is what the per-group
+// mean removal exists to prevent.
+//
+// SHIELDING: σ² = (df·σ̂² + ν₀·σ²_glob)/(df+ν₀) with ν₀ = BANK_PRIOR_DF = 2 —
+// [0.5, 0.5] is two reps that failed to observe noise, not proof of σ=0. Thin
+// history (df < BANK_THIN_DF) additionally floors σ at BANK_QUANTUM = 0.125/√2:
+// unit scores are fractions of checklist items on a ~1/8 grid, so two reps one
+// flipped item apart differ by exactly 0.125 and a one-step-pair has sd
+// 0.125/√2; a unit quieter than that has only been lucky, not measured.
+// Proven-quiet units (df ≥ BANK_THIN_DF, e.g. the guards with 12–14 zero-SS
+// df) keep their tight shrunk σ — earned across independent benches.
+//
+// READ-ONLY AND FAIL-CLOSED: never Ledger.open (that mkdirs .state — the same
+// discipline as peekPlanState in run-rows.ts), never writes, never exits the
+// process. A row that fails schema validation contributes nothing and only
+// adds a notice (archives may legitimately predate schema evolutions). No
+// files / no readable rows / zero pooled df ⇒ null ⇒ the caller must run the
+// legacy cross-arm gate verbatim: the bank can only inform, absence can never
+// invent a nomination or a cull.
+//
+// ACTIVATION REQUIRES A ROTATED ARCHIVE: with only the live ledger.jsonl
+// present the bank stays null. A lone live file may be one campaign young
+// (gate-time df=1 per unit — zero cross-doc information) or, worse, the fresh
+// .state of any toy/fixture genome whose very first run would silently switch
+// gates mid-test. Rotation (ledger.campaign<N>-*.jsonl) is the operator's own
+// mark that a genome has earned lifetime history, so it is also the mark that
+// entitles the acceptance gate to override the proven legacy default.
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { LEDGER_KIND_GENERATION_COMPLETE, ledgerPath, ledgerRecordSchema } from "../ledger.js";
+import { generationRowDataSchema } from "./run-rows.js";
+// ------------------------------------------------------------- bank epoch
+// Lineage-restart quarantine (institutional addition 2026-09-25, born of the
+// s19 pin era + the s16 churn window): an operator-ruled epoch start for a
+// unit voids every bank group whose row.ts predates it — a broken or polluted
+// measurement era must not teach the gate the wrong noise level. The LEDGER
+// FILES STAY IMMUTABLE (doctrine): the verdict on which rows count lives in
+// this sidecar, beside its prose provenance (rotation NOTEs / evidence pages).
+// FAIL-CLOSED IN BOTH DIRECTIONS: absent sidecar ⇒ no quarantine; present but
+// malformed/unreadable/unparsable-dates ⇒ the WHOLE bank returns null and the
+// caller runs the legacy gate verbatim — a quarantine we cannot read honestly
+// is a quarantine we cannot silently ignore.
+const BANK_EPOCH_FILE = "bank-epoch.json";
+const bankEpochSchema = z.record(z.string().min(1), z
+    .object({ sinceIso: z.string().min(1), why: z.string().optional() })
+    .strict());
+function loadBankEpoch(dir, note) {
+    let raw;
+    try {
+        raw = readFileSync(path.join(dir, BANK_EPOCH_FILE), "utf8");
+    }
+    catch (cause) {
+        const code = cause?.code;
+        if (code === "ENOENT")
+            return undefined; // absent: nothing quarantined
+        note(`${BANK_EPOCH_FILE}: unreadable (${String(cause)}) — bank disabled, legacy gate`);
+        return null;
+    }
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch (cause) {
+        note(`${BANK_EPOCH_FILE}: invalid JSON (${String(cause)}) — bank disabled, legacy gate`);
+        return null;
+    }
+    const parsed = bankEpochSchema.safeParse(doc);
+    if (!parsed.success) {
+        note(`${BANK_EPOCH_FILE}: schema violation (${parsed.error.issues[0]?.message ?? "?"}) — bank disabled, legacy gate`);
+        return null;
+    }
+    const out = new Map();
+    for (const [unitId, rule] of Object.entries(parsed.data)) {
+        const sinceMs = Date.parse(rule.sinceIso);
+        if (!Number.isFinite(sinceMs)) {
