@tangle-network/agent-eval 0.129.0 → 0.130.1

package/dist/campaign-aKJt6emI.js

@@ -0,0 +1,3886 @@
+import { s as ValidationError, t as AgentEvalError } from "./errors-8YnH8WlF.js";
+import { t as canonicalize } from "./pre-registration-DakwTRXk.js";
+import { m as buildAgentProfileCell, o as runTaskScore, r as modelHasSnapshot, s as validateRunRecord } from "./run-record-BuoE80Dq.js";
+import { i as CostLedger } from "./cost-ledger-DIgQUFZZ.js";
+import { f as maximumChargeForLlmRequest, l as costReceiptFromLlm, u as costReceiptFromLlmError } from "./llm-client--GR4JbZE.js";
+import { $ as SEARCH_LEDGER_FILE_CONTEXT, B as surfaceContentHash, Bt as JudgeParseError, E as pairHoldout, Et as contentHash, F as assertCodeSurfaceIdentity, J as planCampaignRun, Lt as assertRealBackend, Pt as recoverTruncatedJson, Y as runCampaign, et as SearchLedgerConflictError, h as labelTrustRank, nt as SearchLedgerIntegrityError, tt as SearchLedgerError, zt as summarizeBackendIntegrity } from "./skillopt-optimization-method-CUmHkGbI.js";
+import { c as eProcess, g as mulberry32, v as pairedBootstrap } from "./statistics-CnnxdpOg.js";
+import { t as comparePairedArms } from "./paired-arms-D9D0wXj2.js";
+import { t as analyzeTraces } from "./analyst-LsnNpSkm.js";
+import { c as campaignCellToRunRecord } from "./reward-hacking-qipEpKvY.js";
+import { n as canonicalString, t as FileLedgerJournal } from "./ledger-core-DtZz1RG0.js";
+import { z } from "zod";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { devNull, tmpdir } from "node:os";
+import { execFileSync } from "node:child_process";
+import { harnessSupportsModel } from "@tangle-network/agent-interface";
+//#region src/completion-verifier.ts
+/**
+* Completion verifier — the task-completion oracle.
+*
+* Answers the only eval question that is not a proxy: did the agent actually
+* COMPLETE the task — produce every required deliverable, persisted and
+* correct — rather than describe what should be done. A fluent transcript
+* that never produces the artifact scores zero here.
+*
+* Per requirement, a two-stage check:
+*   1. Structural — a produced item (vault artifact / approved proposal /
+*      tool call) of the right kind is matched against the requirement and
+*      carries non-empty content. Deterministic; no LLM.
+*   2. Correctness — only if structurally present AND the matched item
+*      carries content, one targeted check decides whether that item
+*      actually fulfils the requirement. A hallucinated artifact fails here;
+*      an absent one already failed stage 1.
+*
+* `completionRate` is satisfied / MEASURABLE requirements (unmeasured rows —
+* checker failures — are excluded from the denominator, never scored as
+* zeros). Quality dimensions are meaningless on an incomplete task — callers
+* gate on `fullyComplete` / `completionRate` before scoring quality.
+*/
+/**
+* Construct a `CompletionVerdict` from the per-requirement checks, deriving
+* `completionRate` / `fullyComplete` and the spine fields (`valid` =
+* `fullyComplete`, `score` = `completionRate`) in one place. Throws on zero
+* requirements — a verdict over nothing is a misconfiguration, mirroring
+* `verifyCompletion`'s gold-spec guard.
