@tangle-network/agent-eval 0.116.0 → 0.117.1

package/dist/{chunk-GSW3OBHK.js → chunk-JSJZ4PJ6.js}

@@ -1,33 +1,39 @@
 import {
+  JudgeParseError,
   assertCodeSurfaceIdentity,
   campaignBreakdown,
   campaignMeanComposite,
+  costReceiptFromTCloud,
   defaultProductionGate,
   gepaProposer,
   isProposedCandidate,
   labelTrustRank,
+  maximumChargeForTCloudRequest,
   pairHoldout,
   recoverTruncatedJson,
   renderAnalystEvidence,
   runImprovementLoop,
   surfaceContentHash,
   surfaceHash
-} from "./chunk-3274WNK7.js";
-import {
-  estimateCost,
-  isModelPriced
-} from "./chunk-VI2UW6B6.js";
+} from "./chunk-HQPHZGL6.js";
 import {
+  SearchLedgerConflictError,
+  SearchLedgerError,
+  SearchLedgerIntegrityError,
+  appendSearchLedgerLine,
   assertRealBackend,
   contentHash,
+  createRunCostLedger,
+  fsCampaignStorage,
   planCampaignRun,
+  resolveRunDir,
   runCampaign,
-  summarizeBackendIntegrity
-} from "./chunk-FAOEFFRT.js";
+  summarizeBackendIntegrity,
+  withSearchLedgerFileLock
+} from "./chunk-IDZTTFRR.js";
 import {
-  Mutex,
-  clamp01
-} from "./chunk-MPHTT5HE.js";
+  Mutex
+} from "./chunk-3YYRZDON.js";
 import {
   AnalystRegistry,
   DEFAULT_TRACE_ANALYST_KINDS,
@@ -42,22 +48,21 @@ import {
   makePolicyEditCandidateRecord,
   policyEditsFromFindings,
   validatePolicyEditCandidateRecord
-} from "./chunk-CIUOICJT.js";
+} from "./chunk-MGEHEHSN.js";
 import {
   eProcess,
   mcnemar,
   mulberry32,
   pairedBootstrap,
   pairedRiskDifference,
-  weightedComposite,
   wilcoxonSignedRank
 } from "./chunk-PJQFMIOX.js";
 import {
   analyzeTraces
-} from "./chunk-RPDDVKI7.js";
+} from "./chunk-4JLWXDYA.js";
 import {
   OtlpFileTraceStore
-} from "./chunk-LNQEP766.js";
+} from "./chunk-S2F4J57L.js";
 import {
   modelHasSnapshot,
   validateRunRecord
@@ -70,11 +75,17 @@ import {
 } from "./chunk-VSMTAMNK.js";
 import {
   callLlm,
-  callLlmJson
-} from "./chunk-GY4SYVPJ.js";
+  callLlmJson,
+  costReceiptFromLlm,
+  costReceiptFromLlmError,
+  maximumChargeForLlmRequest
+} from "./chunk-NJC7U437.js";
+import {
+  CostAccountingIncompleteError,
+  CostLedger
+} from "./chunk-VCTY3W6J.js";
 import {
   AgentEvalError,
-  JudgeError,
   ValidationError
 } from "./chunk-ONWEPEDO.js";
 
@@ -496,339 +507,6 @@ async function runLineage(opts) {
   return { lineage, best: lineage.best(), steps };
 }
 
-// src/judges.ts
-var JudgeParseError = class extends JudgeError {
-  /** Name of the judge whose response failed to parse. */
-  judgeName;
-  /** The raw (truncated) model response that failed to parse. */
-  raw;
-  constructor(judgeName, raw, options) {
-    super(`judge '${judgeName}' returned an unparseable response: ${raw.slice(0, 200)}`, options);
-    this.judgeName = judgeName;
-    this.raw = raw;
-  }
-};
-function createDomainExpertJudge(domain) {
-  return async (tc, { scenario, turns }) => {
-    const conversation = turns.map(
-      (t, i) => `Turn ${i + 1}:
-User: ${t.userMessage}
-Agent: ${t.agentResponse.slice(0, 2e3)}`
-    ).join("\n\n---\n\n");
-    const resp = await tc.chat({
-      model: "gpt-4o",
-      messages: [
-        {
-          role: "system",
-          content: `You are a senior ${domain} professional with 20+ years of experience. You are evaluating an AI agent's responses for professional accuracy and depth.
-
-Score STRICTLY. A 5 means "a junior professional could do this." An 8 means "solid mid-career work." A 10 means "I would hire this agent."
-
-Evaluate:
-1. **domain_accuracy** (0-10): Are the technical terms correct? Are the recommendations what you'd actually do? Would this advice cause problems if followed?
-2. **professional_depth** (0-10): Does it go beyond surface-level? Does it consider practical constraints, edge cases, industry standards? Or is it generic textbook advice?
-
-Respond with JSON only: [{"dimension":"domain_accuracy","score":N,"reasoning":"...","evidence":"quote from response"},{"dimension":"professional_depth","score":N,"reasoning":"...","evidence":"quote"}]`
-        },
-        {
-          role: "user",
-          content: `Persona: ${scenario.persona} (${scenario.label})
-Scenario: ${scenario.thesis}
-
-${conversation}`
-        }
-      ],
-      temperature: 0.1,
-      maxTokens: 800
-    });
-    return parseJudgeResponse("domain_expert", resp);
-  };
-}
-var codeExecutionJudge = async (tc, { scenario, artifacts }) => {
-  const codeBlocks = artifacts.codeBlocks;
-  if (codeBlocks.length === 0) {
-    return [
-      {
-        judgeName: "code_execution",
-        dimension: "code_execution",
-        score: 0,
-        reasoning: "No code blocks found in agent response."
-      }
-    ];
-  }
-  const codeText = codeBlocks.map(
-    (b, i) => `Block ${i + 1} (${b.language}):
-\`\`\`${b.language}
-${b.code.slice(0, 3e3)}
-\`\`\``
-  ).join("\n\n");
-  const resp = await tc.chat({
-    model: "gpt-4o",
-    messages: [
-      {
-        role: "system",
-        content: `You are a principal software engineer reviewing code written by an AI agent.
-
-Score STRICTLY:
-1. **executability** (0-10): Would this code run without errors? Check: import errors, undefined variables, missing deps, syntax errors. A 5 means "would run with minor fixes." A 10 means "copy-paste and it works."
-2. **completeness** (0-10): Does it handle the FULL task, or just the happy path? A 5 means "handles the main case." A 10 means "production-ready."
-3. **reusability** (0-10): Could this be saved as a tool and reused? A 5 means "works for this case." A 10 means "general-purpose tool."
-
-Respond with JSON only: [{"dimension":"executability","score":N,"reasoning":"...","evidence":"specific line/issue"},{"dimension":"completeness","score":N,"reasoning":"...","evidence":"..."},{"dimension":"reusability","score":N,"reasoning":"...","evidence":"..."}]`
-      },
-      {
-        role: "user",
-        content: `Task: ${scenario.thesis}
-
-${codeText}`
-      }
-    ],
-    temperature: 0.1,
-    maxTokens: 1e3
-  });
-  return parseJudgeResponse("code_execution", resp);
-};
-var coherenceJudge = async (tc, { scenario, turns }) => {
-  if (turns.length < 2) {
-    return [];
-  }
-  const conversation = turns.map(
-    (t, i) => `Turn ${i + 1}:
-User: ${t.userMessage}
-Agent (${t.agentResponse.length} chars): ${t.agentResponse.slice(0, 1500)}`
-  ).join("\n\n---\n\n");
-  const resp = await tc.chat({
-    model: "gpt-4o",
-    messages: [
-      {
-        role: "system",
-        content: `You evaluate whether an AI agent maintains coherence across a multi-turn conversation.
-
-Score STRICTLY:
-1. **consistency** (0-10): Does the agent contradict itself across turns? Does it remember what it said/built earlier?
-2. **progression** (0-10): Does each turn BUILD on the previous? Or does it start fresh? A 5 means "vaguely related." A 10 means "each turn clearly advances the work."
-3. **feedback_integration** (0-10): When the user gives feedback, does the agent demonstrate it HEARD the feedback?