+            note(`${BANK_EPOCH_FILE}: bad sinceIso for '${unitId}' — bank disabled, legacy gate`);
+            return null;
+        }
+        out.set(unitId, { sinceIso: rule.sinceIso, sinceMs, why: rule.why ?? "" });
+    }
+    return out;
+}
+/** Half of one 1/8-grid checklist step between two reps — the sd of that pair. */
+export const BANK_QUANTUM = 0.125 / Math.SQRT2;
+/** Phantom df of the bank-wide pooled prior used to shrink each unit's σ̂². */
+export const BANK_PRIOR_DF = 2;
+/** Below this pooled df a unit's history counts as thin and the quantum floor binds. */
+export const BANK_THIN_DF = 6;
+/** Notices stop accumulating past this many lines (a corrupt archive must not flood run output). */
+const NOTICE_CAP = 20;
+/** One group = one row × unit; a multi-rep scores array contributes n−1 df of within-mean scatter. */
+function accumulate(acc, unitId, scores) {
+    const n = scores.length;
+    if (n < 2)
+        return;
+    let sum = 0;
+    for (const s of scores)
+        sum += s;
+    const mean = sum / n;
+    let ss = 0;
+    for (const s of scores) {
+        const d = s - mean;
+        ss += d * d;
+    }
+    const cur = acc.get(unitId) ?? { df: 0, ss: 0 };
+    acc.set(unitId, { df: cur.df + (n - 1), ss: cur.ss + ss });
+}
+const LIVE_LEDGER = "ledger.jsonl";
+function isRotatedArchive(name) {
+    return name.startsWith("ledger.") && name.endsWith(".jsonl") && name !== LIVE_LEDGER && !name.startsWith("ledger.corrupt-");
+}
+export function loadScoreBank(genomeRepo, opts = {}) {
+    const dir = path.dirname(ledgerPath(genomeRepo));
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return null; // no .state/abathur at all — fresh genome, legacy gate
+    }
+    const excluded = new Set(opts.excludeCandidateTrees ?? []);
+    const excludedFiles = new Set(opts.excludeFiles ?? []);
+    const files = names.filter((n) => (n === LIVE_LEDGER || isRotatedArchive(n)) && !excludedFiles.has(n)).sort();
+    if (!files.some(isRotatedArchive))
+        return null; // activation law: rotated history or legacy gate
+    const notices = [];
+    const note = (line) => {
+        if (notices.length < NOTICE_CAP)
+            notices.push(line);
+        else if (notices.length === NOTICE_CAP)
+            notices.push("score bank: further notices suppressed");
+    };
+    const bankEpoch = loadBankEpoch(dir, note);
+    if (bankEpoch === null)
+        return null; // malformed quarantine ⇒ legacy gate, never a silently ignored one
+    const quarantined = new Map();
+    const acc = new Map();
+    for (const file of files) {
+        let text;
+        try {
+            text = readFileSync(path.join(dir, file), "utf8");
+        }
+        catch {
+            note(`${file}: unreadable — archive skipped`);
+            continue;
+        }
+        const lines = text.split("\n");
+        lines.forEach((raw, index) => {
+            const line = raw.trim();
+            if (line.length === 0)
+                return;
+            let record;
+            try {
+                record = JSON.parse(line);
+            }
+            catch {
+                note(`${file}:${String(index + 1)}: not JSON — row skipped`);
+                return;
+            }
+            const parsed = ledgerRecordSchema.safeParse(record);
+            if (!parsed.success || parsed.data.kind !== LEDGER_KIND_GENERATION_COMPLETE)
+                return;
+            const row = generationRowDataSchema.safeParse(parsed.data.data);
+            if (!row.success) {
+                note(`${file}:${String(index + 1)}: generation_complete row unreadable — row skipped`);
+                return;
+            }
+            if (row.data.source === "candidate" && row.data.treeSha !== undefined && excluded.has(row.data.treeSha))
+                return;
+            const rowMs = Date.parse(parsed.data.ts);
+            for (const u of row.data.units) {
+                const rule = bankEpoch?.get(u.unitId);
+                if (rule !== undefined && !(Number.isFinite(rowMs) && rowMs >= rule.sinceMs)) {