+*/
+function completionVerdict(input) {
+	if (input.requirements.length === 0) throw new Error(`completionVerdict: task '${input.taskId}' has no requirement checks — nothing to derive a verdict from`);
+	const measurable = input.requirements.filter((r) => !r.unmeasured);
+	const unmeasuredCount = input.requirements.length - measurable.length;
+	if (measurable.length === 0) throw new Error(`completionVerdict: task '${input.taskId}' has no measurable requirements — all ${input.requirements.length} correctness checks failed (${input.requirements[0]?.unmeasuredReason ?? "unknown reason"})`);
+	const satisfiedCount = measurable.filter((r) => r.satisfied).length;
+	const completionRate = satisfiedCount / measurable.length;
+	const fullyComplete = unmeasuredCount === 0 && satisfiedCount === measurable.length;
+	return {
+		taskId: input.taskId,
+		requirements: input.requirements,
+		completionRate,
+		fullyComplete,
+		unmeasuredCount,
+		valid: fullyComplete,
+		score: completionRate
+	};
+}
+const STOPWORDS = /* @__PURE__ */ new Set([
+	"the",
+	"a",
+	"an",
+	"of",
+	"for",
+	"and",
+	"or",
+	"to",
+	"in",
+	"on",
+	"with",
+	"by"
+]);
+const REQUIREMENT_FORM_STOPWORDS = /* @__PURE__ */ new Set([
+	"generated",
+	"generate",
+	"view",
+	"render",
+	"rendered",
+	"persisted",
+	"persist",
+	"artifact",
+	"file",
+	"document",
+	"note",
+	"proposal",
+	"deliverable",
+	"output",
+	"created",
+	"create",
+	"produce",
+	"produced",
+	"flag"
+]);
+const MATCH_THRESHOLD = .5;
+const MIN_CONTENT_CHARS = 50;
+function tokens(s, extraStop) {
+	return new Set(s.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 1 && !STOPWORDS.has(t) && !extraStop?.has(t)));
+}
+/**
+* Recall of the requirement's tokens within a candidate's identifying text.
+* Recall, not Jaccard — a candidate's path/id legitimately carries extra
+* tokens the requirement does not name. The requirement side drops
+* deliverable-FORM vocabulary so recall keys on the distinctive domain tokens.
+*/
+function tokenRecall(requirementText, candidateText) {
+	const req = tokens(requirementText, REQUIREMENT_FORM_STOPWORDS);
+	if (req.size === 0) return 0;
+	const cand = tokens(candidateText);
+	let hit = 0;
+	for (const t of req) if (cand.has(t)) hit++;
+	return hit / req.size;
+}
+function artifactCandidates(req, reqIndex, artifacts) {
+	const reqText = `${req.title} ${req.category ?? ""}`;
+	const out = [];
+	artifacts.forEach((a, i) => {
+		if ((a.content ?? "").trim().length < MIN_CONTENT_CHARS) return;
+		let score = tokenRecall(reqText, `${a.path ?? ""} ${a.kind} ${(a.content ?? "").slice(0, 4e3)}`);
+		if (req.category && a.kind && req.category.toLowerCase() === a.kind.toLowerCase()) score = Math.max(score, 1);
+		if (score < MATCH_THRESHOLD) return;
+		out.push({
+			reqIndex,
+			itemKey: `artifact:${i}`,
+			score,
+			evidence: `artifact '${a.path ?? a.kind}' matched (token recall ${score.toFixed(2)})`,
+			content: a.content ?? null
+		});
+	});
+	return out;
+}
+function proposalCandidates(req, reqIndex, proposals) {
+	const reqText = `${req.title} ${req.category ?? ""}`;
+	const out = [];
+	for (const p of proposals) {
+		if (p.status !== "approved") continue;
+		const body = (p.content ?? "").trim();
+		if (body.length < MIN_CONTENT_CHARS) continue;
+		const score = tokenRecall(reqText, `${p.title} ${body}`);
+		if (score < MATCH_THRESHOLD) continue;
+		out.push({
+			reqIndex,
+			itemKey: `proposal:${p.id}`,
+			score,
+			evidence: `approved proposal '${p.title}' matched (token recall ${score.toFixed(2)})`,
+			content: body
+		});
+	}
+	return out;
+}
+function toolCallCandidates(req, reqIndex, toolCalls) {
+	const out = [];
+	toolCalls.forEach((name, i) => {
+		const score = tokenRecall(req.title, name);
+		if (score < MATCH_THRESHOLD) return;
+		out.push({
+			reqIndex,
+			itemKey: `tool:${i}`,
+			score,
+			evidence: `tool call '${name}' matched (token recall ${score.toFixed(2)})`,
+			content: null
+		});
+	});
+	return out;
+}
+/**
+* Verify whether a run completed the task. `checkCorrectness` is injected —
+* `createLlmCorrectnessChecker` for production, a deterministic stub in tests.
+*
+* Throws on a gold spec with no requirements: an eval task that requires
+* nothing is a misconfiguration, not a vacuously-complete task.