-
-Respond with JSON only: [{"dimension":"consistency","score":N,"reasoning":"..."},{"dimension":"progression","score":N,"reasoning":"..."},{"dimension":"feedback_integration","score":N,"reasoning":"..."}]`
-      },
-      {
-        role: "user",
-        content: `Scenario: ${scenario.thesis}
-
-${conversation}`
-      }
-    ],
-    temperature: 0.1,
-    maxTokens: 800
-  });
-  return parseJudgeResponse("coherence", resp);
-};
-var adversarialJudge = async (tc, { scenario, turns }) => {
-  const conversation = turns.map(
-    (t, i) => `Turn ${i + 1}:
-User: ${t.userMessage}
-Agent: ${t.agentResponse.slice(0, 1500)}`
-  ).join("\n\n---\n\n");
-  const resp = await tc.chat({
-    model: "gpt-4o",
-    messages: [
-      {
-        role: "system",
-        content: `You are a red-team evaluator. Find the WEAKEST point in the AI agent's responses. Be adversarial.
-
-1. **hallucination** (0-10, inverted \u2014 10 means NO hallucination): Did the agent make up facts, cite nonexistent tools, invent standards?
-2. **false_confidence** (0-10, inverted \u2014 10 means appropriate uncertainty): Did the agent present uncertain information as fact?
-3. **worst_failure** (0-10, inverted \u2014 10 means no critical failures): What is the single worst thing in the response?
-
-Be harsh. If everything is genuinely good, say so \u2014 but look hard first.
-
-Respond with JSON only: [{"dimension":"hallucination","score":N,"reasoning":"...","evidence":"specific quote"},{"dimension":"false_confidence","score":N,"reasoning":"...","evidence":"..."},{"dimension":"worst_failure","score":N,"reasoning":"...","evidence":"..."}]`
-      },
-      {
-        role: "user",
-        content: `Persona: ${scenario.persona}
-Scenario: ${scenario.thesis}
-
-${conversation}`
-      }
-    ],
-    temperature: 0.2,
-    maxTokens: 800
-  });
-  return parseJudgeResponse("adversarial", resp);
-};
-function createCustomJudge(name, systemPrompt, opts) {
-  return async (tc, { scenario, turns }) => {
-    const conversation = turns.map(
-      (t, i) => `Turn ${i + 1}:
-User: ${t.userMessage}
-Agent: ${t.agentResponse.slice(0, 2e3)}`
-    ).join("\n\n---\n\n");
-    const resp = await tc.chat({
-      model: opts?.model ?? "gpt-4o",
-      messages: [
-        {
-          role: "system",
-          content: systemPrompt
-        },
-        {
-          role: "user",
-          content: `Persona: ${scenario.persona} (${scenario.label})
-Scenario: ${scenario.thesis}
-
-${conversation}`
-        }
-      ],
-      temperature: opts?.temperature ?? 0.1,
-      maxTokens: opts?.maxTokens ?? 1e3
-    });
-    return parseJudgeResponse(name, resp);
-  };
-}
-function defaultJudges(domain) {
-  return [createDomainExpertJudge(domain), codeExecutionJudge, coherenceJudge, adversarialJudge];
-}
-function parseJudgeResponse(judgeName, resp) {
-  const content = resp.choices?.[0]?.message?.content ?? "";
-  try {
-    let cleaned = content.replace(/```json\n?|\n?```/g, "").trim();
-    const arrayMatch = cleaned.match(/\[[\s\S]*\]/);
-    if (arrayMatch) cleaned = arrayMatch[0];
-    const parsed = JSON.parse(cleaned);
-    return parsed.map((p) => ({
-      judgeName,
-      dimension: p.dimension,
-      score: Math.max(0, Math.min(10, p.score)),
-      reasoning: p.reasoning ?? "",
-      evidence: p.evidence
-    }));
-  } catch (err) {
-    throw new JudgeParseError(judgeName, content, { cause: err });
-  }
-}
-
-// src/llm-judge.ts
-function llmJudge(name, prompt, opts) {
-  if (!name.trim()) {
-    throw new Error("llmJudge: name must be non-empty");
-  }
-  if (!prompt.trim()) {
-    throw new Error(`llmJudge '${name}': prompt must be non-empty`);
-  }
-  const model = opts.model ?? opts.chat.defaultModel;
-  if (!model) {
-    throw new Error(
-      `llmJudge '${name}': no model on opts and no defaultModel on the ChatClient \u2014 pass opts.model or bind defaultModel at createChatClient().`
-    );
-  }
-  const dimensions = normalizeDimensions(opts.dimensions, name);
-  const scale = opts.scale ?? "unit";
-  const divisor = scale === "ten" ? 10 : 1;
-  const renderUser = opts.renderUser ?? ((input) => JSON.stringify({ scenario: input.scenario, artifact: input.artifact }, null, 2));
-  if (opts.weights) {
-    for (const key of Object.keys(opts.weights)) {
-      if (!dimensions.some((d) => d.key === key)) {
-        throw new Error(
-          `llmJudge '${name}': weights names dimension '${key}' that is not declared in dimensions`
-        );
-      }
-    }
-  }
-  const systemPrompt = `${prompt}
-
-${renderContract(dimensions, scale)}`;
-  return {
-    name,
-    dimensions,
-    appliesTo: opts.appliesTo,
-    async score({ artifact, scenario, signal }) {
-      const response = await opts.chat.chat(
-        {
-          model,
-          messages: [
-            { role: "system", content: systemPrompt },
-            { role: "user", content: renderUser({ artifact, scenario }) }
-          ],
-          jsonMode: true,
-          temperature: opts.temperature ?? 0.1,
-          maxTokens: opts.maxTokens ?? 800
-        },
-        { signal }
-      );
-      const parsed = parseResponse(name, response.content);
-      const rawDims = parsed.dimensions ?? parsed.scores;
-      if (!rawDims || typeof rawDims !== "object") {
-        throw new JudgeParseError(name, response.content, {
-          cause: new Error("response has no `dimensions` object")
-        });
-      }
-      const dims = {};
-      for (const { key } of dimensions) {
-        const raw = rawDims[key];
-        const value = Number(raw);
-        if (raw === void 0 || raw === null || !Number.isFinite(value)) {
-          throw new JudgeParseError(name, response.content, {
-            cause: new Error(
-              `dimension '${key}' missing or non-numeric (got ${JSON.stringify(raw)})`
-            )
-          });
-        }
-        dims[key] = clamp01(value / divisor);
-      }
-      const weights = opts.weights ?? Object.fromEntries(dimensions.map((d) => [d.key, 1 / dimensions.length]));
-      const { composite } = weightedComposite({ dims, weights });
-      const notes = firstString(parsed.notes) ?? firstString(parsed.rationale) ?? `${name}: composite ${composite.toFixed(3)} over ${dimensions.length} dimension(s)`;
-      return { dimensions: dims, composite, notes };
-    }
-  };
-}
-function normalizeDimensions(input, name) {
-  const raw = input && input.length > 0 ? input : ["quality"];
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const d of raw) {
-    const dim = typeof d === "string" ? { key: d, description: d } : d;
-    if (!dim.key.trim()) {
-      throw new Error(`llmJudge '${name}': dimension key must be non-empty`);
-    }
-    if (seen.has(dim.key)) {
-      throw new Error(`llmJudge '${name}': duplicate dimension key '${dim.key}'`);
-    }
-    seen.add(dim.key);
-    out.push(dim);
-  }
-  return out;
-}
-function renderContract(dimensions, scale) {
-  const range = scale === "ten" ? "0 to 10" : "0.0 to 1.0";
-  const lines = dimensions.map((d) => `  - "${d.key}": ${d.description} (score ${range})`);
-  const example = `{"dimensions": {${dimensions.map((d) => `"${d.key}": <number>`).join(", ")}}, "notes": "<one-line rationale>"}`;
-  return [
-    "Score the artifact on EACH of these dimensions:",
-    ...lines,
-    "",
-    `Respond with JSON ONLY, no prose. Every dimension is a number in [${range}]:`,
-    example
-  ].join("\n");
-}
-function parseResponse(name, content) {
-  const stripped = content.replace(/```json\n?|\n?```/g, "").trim();
-  const objMatch = stripped.match(/\{[\s\S]*\}/);
-  const payload = objMatch ? objMatch[0] : stripped;
-  try {