+                    quarantined.set(u.unitId, (quarantined.get(u.unitId) ?? 0) + 1);
+                    continue; // only rows provably at/after the epoch start count; unreadable ts fails closed
+                }
+                accumulate(acc, u.unitId, u.scores);
+            }
+        });
+    }
+    for (const [unitId, rule] of [...(bankEpoch ?? new Map()).entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+        note(`bank-epoch '${unitId}' since ${rule.sinceIso}: ${String(quarantined.get(unitId) ?? 0)} group(s) quarantined${rule.why === "" ? "" : ` — ${rule.why}`}`);
+    }
+    let totalDf = 0;
+    let totalSs = 0;
+    for (const { df, ss } of acc.values()) {
+        totalDf += df;
+        totalSs += ss;
+    }
+    if (totalDf === 0)
+        return null;
+    const priorVar = totalSs / totalDf;
+    const units = new Map();
+    for (const [unitId, { df, ss }] of [...acc.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+        const within = ss / df;
+        const shrunk = (df * within + BANK_PRIOR_DF * priorVar) / (df + BANK_PRIOR_DF);
+        const sigma = Math.sqrt(shrunk);
+        units.set(unitId, { sigma: df >= BANK_THIN_DF ? sigma : Math.max(sigma, BANK_QUANTUM), df });
+    }
+    return { units, priorSigma: Math.sqrt(priorVar), totalDf, notices };
+}

package/dist/core/graft-rebench.js

@@ -13,6 +13,7 @@ import { LEDGER_KIND_GENERATION_COMPLETE } from "./ledger.js";
 import { newGeneration, openGenome, sealGeneration, snapshotCommit } from "./worktree.js";
 import { git, tryGit } from "../util/git.js";
 import { asReplicates, benchTarget, cloneMatrixRow, copyProvenance } from "./evolve/run-bench.js";
+import { loadScoreBank } from "./evolve/score-bank.js";
 import { addCounters, readResume } from "./evolve/run-rows.js";
 import { ChildTracker, reapOrphans } from "./evolve/child-track.js";
 import { clampReps, evaluate, VERDICT_EXIT } from "./stats.js";
@@ -82,6 +83,7 @@ export async function graftAndBench(req, ctx) {
         ledger.append({ kind: LEDGER_KIND_GENERATION_COMPLETE, genId: incGen, data });
         incUnits = out.units;
     }
+    const scoreBank = loadScoreBank(spec.repoPath);
     const out = await benchTarget({
         spec: { ...spec, repoPath: gen.worktreePath },
         genId: graftGenId,
@@ -103,6 +105,7 @@ export async function graftAndBench(req, ctx) {
         stats: spec.bench.stats,
         budgetCaps: caps,
         nPairs: 1,
+        ...(scoreBank === null ? {} : { bank: scoreBank.units }),
     });
     // EXACTLY ONE graft_import decision row lands BEFORE any further writes.
     ctx.recordDecision(gate.verdict, localScoreReason(gate, manifest, reps), { graftGenId, ...sealed });

package/dist/core/ledger.js

@@ -9,10 +9,13 @@ import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync
 import path from "node:path";
 import { z } from "zod";
 import { canonicalJson, compactUtc } from "./ids.js";
+import { effectiveRepoPath } from "./spec.js";
 import { acquireLock } from "./locks.js";
 export { acquireLock, lockDirFor } from "./locks.js";
 export const LEDGER_KIND_LOCK_TAKEOVER = "lock_takeover";
 export const LEDGER_KIND_GENERATION_COMPLETE = "generation_complete";
+export const LEDGER_KIND_PROMOTE = "promote";
+export const LEDGER_KIND_TOMBSTONE = "tombstone";
 export const ledgerRecordSchema = z.strictObject({
     v: z.literal(1),
     ts: z.string().min(1),
@@ -30,7 +33,11 @@ export class LedgerError extends Error {
     }
 }
 export function ledgerPath(genomeRepo) {
-    return path.join(genomeRepo, ".state", "abathur", "ledger.jsonl");
+    // FS-seam rule: the stored repoPath may be an unresolved `${VAR}` literal
+    // (0.2.x convention; see 4997618 / 863e6c2). Resolve HERE at the single
+    // ledger seam so no caller can ever read an empty ledger under a literal
+    // path and report a misleading downstream error again.
+    return path.join(effectiveRepoPath(genomeRepo), ".state", "abathur", "ledger.jsonl");
 }
 function buildRecord(input, now) {
     const candidate = {