+*/
+async function verifyCompletion(gold, state, checkCorrectness) {
+	if (gold.requirements.length === 0) throw new Error(`verifyCompletion: task '${gold.taskId}' has no requirements — malformed gold spec`);
+	const candidates = [];
+	gold.requirements.forEach((req, i) => {
+		const by = req.satisfiedBy ?? "any";
+		if (by === "artifact" || by === "any") candidates.push(...artifactCandidates(req, i, state.artifacts));
+		if (by === "proposal" || by === "any") candidates.push(...proposalCandidates(req, i, state.proposals));
+		if (by === "tool-call" || by === "any") candidates.push(...toolCallCandidates(req, i, state.toolCalls));
+	});
+	candidates.sort((a, b) => b.score - a.score);
+	const assigned = /* @__PURE__ */ new Map();
+	const itemTaken = /* @__PURE__ */ new Set();
+	for (const c of candidates) {
+		if (assigned.has(c.reqIndex) || itemTaken.has(c.itemKey)) continue;
+		assigned.set(c.reqIndex, c);
+		itemTaken.add(c.itemKey);
+	}
+	const requirements = [];
+	for (let i = 0; i < gold.requirements.length; i++) {
+		const req = gold.requirements[i];
+		const match = assigned.get(i);
+		const evidence = [];
+		let correct = null;
+		let unmeasuredReason;
+		if (match) {
+			evidence.push(match.evidence);
+			if (match.content !== null) try {
+				const r = await checkCorrectness(req, match.content);
+				correct = r.correct;
+				evidence.push(`correctness: ${r.correct ? "pass" : "fail"} — ${r.reason}`);
+			} catch (err) {
+				unmeasuredReason = err instanceof JudgeParseError ? `checker response unparseable after retry: ${err.raw.slice(0, 200)}` : `checker call failed: ${err instanceof Error ? err.message : String(err)}`;
+				evidence.push(`correctness: UNMEASURED — ${unmeasuredReason}`);
+			}
+			else evidence.push("correctness: not assessed — matched item carries no content");
+		} else {
+			const by = req.satisfiedBy ?? "any";
+			const kind = by === "any" ? "artifact/proposal/tool-call" : by;
+			evidence.push(`no produced ${kind} matched this requirement`);
+		}
+		const structurallyPresent = match !== void 0;
+		const unmeasured = unmeasuredReason !== void 0;
+		const satisfied = structurallyPresent && !unmeasured && correct !== false;
+		requirements.push({
+			reqId: req.reqId,
+			title: req.title,
+			structurallyPresent,
+			correct,
+			satisfied,
+			...unmeasured ? {
+				unmeasured: true,
+				unmeasuredReason
+			} : {},
+			evidence
+		});
+	}
+	return completionVerdict({
+		taskId: gold.taskId,
+		requirements
+	});
+}
+/**
+* Parse the correctness checker's model response. Tolerates a response
+* truncated mid-JSON (max_tokens cap) by auto-closing the prefix — the
+* verdict boolean usually lands in the first few tokens, so a recovered
+* prefix with a boolean `correct` is a real measurement, not a guess.
+* Fails loud (JudgeParseError) when no boolean verdict is recoverable.
+*/
+function parseCorrectnessResponse(raw) {
+	const readVerdict = (candidate) => {
+		if (candidate === null || typeof candidate !== "object") return null;
+		const { correct, reason } = candidate;
+		if (typeof correct !== "boolean") return null;
+		return {
+			correct,
+			reason: typeof reason === "string" ? reason : ""
+		};
+	};
+	const match = raw.match(/\{[\s\S]*\}/);
+	if (match) try {
+		const strict = readVerdict(JSON.parse(match[0]));
+		if (strict) return strict;
+	} catch {}
+	const start = raw.indexOf("{");
+	if (start !== -1) {
+		const recovered = readVerdict(recoverTruncatedJson(raw.slice(start)));
+		if (recovered) return recovered;
+	}
+	throw new JudgeParseError("correctness-checker", raw);
+}
+/**
+* Production `CorrectnessChecker` — one LLM call per matched artifact,
+* deterministic (temperature 0), structured JSON out. Judges fulfilment
+* only: a plan, a gesture, or a description of what should be done does not
+* fulfil a requirement — the artifact must BE the deliverable.