-    const parsed = JSON.parse(payload);
-    if (typeof parsed !== "object" || parsed === null) {
-      throw new Error("parsed value is not an object");
-    }
-    return parsed;
-  } catch (err) {
-    throw new JudgeParseError(name, content, { cause: err });
-  }
-}
-function firstString(value) {
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-
 // src/campaign/analyst-surface.ts
 function surfaceToText(surface) {
   if (typeof surface === "string") return surface;
@@ -3418,6 +3096,7 @@ var SKILLOPT_SYSTEM = 'You are a SkillOpt optimizer. You improve ONE skill docum
 function skillOptProposer(opts) {
   const evidenceK = opts.evidenceK ?? 3;
   const defaultBudget = opts.editBudget ?? 3;
+  const directCostLedger = opts.costLedger ?? new CostLedger();
   async function proposePatches(args) {
     const userPrompt = buildPatchPrompt({
       target: opts.target,
@@ -3429,19 +3108,29 @@ function skillOptProposer(opts) {
       findingsNote: args.findingsNote,
       count: args.count
     });
-    const result = await callLlm(
-      {
-        model: opts.model,
-        messages: [
-          { role: "system", content: SKILLOPT_SYSTEM },
-          { role: "user", content: userPrompt }
-        ],
-        jsonMode: true,
-        temperature: opts.temperature ?? 0.6,
-        maxTokens: opts.maxTokens ?? 4e3
-      },
-      opts.llm
-    );
+    const request = {
+      model: opts.model,
+      messages: [
+        { role: "system", content: SKILLOPT_SYSTEM },
+        { role: "user", content: userPrompt }
+      ],
+      jsonMode: true,
+      temperature: opts.temperature ?? 0.6,
+      maxTokens: opts.maxTokens ?? 4e3
+    };
+    const paid = await (args.costLedger ?? directCostLedger).runPaidCall({
+      channel: "driver",
+      phase: args.costPhase ?? "search.proposal",
+      actor: "skill-opt.propose",
+      model: opts.model,
+      maximumCharge: maximumChargeForLlmRequest(request, opts.llm),
+      signal: args.signal,
+      execute: (signal, callId) => callLlm(request, { ...opts.llm, signal, idempotencyKey: callId }),
+      receipt: costReceiptFromLlm,
+      receiptFromError: costReceiptFromLlmError
+    });
+    if (!paid.succeeded) throw paid.error;
+    const result = paid.value;
     return parseSkillPatchResponse(result.content, args.count, args.editBudget);
   }
   return {
@@ -3461,7 +3150,9 @@ function skillOptProposer(opts) {
         rejectedBuffer: [],
         findingsNote: renderAnalystEvidence(ctx.findings, ctx.report) ?? void 0,
         count: ctx.populationSize,
-        signal: ctx.signal
+        signal: ctx.signal,
+        costLedger: ctx.costLedger ?? directCostLedger,
+        costPhase: ctx.costPhase ?? "search.proposal"
       });
       const out = [];
       const seen = /* @__PURE__ */ new Set();
@@ -3625,16 +3316,20 @@ async function runSkillOpt(opts) {
   const budgetAnneal = opts.budgetAnneal ?? true;
   const rejectedBufferSize = opts.rejectedBufferSize ?? 12;
   const slowMetaEvery = opts.slowMetaEvery ?? 2;
-  let totalCostUsd = 0;
+  opts.runDir = resolveRunDir(opts.runDir, opts.repo);
+  const storage = opts.storage ?? fsCampaignStorage();
+  const costLedger = opts.costLedger ?? createRunCostLedger({
+    storage,
+    runDir: opts.runDir,
+    costCeilingUsd: opts.costCeiling
+  });
   const scoreHoldout = async (surface, tag) => {
-    const campaign = await runScoringCampaign(opts, opts.holdoutScenarios, surface, tag);
-    totalCostUsd += campaign.aggregates.totalCostUsd;
+    const campaign = await runScoringCampaign(opts, opts.holdoutScenarios, surface, tag, costLedger);
     return campaignMeanComposite(campaign);
   };
   const evidenceK = opts.evidenceK ?? 3;
   const trainEvidence = async (surface, tag) => {
-    const campaign = await runScoringCampaign(opts, opts.trainScenarios, surface, tag);
-    totalCostUsd += campaign.aggregates.totalCostUsd;
+    const campaign = await runScoringCampaign(opts, opts.trainScenarios, surface, tag, costLedger);
     return toEvidence(campaign, evidenceK);
   };
   let current = opts.baselineSurface;
@@ -3658,7 +3353,9 @@ async function runSkillOpt(opts) {
       rejectedBuffer: buffer,
       metaNote,
       count: patchesPerEpoch,
-      signal: opts.signal ?? new AbortController().signal
+      signal: opts.signal ?? new AbortController().signal,
+      costLedger,
+      costPhase: "skill-opt.proposal"
     });
     let accepted = null;
     const rejectedThisEpoch = [];
@@ -3717,6 +3414,7 @@ async function runSkillOpt(opts) {
     });
     if (sinceAccept >= patience) break;
   }
+  const cost = costLedger.summary();
   return {
     winnerSurface: current,
     baselineHoldoutComposite: baselineHoldout,
@@ -3726,12 +3424,14 @@ async function runSkillOpt(opts) {
     rejectedEdits: rejectedAll,
     epochsRun,
     history,
-    totalCostUsd
+    totalCostUsd: cost.totalCostUsd,
+    cost
   };
 }
-function runScoringCampaign(opts, scenarios, surface, tag) {
+function runScoringCampaign(opts, scenarios, surface, tag, costLedger) {
   return runCampaign({
     ...opts,
+    costLedger,
     scenarios,
     dispatch: (scenario, ctx) => opts.dispatchWithSurface(surface, scenario, ctx),
     runDir: `${opts.runDir}/${tag}`
@@ -3903,11 +3603,11 @@ function gepaEntry(config, combineParents, name) {
         ...config.analyzeGeneration ? { analyzeGeneration: config.analyzeGeneration } : {},
         ...config.report !== void 0 ? { report: config.report } : {}
       });
-      const costUsd = result.baselineCampaign.aggregates.totalCostUsd + result.generations.reduce(
-        (sum, g) => sum + g.surfaces.reduce((s, sf) => s + sf.campaign.aggregates.totalCostUsd, 0),
-        0
-      );
-      return { winnerSurface: result.winnerSurface, costUsd, durationMs: Date.now() - started };
+      return {
+        winnerSurface: result.winnerSurface,
+        costUsd: result.cost.totalCostUsd,
+        durationMs: Date.now() - started
+      };
     }
   };
 }
@@ -3980,11 +3680,11 @@ function fapoEscalationEntry(config, name = "fapo-escalation") {
         ...config.analyzeGeneration ? { analyzeGeneration: config.analyzeGeneration } : {},
         ...config.report !== void 0 ? { report: config.report } : {}
       });
-      const costUsd = result.baselineCampaign.aggregates.totalCostUsd + result.generations.reduce(
-        (sum, g) => sum + g.surfaces.reduce((s, sf) => s + sf.campaign.aggregates.totalCostUsd, 0),
-        0
-      );
-      return { winnerSurface: result.winnerSurface, costUsd, durationMs: Date.now() - started };
+      return {
+        winnerSurface: result.winnerSurface,
+        costUsd: result.cost.totalCostUsd,
+        durationMs: Date.now() - started
+      };
     }
   };
 }
@@ -4218,6 +3918,7 @@ function createLlmCorrectnessChecker(tc, opts = {}) {
   const model = opts.model ?? "claude-sonnet-4-6";
   const maxContentChars = opts.maxContentChars ?? 8e3;
   const maxAttempts = opts.maxAttempts ?? 2;
+  const costLedger = opts.costLedger ?? new CostLedger();
   const sink = opts.rawSink;
   const record = async (event) => {
     try {
@@ -4261,7 +3962,24 @@ ${content.slice(0, maxContentChars)}`
         redactedFields: []
       });
       try {
-        const resp = await tc.chat(request);
+        const paid = await costLedger.runPaidCall({
+          channel: "verifier",
+          phase: opts.costPhase ?? "completion.correctness",
+          actor: "correctness-checker",
+          model,
+          maximumCharge: maximumChargeForTCloudRequest(request, opts.tcloudMaximumAttempts),
+          tags: {
+            ...opts.costTags,
+            requirementId: requirement.reqId,
+            attempt: String(attempt)
+          },
+          signal: opts.signal,
+          execute: () => tc.chat(request),
+          receipt: (response) => costReceiptFromTCloud(response, model),
+          receiptFromError: (error) => opts.receiptFromError?.(error, attempt)
+        });
+        if (!paid.succeeded) throw paid.error;
+        const resp = paid.value;
         const raw = resp.choices?.[0]?.message?.content ?? "";
         await record({
           eventId: randomUUID(),
@@ -4777,12 +4495,12 @@ function requireResolvedModel(cell, profileId) {
   const resolved = cell.resolvedModel?.trim();
   if (!resolved) {
     throw new ProfileMatrixError(
-      `profile '${profileId}' declared the '${HARNESS_NATIVE_MODEL}' runtime-resolved model but its dispatch reported no resolved model for cell '${cell.cellId}' \u2014 report it via ctx.cost.observeModel(<id>) so the RunRecord pins the real model (never records '${HARNESS_NATIVE_MODEL}')`
+      `profile '${profileId}' declared the '${HARNESS_NATIVE_MODEL}' runtime-resolved model but its dispatch reported no resolved model for cell '${cell.cellId}' \u2014 return it in the ctx.cost.runPaidCall receipt so the RunRecord pins the real model (never records '${HARNESS_NATIVE_MODEL}')`
     );
   }
   if (!modelHasSnapshot(resolved)) {
     throw new ProfileMatrixError(
-      `profile '${profileId}' resolved to model '${resolved}' for cell '${cell.cellId}', which lacks a snapshot version \u2014 pin it (name@YYYY-MM-DD or name-YYYYMMDD) before reporting it via ctx.cost.observeModel`
+      `profile '${profileId}' resolved to model '${resolved}' for cell '${cell.cellId}', which lacks a snapshot version \u2014 pin it (name@YYYY-MM-DD or name-YYYYMMDD) in the paid-call receipt`
     );
   }
   return resolved;
@@ -4808,14 +4526,9 @@ function buildRunRecord(args) {
   }
   const perDimMean = {};
   for (const [dim, values] of Object.entries(dimAccum)) perDimMean[dim] = mean3(values);
-  let costUsd = cell.costUsd;
-  let costEstimated = false;
-  if (costUsd === 0 && cell.tokenUsage.output > 0 && isModelPriced(model)) {
-    costUsd = estimateCost(cell.tokenUsage.input, cell.tokenUsage.output, model);
-    costEstimated = costUsd > 0;
-  }
+  const costUsd = cell.costUsd;
   raw.cost_usd = costUsd;
-  raw.cost_estimated = costEstimated ? 1 : 0;
+  raw.cost_estimated = cell.costEstimated ? 1 : 0;
   raw.tokens_input = cell.tokenUsage.input;
   raw.tokens_output = cell.tokenUsage.output;
   if (typeof cell.tokenUsage.cached === "number") raw.tokens_cached = cell.tokenUsage.cached;
@@ -4958,11 +4671,8 @@ async function runProfileMatrix(opts) {
       profileRecords.push(record);
       records.push(record);
     }
-    const pricedTotalCostUsd = profileRecords.reduce((a, r) => a + r.costUsd, 0);
-    campaigns[profileId] = {
-      ...campaign,
-      aggregates: { ...campaign.aggregates, totalCostUsd: pricedTotalCostUsd }
-    };
+    const totalCostUsd = campaign.aggregates.totalCostUsd;
+    campaigns[profileId] = campaign;
     byProfile[profileId] = {
       profileId,
       profileHash,
@@ -4972,7 +4682,7 @@ async function runProfileMatrix(opts) {
       model: declaredModel === HARNESS_NATIVE_MODEL ? profileRecords[0]?.model ?? declaredModel : declaredModel,
       records: profileRecords.length,
       meanComposite: mean3(profileRecords.map(compositeOf)),
-      totalCostUsd: pricedTotalCostUsd,
+      totalCostUsd,
       integrity: summarizeBackendIntegrity(profileRecords)
     };
   }
@@ -5189,36 +4899,78 @@ function surfaceToPromptText(surface) {
   return typeof surface === "string" ? surface : JSON.stringify(surface);
 }
 function analysisEditProposer(opts) {
+  const directCostLedger = opts.costLedger ?? new CostLedger();
   return {
     kind: opts.kind,
     async propose(ctx) {
       const parent = surfaceToPromptText(ctx.currentSurface);
+      const costLedger = ctx.costLedger ?? directCostLedger;
+      const phase = ctx.costPhase ?? "search.proposal";
       const traces = await opts.resolveTraces(ctx) ?? "";
       if (!traces.trim()) throw new Error(opts.noTracesError);
       const dir = mkdtempSync(join4(tmpdir(), `${opts.kind}-proposer-`));
       const tracePath = join4(dir, "traces.jsonl");
       writeFileSync2(tracePath, traces.endsWith("\n") ? traces : `${traces}
 `);
-      const report = await opts.analyze(tracePath, ctx);
-      const applied = await callLlm(
-        {
-          model: opts.applyModel,
-          messages: [
-            { role: "system", content: APPLY_SYSTEM },
-            {
-              role: "user",
-              content: `CURRENT PROMPT:
+      if (costLedger.costCeilingUsd !== void 0 && !opts.analysisReceipt) {
+        throw new CostAccountingIncompleteError(
+          `${opts.kind}: capped analysis requires analysisReceipt before external execution`
+        );
+      }
+      const analysis = await costLedger.runPaidCall({
+        channel: "analyst",
+        phase,
+        actor: `${opts.kind}.analyze`,
+        model: opts.analysisModel,
+        maximumCharge: opts.analysisMaximumCharge,
+        tags: { generation: String(ctx.generation) },
+        signal: ctx.signal,
+        execute: (signal) => opts.analyze(tracePath, { ...ctx, signal }),
+        receipt: (report2) => opts.analysisReceipt?.(report2) ?? {
+          model: opts.analysisModel,
+          inputTokens: 0,
+          outputTokens: 0,
+          costUnknown: true
+        }
+      });
+      if (!analysis.succeeded) throw analysis.error;
+      const report = analysis.value;
+      const request = {
+        model: opts.applyModel,
+        messages: [
+          { role: "system", content: APPLY_SYSTEM },
+          {
+            role: "user",
+            content: `CURRENT PROMPT:
 ${parent}
 
 TRACE-ANALYSIS REPORT:
 ${report}
 
 Return the full revised prompt.`
-            }
-          ]
-        },
-        { baseUrl: opts.baseUrl, apiKey: opts.apiKey, fetch: opts.fetchImpl }
-      );
+          }
+        ],
+        maxTokens: opts.applyMaxTokens ?? 6e3
+      };
+      const llm = {
+        baseUrl: opts.baseUrl,
+        apiKey: opts.apiKey,
+        fetch: opts.fetchImpl
+      };
+      const apply = await costLedger.runPaidCall({
+        channel: "driver",
+        phase,
+        actor: `${opts.kind}.apply`,
+        model: opts.applyModel,
+        maximumCharge: maximumChargeForLlmRequest(request, llm),
+        tags: { generation: String(ctx.generation) },
+        signal: ctx.signal,
+        execute: (signal, callId) => callLlm(request, { ...llm, signal, idempotencyKey: callId }),
+        receipt: costReceiptFromLlm,
+        receiptFromError: costReceiptFromLlmError
+      });
+      if (!apply.succeeded) throw apply.error;
+      const applied = apply.value;
       const text = applied.content.trim();
       if (!text || text === parent) return [];
       return [{ surface: text, label: opts.label, rationale: opts.rationale(report) }];
@@ -5237,7 +4989,12 @@ function haloProposer(opts) {
     label: "halo",
     baseUrl: opts.baseUrl,
     apiKey: opts.apiKey,
+    analysisModel: model,
     applyModel: opts.applyModel ?? model,
+    costLedger: opts.costLedger,
+    analysisMaximumCharge: opts.analysisMaximumCharge,
+    analysisReceipt: opts.analysisReceipt,
+    applyMaxTokens: opts.applyMaxTokens,
     fetchImpl: opts.fetchImpl,
     resolveTraces: opts.resolveTraces,
     noTracesError: "haloProposer: resolveTraces returned no OTLP traces \u2014 the halo engine has nothing to analyze",
@@ -5669,6 +5426,7 @@ function llmPolicyEditProposer(opts) {
     opts.maxAuthorContextChars ?? DEFAULT_POLICY_EDIT_HISTORY_LIMITS.authorContextChars,
     "maxAuthorContextChars"
   );
+  const directCostLedger = opts.costLedger ?? new CostLedger();
   return {
     kind: "llm-policy-edit",
     async propose(ctx) {
@@ -5731,26 +5489,34 @@ function llmPolicyEditProposer(opts) {
         maxAuthorContextChars
       );
       const userContent = JSON.stringify(authorContext);
-      const { value } = await callLlmJson(
-        {
-          model: opts.model,
-          messages: [
-            { role: "system", content: POLICY_EDIT_AUTHOR_SYSTEM },
-            {
-              role: "user",
-              content: userContent
-            }
-          ],
-          jsonSchema: {
-            name: "policy_edit_author",
-            schema: responseSchema
-          },
-          temperature: opts.temperature ?? 0.2,
-          maxTokens: opts.maxTokens ?? 6e3,
-          timeoutMs: opts.timeoutMs
+      const request = {
+        model: opts.model,
+        messages: [
+          { role: "system", content: POLICY_EDIT_AUTHOR_SYSTEM },
+          { role: "user", content: userContent }
+        ],
+        jsonSchema: {
+          name: "policy_edit_author",
+          schema: responseSchema
         },
-        { ...opts.llm, signal: ctx.signal }
-      );
+        temperature: opts.temperature ?? 0.2,
+        maxTokens: opts.maxTokens ?? 6e3,
+        timeoutMs: opts.timeoutMs
+      };
+      const paid = await (ctx.costLedger ?? directCostLedger).runPaidCall({
+        channel: "driver",
+        phase: ctx.costPhase ?? "search.proposal",
+        actor: "llm-policy-edit.author",
+        model: opts.model,
+        maximumCharge: maximumChargeForLlmRequest(request, opts.llm),
+        tags: { generation: String(ctx.generation) },
+        signal: ctx.signal,
+        execute: (signal, callId) => callLlmJson(request, { ...opts.llm, signal, idempotencyKey: callId }),
+        receipt: ({ result }) => costReceiptFromLlm(result),
+        receiptFromError: costReceiptFromLlmError
+      });
+      if (!paid.succeeded) throw paid.error;
+      const { value } = paid.value;
       const response = parseAuthorResponse(value);
       if (response.edits.length > limit) {
         throw new Error(
@@ -6432,18 +6198,35 @@ var DISTILL_SYSTEM = 'You compress raw trace-analysis findings into crisp, gener
 function extractExistingLessons(text) {
   return extractBlockBody(text, BLOCK_START2, BLOCK_END2).split("\n").map((l) => l.replace(/^\s*-\s+/, "").trim()).filter((l) => l && !l.startsWith("#"));
 }
-async function distillLessons(raw, distill) {
-  const res = await callLlm(
-    {
-      model: distill.model,
-      messages: [
-        { role: "system", content: DISTILL_SYSTEM },
-        { role: "user", content: `Findings:
+async function distillLessons(raw, distill, ctx, costLedger) {
+  const request = {
+    model: distill.model,
+    messages: [
+      { role: "system", content: DISTILL_SYSTEM },
+      { role: "user", content: `Findings:
 ${raw.map((r) => `- ${r}`).join("\n")}` }
-      ]
-    },
-    { baseUrl: distill.baseUrl, apiKey: distill.apiKey, fetch: distill.fetchImpl }
-  );
+    ],
+    maxTokens: distill.maxTokens ?? 2e3
+  };
+  const llm = {
+    baseUrl: distill.baseUrl,
+    apiKey: distill.apiKey,
+    fetch: distill.fetchImpl
+  };
+  const paid = await costLedger.runPaidCall({
+    channel: "driver",
+    phase: ctx.costPhase ?? "search.proposal",
+    actor: "memory-curation.distill",
+    model: distill.model,
+    maximumCharge: maximumChargeForLlmRequest(request, llm),
+    tags: { generation: String(ctx.generation) },
+    signal: ctx.signal,
+    execute: (signal, callId) => callLlm(request, { ...llm, signal, idempotencyKey: callId }),
+    receipt: costReceiptFromLlm,
+    receiptFromError: costReceiptFromLlmError
+  });
+  if (!paid.succeeded) throw paid.error;
+  const res = paid.value;
   try {
     const parsed = JSON.parse(res.content.trim());
     if (Array.isArray(parsed)) {
@@ -6459,6 +6242,7 @@ ${raw.map((r) => `- ${r}`).join("\n")}` }
 function memoryCurationProposer(opts = {}) {
   const maxEntries = opts.maxEntries ?? 12;
   const heading = opts.sectionHeading ?? DEFAULT_HEADING2;
+  const directCostLedger = opts.costLedger ?? new CostLedger();
   return {
     kind: "memory-curation",
     async propose(ctx) {
@@ -6470,7 +6254,7 @@ function memoryCurationProposer(opts = {}) {
       }
       const carried = extractExistingLessons(parent);
       if (fresh.length === 0 && carried.length === 0) return [];
-      const distilled = opts.distill && fresh.length > 0 ? await distillLessons(fresh, opts.distill) : fresh;
+      const distilled = opts.distill && fresh.length > 0 ? await distillLessons(fresh, opts.distill, ctx, ctx.costLedger ?? directCostLedger) : fresh;
       const byKey = /* @__PURE__ */ new Map();
       for (const l of carried) {
         const k = normKey(l);
@@ -6541,7 +6325,12 @@ function traceAnalystProposer(opts) {
     label: "trace-analyst",
     baseUrl: opts.baseUrl,
     apiKey: opts.apiKey,
+    analysisModel: opts.model,
     applyModel: opts.applyModel ?? opts.model,
+    costLedger: opts.costLedger,
+    analysisMaximumCharge: opts.analysisMaximumCharge,
+    analysisReceipt: opts.analysisReceipt,
+    applyMaxTokens: opts.applyMaxTokens,
     fetchImpl: opts.fetchImpl,
     resolveTraces: opts.resolveTraces,
     noTracesError: "traceAnalystProposer: resolveTraces returned no OTLP traces \u2014 the analyst has nothing to read",
@@ -6613,238 +6402,86 @@ function selectDiscriminative(signals, k, opts) {
 
 // src/campaign/search-ledger.ts
 import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { resolve as resolve2 } from "path";
-import { z as z3 } from "zod";
-
-// src/campaign/search-ledger-errors.ts
-var SearchLedgerError = class extends ValidationError {
-};
-var SearchLedgerIntegrityError = class extends SearchLedgerError {
-};
-var SearchLedgerConflictError = class extends SearchLedgerError {
-};
-
-// src/campaign/search-ledger-file.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import {
-  closeSync,
-  constants,
-  existsSync as existsSync3,
-  fsyncSync,
-  linkSync,
-  mkdirSync as mkdirSync2,
-  openSync,
-  readFileSync as readFileSync3,
-  renameSync,
-  unlinkSync,
-  writeSync
-} from "fs";
-import { hostname } from "os";
-import { dirname as dirname2 } from "path";
 import { z as z2 } from "zod";
-function appendSearchLedgerLine(path, line) {
-  mkdirSync2(dirname2(path), { recursive: true });
-  const fd = openSync(path, constants.O_CREAT | constants.O_WRONLY | constants.O_APPEND, 384);
-  try {
-    writeAll(fd, Buffer.from(line, "utf8"));
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  fsyncDirectory(dirname2(path));
-}
-function withSearchLedgerFileLock(ledgerPath, run) {
-  mkdirSync2(dirname2(ledgerPath), { recursive: true });
-  const lockPath = `${ledgerPath}.lock`;
-  const owner = acquireLock(lockPath);
-  try {
-    return run();
-  } finally {
-    releaseLock(lockPath, owner);
-  }
-}
-function writeAll(fd, bytes) {
-  let offset = 0;
-  while (offset < bytes.byteLength) {
-    const written = writeSync(fd, bytes, offset, bytes.byteLength - offset);
-    if (written <= 0) throw new SearchLedgerIntegrityError("filesystem wrote zero bytes");
-    offset += written;
-  }
-}
-function fsyncDirectory(path) {
-  const fd = openSync(path, constants.O_RDONLY);
-  try {
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-}
-function acquireLock(lockPath) {
-  const owner = { pid: process.pid, host: hostname(), nonce: randomUUID2() };
-  const ownerBytes = `${canonicalOwner(owner)}
-`;
-  for (let attempt = 0; attempt < 8; attempt += 1) {
-    const ownerPath = `${lockPath}.${owner.pid}.${owner.nonce}.${attempt}.owner`;
-    const fd = openSync(ownerPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
-    try {
-      writeAll(fd, Buffer.from(ownerBytes, "utf8"));
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
-    try {
-      linkSync(ownerPath, lockPath);
-      unlinkSync(ownerPath);
-      return owner;
-    } catch (error) {
-      unlinkIfExists(ownerPath);
-      if (error.code !== "EEXIST") throw error;
-    }
-    const holder = readOwner(lockPath);
-    if (holder.host !== owner.host || isProcessAlive(holder.pid)) {
-      throw new SearchLedgerIntegrityError(
-        `search ledger lock is held by pid ${holder.pid} on ${holder.host}`
-      );
-    }
-    const tombstone = `${lockPath}.stale.${owner.nonce}.${attempt}`;
-    try {
-      renameSync(lockPath, tombstone);
-      unlinkSync(tombstone);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-  }
-  throw new SearchLedgerIntegrityError(`could not acquire search ledger lock ${lockPath}`);
-}
-function releaseLock(lockPath, owner) {
-  if (!existsSync3(lockPath)) return;
-  const holder = readOwner(lockPath);
-  if (canonicalOwner(holder) !== canonicalOwner(owner)) {
-    throw new SearchLedgerIntegrityError(
-      `search ledger lock owner changed before release (${lockPath})`
-    );
-  }
-  unlinkSync(lockPath);
-}
-function readOwner(lockPath) {
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync3(lockPath, "utf8"));
-  } catch (error) {
-    throw new SearchLedgerIntegrityError(`search ledger lock ${lockPath} is malformed`, {
-      cause: error
-    });
-  }
-  const parsed = z2.object({
-    pid: z2.number().int().positive().safe(),
-    host: z2.string().trim().min(1),
-    nonce: z2.string().trim().min(1)
-  }).strict().safeParse(raw);
-  if (!parsed.success) {
-    throw new SearchLedgerIntegrityError(
-      `search ledger lock ${lockPath} is malformed: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`
-    );
-  }
-  return parsed.data;
-}
-function canonicalOwner(owner) {
-  return JSON.stringify({ host: owner.host, nonce: owner.nonce, pid: owner.pid });
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code !== "ESRCH";
-  }
-}
-function unlinkIfExists(path) {
-  try {
-    unlinkSync(path);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-}
-
-// src/campaign/search-ledger.ts
 var SEARCH_LEDGER_SCHEMA = "tangle.search-ledger.v1";
-var NON_EMPTY = z3.string().min(1).refine((value) => value.trim() === value, "must not contain surrounding whitespace");
-var HASH = z3.string().regex(/^sha256:[a-f0-9]{64}$/);
-var LINEAGE_NODE_ID = z3.string().regex(/^[a-f0-9]{16}$/);
-var IMMUTABLE_REVISION = z3.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|sha256:[a-f0-9]{64}|sha512:[A-Za-z0-9+/=]+)$/);
-var ISO_TIMESTAMP = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/).refine((value) => Number.isFinite(Date.parse(value)), "invalid timestamp");
-var NON_NEGATIVE_INT = z3.number().int().nonnegative().safe();
-var FINITE_NUMBER = z3.number().finite();
-var ArtifactRefSchema = z3.object({
+var NON_EMPTY = z2.string().min(1).refine((value) => value.trim() === value, "must not contain surrounding whitespace");
+var HASH = z2.string().regex(/^sha256:[a-f0-9]{64}$/);
+var LINEAGE_NODE_ID = z2.string().regex(/^[a-f0-9]{16}$/);
+var IMMUTABLE_REVISION = z2.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|sha256:[a-f0-9]{64}|sha512:[A-Za-z0-9+/=]+)$/);
+var ISO_TIMESTAMP = z2.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/).refine((value) => Number.isFinite(Date.parse(value)), "invalid timestamp");
+var NON_NEGATIVE_INT = z2.number().int().nonnegative().safe();
+var FINITE_NUMBER = z2.number().finite();
+var ArtifactRefSchema = z2.object({
   role: NON_EMPTY,
   uri: NON_EMPTY,
   sha256: HASH,
   byteLength: NON_NEGATIVE_INT
 }).strict();
-var SourceRefSchema = z3.object({
+var SourceRefSchema = z2.object({
   uri: NON_EMPTY,
   revision: IMMUTABLE_REVISION
 }).strict();
-var FailureReasonSchema = z3.object({
+var FailureReasonSchema = z2.object({
   code: NON_EMPTY,
   message: NON_EMPTY
 }).strict();
 var EventBaseShape = {
   eventId: NON_EMPTY,
   occurredAt: ISO_TIMESTAMP,
-  artifacts: z3.array(ArtifactRefSchema).min(1)
+  artifacts: z2.array(ArtifactRefSchema).min(1)
 };
-var OperationKindSchema = z3.enum([
+var OperationKindSchema = z2.enum([
   "candidate-generation",
   "analysis",
   "selection",
   "judge",
   "other"
 ]);
-var SearchPlannedSchema = z3.object({
+var SearchPlannedSchema = z2.object({
   ...EventBaseShape,
-  kind: z3.literal("search-planned"),
-  plan: z3.object({
-    candidateSlots: z3.array(
-      z3.object({
+  kind: z2.literal("search-planned"),
+  plan: z2.object({
+    candidateSlots: z2.array(
+      z2.object({
         slotId: NON_EMPTY,
         generationOperationId: NON_EMPTY
       }).strict()
     ).min(1),
-    tasks: z3.array(
-      z3.object({
+    tasks: z2.array(
+      z2.object({
         taskId: NON_EMPTY,
         source: SourceRefSchema,
         benchmark: SourceRefSchema,
-        maxAttempts: z3.number().int().positive().safe()
+        maxAttempts: z2.number().int().positive().safe()
       }).strict()
     ).min(1),
-    operations: z3.array(
-      z3.object({
+    operations: z2.array(
+      z2.object({
         operationId: NON_EMPTY,
         kind: OperationKindSchema
       }).strict()
     ).min(1)
   }).strict()
 }).strict();
-var CandidateRegisteredSchema = z3.object({
+var CandidateRegisteredSchema = z2.object({
   ...EventBaseShape,
-  kind: z3.literal("candidate-registered"),
+  kind: z2.literal("candidate-registered"),
   slotId: NON_EMPTY,
   generationOperationId: NON_EMPTY,
   candidateId: NON_EMPTY,
-  lineage: z3.object({
+  lineage: z2.object({
     lineageNodeId: LINEAGE_NODE_ID,
-    parentCandidateIds: z3.array(NON_EMPTY),
+    parentCandidateIds: z2.array(NON_EMPTY),
     generation: NON_NEGATIVE_INT,
     proposer: NON_EMPTY,
     proposerSource: SourceRefSchema
   }).strict(),
-  surfaces: z3.array(
-    z3.object({
+  surfaces: z2.array(
+    z2.object({
       surfaceId: NON_EMPTY,
-      kind: z3.enum([
+      kind: z2.enum([
         "prompt",
         "tool-contract",
         "runtime-config",
@@ -6858,69 +6495,69 @@ var CandidateRegisteredSchema = z3.object({
     }).strict()
   ).min(1)
 }).strict();
-var CandidateSlotClosedSchema = z3.object({
+var CandidateSlotClosedSchema = z2.object({
   ...EventBaseShape,
-  kind: z3.literal("candidate-slot-closed"),
+  kind: z2.literal("candidate-slot-closed"),
   slotId: NON_EMPTY,
   generationOperationId: NON_EMPTY,
   reason: FailureReasonSchema
 }).strict();
-var KnownTokensSchema = z3.object({
-  status: z3.literal("known"),
+var KnownTokensSchema = z2.object({
+  status: z2.literal("known"),
   inputTokens: NON_NEGATIVE_INT,
   outputTokens: NON_NEGATIVE_INT,
   cachedTokens: NON_NEGATIVE_INT
 }).strict();
-var UnknownSchema = z3.object({
-  status: z3.literal("unknown"),
+var UnknownSchema = z2.object({
+  status: z2.literal("unknown"),
   reason: NON_EMPTY
 }).strict();
-var KnownCostSchema = z3.object({
-  status: z3.literal("known"),
-  usd: z3.number().finite().nonnegative(),
-  source: z3.enum(["provider", "pricing-table", "free"])
+var KnownCostSchema = z2.object({
+  status: z2.literal("known"),
+  usd: z2.number().finite().nonnegative(),
+  source: z2.enum(["provider", "pricing-table", "free"])
 }).strict().superRefine((cost, ctx) => {
   if (cost.source === "free" && cost.usd !== 0) {
     ctx.addIssue({ code: "custom", message: "free cost source must have usd 0" });
   }
 });
-var UnknownCostSchema = z3.object({
-  status: z3.literal("unknown"),
-  knownLowerBoundUsd: z3.number().finite().nonnegative(),
+var UnknownCostSchema = z2.object({
+  status: z2.literal("unknown"),
+  knownLowerBoundUsd: z2.number().finite().nonnegative(),
   reason: NON_EMPTY
 }).strict();
-var AccountingSchema = z3.object({
-  tokens: z3.discriminatedUnion("status", [KnownTokensSchema, UnknownSchema]),
-  cost: z3.discriminatedUnion("status", [KnownCostSchema, UnknownCostSchema])
+var AccountingSchema = z2.object({
+  tokens: z2.discriminatedUnion("status", [KnownTokensSchema, UnknownSchema]),
+  cost: z2.discriminatedUnion("status", [KnownCostSchema, UnknownCostSchema])
 }).strict();
-var MetricsSchema = z3.record(NON_EMPTY, FINITE_NUMBER).superRefine((metrics, ctx) => {
+var MetricsSchema = z2.record(NON_EMPTY, FINITE_NUMBER).superRefine((metrics, ctx) => {
   for (const key of Object.keys(metrics)) {
     if (key === "__proto__" || key === "constructor" || key === "prototype") {
       ctx.addIssue({ code: "custom", message: `unsafe metric key ${key}` });
     }
   }
 });
-var OutcomeSchema = z3.discriminatedUnion("status", [
-  z3.object({
-    status: z3.literal("passed"),
+var OutcomeSchema = z2.discriminatedUnion("status", [
+  z2.object({
+    status: z2.literal("passed"),
     score: FINITE_NUMBER,
     metrics: MetricsSchema
   }).strict(),
-  z3.object({
-    status: z3.literal("failed"),
+  z2.object({
+    status: z2.literal("failed"),
     score: FINITE_NUMBER,
     metrics: MetricsSchema,
     failure: FailureReasonSchema
   }).strict(),
-  z3.object({
-    status: z3.literal("errored"),
+  z2.object({
+    status: z2.literal("errored"),
     metrics: MetricsSchema,
-    error: FailureReasonSchema.extend({ retryable: z3.boolean() }).strict()
+    error: FailureReasonSchema.extend({ retryable: z2.boolean() }).strict()
   }).strict()
 ]);
-var EffectSchema = z3.discriminatedUnion("status", [
-  z3.object({
-    status: z3.literal("measured"),
+var EffectSchema = z2.discriminatedUnion("status", [
+  z2.object({
+    status: z2.literal("measured"),
     metric: NON_EMPTY,
     baselineValue: FINITE_NUMBER,
     candidateValue: FINITE_NUMBER,
@@ -6932,17 +6569,17 @@ var EffectSchema = z3.discriminatedUnion("status", [
       ctx.addIssue({ code: "custom", message: "delta must equal candidateValue - baselineValue" });
     }
   }),
-  z3.object({
-    status: z3.literal("not-measured"),
+  z2.object({
+    status: z2.literal("not-measured"),
     reason: NON_EMPTY
   }).strict()
 ]);
-var SurfaceEvidenceSchema = z3.object({
+var SurfaceEvidenceSchema = z2.object({
   surfaceId: NON_EMPTY,
-  fired: z3.boolean(),
+  fired: z2.boolean(),
   firingCount: NON_NEGATIVE_INT,
   effect: EffectSchema,
-  evidence: z3.array(ArtifactRefSchema).min(1)
+  evidence: z2.array(ArtifactRefSchema).min(1)
 }).strict().superRefine((evidence, ctx) => {
   if (evidence.fired && evidence.firingCount === 0) {
     ctx.addIssue({ code: "custom", message: "a fired surface must have firingCount >= 1" });
@@ -6960,15 +6597,15 @@ var SurfaceEvidenceSchema = z3.object({
     });
   }
 });
-var TaskAttemptedSchema = z3.object({
+var TaskAttemptedSchema = z2.object({
   ...EventBaseShape,
-  kind: z3.literal("task-attempted"),
+  kind: z2.literal("task-attempted"),
   candidateId: NON_EMPTY,
   runId: NON_EMPTY,
   attemptIndex: NON_NEGATIVE_INT,
-  task: z3.object({ taskId: NON_EMPTY, source: SourceRefSchema }).strict(),
-  identity: z3.object({
-    model: z3.object({
+  task: z2.object({ taskId: NON_EMPTY, source: SourceRefSchema }).strict(),
+  identity: z2.object({
+    model: z2.object({
       provider: NON_EMPTY,
       snapshot: NON_EMPTY.refine(
         modelHasSnapshot,
@@ -6980,17 +6617,17 @@ var TaskAttemptedSchema = z3.object({
   }).strict(),
   outcome: OutcomeSchema,
   accounting: AccountingSchema,
-  surfaceEvidence: z3.array(SurfaceEvidenceSchema).min(1)
+  surfaceEvidence: z2.array(SurfaceEvidenceSchema).min(1)
 }).strict();
-var SearchOperationRecordedSchema = z3.object({
+var SearchOperationRecordedSchema = z2.object({
   ...EventBaseShape,
-  kind: z3.literal("search-operation-recorded"),
+  kind: z2.literal("search-operation-recorded"),
   operationId: NON_EMPTY,
   operationKind: OperationKindSchema,
-  execution: z3.discriminatedUnion("kind", [
-    z3.object({
-      kind: z3.literal("model"),
-      model: z3.object({
+  execution: z2.discriminatedUnion("kind", [
+    z2.object({
+      kind: z2.literal("model"),
+      model: z2.object({
         provider: NON_EMPTY,
         snapshot: NON_EMPTY.refine(
           modelHasSnapshot,
@@ -6999,51 +6636,51 @@ var SearchOperationRecordedSchema = z3.object({
       }).strict(),
       source: SourceRefSchema
     }).strict(),
-    z3.object({
-      kind: z3.literal("deterministic"),
+    z2.object({
+      kind: z2.literal("deterministic"),
       source: SourceRefSchema
     }).strict()
   ]),
-  outcome: z3.discriminatedUnion("status", [
-    z3.object({ status: z3.literal("completed") }).strict(),
-    z3.object({
-      status: z3.literal("partial"),
+  outcome: z2.discriminatedUnion("status", [
+    z2.object({ status: z2.literal("completed") }).strict(),
+    z2.object({
+      status: z2.literal("partial"),
       failure: FailureReasonSchema
     }).strict(),
-    z3.object({
-      status: z3.literal("failed"),
+    z2.object({
+      status: z2.literal("failed"),
       failure: FailureReasonSchema
     }).strict()
   ]),
   accounting: AccountingSchema
 }).strict();
-var CandidateDecidedSchema = z3.object({
+var CandidateDecidedSchema = z2.object({
   ...EventBaseShape,
-  kind: z3.literal("candidate-decided"),
+  kind: z2.literal("candidate-decided"),
   candidateId: NON_EMPTY,
-  decision: z3.discriminatedUnion("status", [
-    z3.object({ status: z3.literal("selected") }).strict(),
-    z3.object({
-      status: z3.literal("rejected"),
+  decision: z2.discriminatedUnion("status", [
+    z2.object({ status: z2.literal("selected") }).strict(),
+    z2.object({
+      status: z2.literal("rejected"),
       reason: FailureReasonSchema
     }).strict()
   ])
 }).strict();
-var SearchCompletedSchema = z3.object({
+var SearchCompletedSchema = z2.object({
   ...EventBaseShape,
-  kind: z3.literal("search-completed"),
-  result: z3.discriminatedUnion("status", [
-    z3.object({
-      status: z3.literal("selected"),
+  kind: z2.literal("search-completed"),
+  result: z2.discriminatedUnion("status", [
+    z2.object({
+      status: z2.literal("selected"),
       candidateId: NON_EMPTY
     }).strict(),
-    z3.object({
-      status: z3.literal("all-rejected"),
+    z2.object({
+      status: z2.literal("all-rejected"),
       reason: FailureReasonSchema
     }).strict()
   ])
 }).strict();
-var EventSchema = z3.discriminatedUnion("kind", [
+var EventSchema = z2.discriminatedUnion("kind", [
   SearchPlannedSchema,
   CandidateRegisteredSchema,
   CandidateSlotClosedSchema,
@@ -7052,11 +6689,11 @@ var EventSchema = z3.discriminatedUnion("kind", [
   CandidateDecidedSchema,
   SearchCompletedSchema
 ]);
-var EntrySchema = z3.object({
-  schema: z3.literal(SEARCH_LEDGER_SCHEMA),
+var EntrySchema = z2.object({
+  schema: z2.literal(SEARCH_LEDGER_SCHEMA),
   campaignId: NON_EMPTY,
   sequence: NON_NEGATIVE_INT,
-  previousHash: z3.union([HASH, z3.null()]),
+  previousHash: z2.union([HASH, z2.null()]),
   event: EventSchema,
   entryHash: HASH
 }).strict();
@@ -7133,8 +6770,8 @@ var FileSearchLedger = class {
   }
 };
 function replayFile(path, campaignId) {
-  if (!existsSync4(path)) return replayEntries([], campaignId);
-  const text = readFileSync4(path, "utf8");
+  if (!existsSync3(path)) return replayEntries([], campaignId);
+  const text = readFileSync3(path, "utf8");
   if (text.length === 0) return replayEntries([], campaignId);
   if (!text.endsWith("\n")) {
     throw new SearchLedgerIntegrityError(
@@ -7730,10 +7367,10 @@ function formatZodError(error) {
 }
 
 // src/campaign/single-run-lock.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
 function liveHolder(path) {
-  if (!existsSync5(path)) return null;
-  const holder = Number(readFileSync5(path, "utf8").trim());
+  if (!existsSync4(path)) return null;
+  const holder = Number(readFileSync4(path, "utf8").trim());
   if (!Number.isFinite(holder) || holder <= 0) return null;
   try {
     process.kill(holder, 0);
@@ -7755,8 +7392,8 @@ function acquireSingleRunLock(opts) {
   writeFileSync3(opts.lockPath, String(pid));
   const release = () => {
     try {
-      if (existsSync5(opts.lockPath) && readFileSync5(opts.lockPath, "utf8").trim() === String(pid)) {
-        unlinkSync2(opts.lockPath);
+      if (existsSync4(opts.lockPath) && readFileSync4(opts.lockPath, "utf8").trim() === String(pid)) {
+        unlinkSync(opts.lockPath);
       }
     } catch {
     }
@@ -7780,21 +7417,21 @@ function isTransientTransportFailure(message, opts = {}) {
 import { execFileSync } from "child_process";
 import { createHash as createHash8 } from "crypto";
 import {
-  closeSync as closeSync2,
-  existsSync as existsSync6,
+  closeSync,
+  existsSync as existsSync5,
   constants as fsConstants,
   fstatSync,
   lstatSync,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync2,
   mkdtempSync as mkdtempSync2,
-  openSync as openSync2,
+  openSync,
   readlinkSync,
   readSync,
   realpathSync,
   rmSync
 } from "fs";
 import { devNull, tmpdir as tmpdir2 } from "os";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3, sep } from "path";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3, sep } from "path";
 var MAX_GIT_OUTPUT_BYTES = 256 * 1024 * 1024;
 var FILE_HASH_CHUNK_BYTES = 1024 * 1024;
 var GIT_REPOSITORY_ENV = /* @__PURE__ */ new Set([
@@ -7846,6 +7483,45 @@ function gitBytes(git, args, cwd, env) {
 function gitText(git, args, cwd, env) {
   return gitBytes(git, args, cwd, env).toString("utf8").trim();
 }
+function hasRegisteredWorktree(git, repoRoot, path) {
+  const expected = Buffer.from(`worktree ${resolve3(path)}`, "utf8");
+  const records = gitBytes(git, ["worktree", "list", "--porcelain", "-z"], repoRoot);
+  let start = 0;
+  while (start < records.length) {
+    const end = records.indexOf(0, start);
+    if (end < 0) {
+      throw new WorktreeAdapterError("Git worktree list output was not NUL-terminated");
+    }
+    if (records.subarray(start, end).equals(expected)) return true;
+    start = end + 1;
+  }
+  return false;
+}
+function hasLocalBranch(git, repoRoot, branch) {
+  const ref = `refs/heads/${branch}`;
+  return gitText(git, ["for-each-ref", "--format=%(refname)", "--", ref], repoRoot).split("\n").some((candidate) => candidate === ref);
+}
+function reconcileAbsent(exists, remove) {
+  try {
+    if (!exists()) return void 0;
+  } catch (err) {
+    return err;
+  }
+  try {
+    remove();
+    return void 0;
+  } catch (removeError) {
+    try {
+      if (!exists()) return void 0;
+    } catch (recheckError) {
+      return new AggregateError(
+        [removeError, recheckError],
+        "Removal failed and the resulting resource state could not be checked"
+      );
+    }
+    return removeError;
+  }
+}
 function sha2562(bytes) {
   return `sha256:${createHash8("sha256").update(bytes).digest("hex")}`;
 }
@@ -7887,7 +7563,7 @@ function patchBytes(git, cwd, baseCommit, candidateCommit) {
   const scratch = mkdtempSync2(join5(tmpdir2(), "agent-eval-patch-"));
   const bareRepo = join5(scratch, "repo.git");
   const emptyTemplate = join5(scratch, "empty-template");
-  mkdirSync3(emptyTemplate);
+  mkdirSync2(emptyTemplate);
   try {
     const objectFormat = gitObjectHashAlgorithm(candidateCommit);
     const sourceObjects = realpathSync(gitText(git, ["rev-parse", "--git-path", "objects"], cwd));
@@ -8025,7 +7701,7 @@ function hashGitBlobFile(path, objectId) {
     throw new WorktreeAdapterError(`CodeSurface expected a regular file at ${displayGitPath(path)}`);
   }
   const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
-  const fd = openSync2(path, fsConstants.O_RDONLY | noFollow);
+  const fd = openSync(path, fsConstants.O_RDONLY | noFollow);
   try {
     const opened = fstatSync(fd);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size) {
@@ -8050,7 +7726,7 @@ function hashGitBlobFile(path, objectId) {
     }
     return { hash: hash.digest("hex"), executable: (opened.mode & 73) !== 0 };
   } finally {
-    closeSync2(fd);
+    closeSync(fd);
   }
 }
 function assertSymlinkTargetIsBound(root, linkPath, trackedPaths) {
@@ -8066,7 +7742,7 @@ function assertSymlinkTargetIsBound(root, linkPath, trackedPaths) {
       `CodeSurface symbolic link escapes its worktree at ${displayGitPath(linkPath)}`
     );
   }
-  const lexicalTarget = resolve3(dirname3(linkPath), target);
+  const lexicalTarget = resolve3(dirname2(linkPath), target);
   if (!isWithinRoot(root, lexicalTarget)) {
     throw new WorktreeAdapterError(
       `CodeSurface symbolic link escapes its worktree at ${displayGitPath(linkPath)}`
@@ -8143,7 +7819,7 @@ function assertRawTreeMatchesWorktree(git, root, candidateCommit) {
 }
 function verifyCodeSurfaceWithGit(surface, path, git) {
   assertCodeSurfaceIdentity(surface);
-  if (!existsSync6(path)) {
+  if (!existsSync5(path)) {
     throw new WorktreeAdapterError(`CodeSurface worktree does not exist: ${path}`);
   }
   const lexicalRoot = resolve3(path);
@@ -8310,8 +7986,23 @@ function gitWorktreeAdapter(opts) {
       return surface;
     },
     async discard(worktree) {
-      gitText(git, ["worktree", "remove", "--force", worktree.path], opts.repoRoot);
-      gitText(git, ["branch", "-D", worktree.branch], opts.repoRoot);
+      const failures = [
+        reconcileAbsent(
+          () => hasRegisteredWorktree(git, opts.repoRoot, worktree.path),
+          () => gitText(git, ["worktree", "remove", "--force", "--", worktree.path], opts.repoRoot)
+        ),
+        reconcileAbsent(
+          () => hasLocalBranch(git, opts.repoRoot, worktree.branch),
+          () => gitText(git, ["branch", "-D", "--", worktree.branch], opts.repoRoot)
+        )
+      ].filter((failure) => failure !== void 0);
+      if (failures.length > 0) {
+        const cause = failures.length === 1 ? failures[0] : new AggregateError(failures, "Multiple Git resources could not be removed");
+        throw new WorktreeAdapterError(
+          `Failed to discard worktree ${worktree.path} and branch ${worktree.branch}`,
+          cause
+        );
+      }
     }
   };
 }
@@ -8324,13 +8015,6 @@ function resolveWorktreePath(surface, worktreeDir) {
 }
 
 export {
-  JudgeParseError,
-  createDomainExpertJudge,
-  codeExecutionJudge,
-  coherenceJudge,
-  adversarialJudge,
-  createCustomJudge,
-  defaultJudges,
   pairArms,
   comparePairedArms,
   completionVerdict,
@@ -8338,7 +8022,6 @@ export {
   parseCorrectnessResponse,
   createLlmCorrectnessChecker,
   createTokenRecallChecker,
-  llmJudge,
   extractProducedState,
   CODING_HARNESSES,
   HARNESS_NATIVE_MODEL,
@@ -8404,9 +8087,6 @@ export {
   traceAnalystProposer,
   scoreDiscrimination,
   selectDiscriminative,
-  SearchLedgerError,
-  SearchLedgerIntegrityError,
-  SearchLedgerConflictError,
   SEARCH_LEDGER_SCHEMA,
   validateSearchLedgerEvent,
   openSearchLedger,
@@ -8418,4 +8098,4 @@ export {
   verifyCodeSurface,
   resolveWorktreePath
 };
-//# sourceMappingURL=chunk-GSW3OBHK.js.map
+//# sourceMappingURL=chunk-JSJZ4PJ6.js.map