+*/
+function createLlmCorrectnessChecker(chat, opts = {}) {
+	const model = opts.model ?? "claude-sonnet-4-6";
+	const maxContentChars = opts.maxContentChars ?? 8e3;
+	const maxAttempts = opts.maxAttempts ?? 2;
+	const costLedger = opts.costLedger ?? new CostLedger();
+	const sink = opts.rawSink;
+	const record = async (event) => {
+		try {
+			await sink?.record(event);
+		} catch {}
+	};
+	return async (requirement, content) => {
+		const request = {
+			model,
+			messages: [{
+				role: "system",
+				content: "You verify whether a produced work artifact actually fulfils a stated requirement. Judge fulfilment only — is the deliverable substantively present and on-point — not polish. A plan to do it later, a vague gesture, or a description of what should be done does NOT fulfil a requirement; the artifact must BE the deliverable. Respond with a single JSON object: {\"correct\": boolean, \"reason\": string (<= 30 words)}."
+			}, {
+				role: "user",
+				content: `Requirement: ${requirement.title}\n${requirement.category ? `Category: ${requirement.category}\n` : ""}\nProduced artifact:\n${content.slice(0, maxContentChars)}`
+			}],
+			temperature: 0,
+			maxTokens: 200
+		};
+		let lastErr;
+		for (let attempt = 0; attempt < maxAttempts; attempt++) {
+			const started = Date.now();
+			await record({
+				eventId: randomUUID(),
+				provider: chat.transport,
+				model,
+				endpoint: "/chat",
+				baseUrl: "",
+				attemptIndex: attempt,
+				direction: "request",
+				timestamp: started,
+				requestBody: request,
+				redactedFields: []
+			});
+			try {
+				const paid = await costLedger.runPaidCall({
+					channel: "verifier",
+					phase: opts.costPhase ?? "completion.correctness",
+					actor: "correctness-checker",
+					model,
+					maximumCharge: chat.maximumAttempts === void 0 ? void 0 : maximumChargeForLlmRequest(request, { maximumAttempts: chat.maximumAttempts }),
+					tags: {
+						...opts.costTags,
+						requirementId: requirement.reqId,
+						attempt: String(attempt)
+					},
+					signal: opts.signal,
+					execute: (signal, callId) => chat.chat(request, {
+						signal,
+						idempotencyKey: callId
+					}),
+					receipt: costReceiptFromLlm,
+					receiptFromError: costReceiptFromLlmError
+				});
+				if (!paid.succeeded) throw paid.error;
+				const resp = paid.value;
+				const raw = resp.content;
+				await record({
+					eventId: randomUUID(),
+					provider: chat.transport,
+					model,
+					endpoint: "/chat",
+					baseUrl: "",
+					attemptIndex: attempt,
+					direction: "response",
+					timestamp: Date.now(),
+					durationMs: Date.now() - started,
+					responseBody: resp,
+					redactedFields: []
+				});
+				return parseCorrectnessResponse(raw);
+			} catch (err) {
+				lastErr = err;
+				await record({
+					eventId: randomUUID(),
+					provider: chat.transport,
+					model,
+					endpoint: "/chat",
+					baseUrl: "",
+					attemptIndex: attempt,
+					direction: "error",
+					timestamp: Date.now(),
+					durationMs: Date.now() - started,
+					errorMessage: err instanceof Error ? err.message : String(err),
+					redactedFields: []
+				});
+			}
+		}
+		throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+	};
+}
+/** Stopwords for requirement-title tokenization — drops the imperative verbs
+*  ('review', 'update', …) common to deliverable titles so recall keys on the
+*  substantive nouns, not the boilerplate ask. */
+const TITLE_STOPWORDS = /* @__PURE__ */ new Set([
+	"the",
+	"a",
+	"an",
+	"and",
+	"or",
+	"for",
+	"to",
+	"of",
+	"in",
+	"on",
+	"with",
+	"review",
+	"update",
+	"new",
+	"proposed"
+]);
+/**
+* Deterministic `CorrectnessChecker` — the no-LLM counterpart to
+* `createLlmCorrectnessChecker`. A produced item fulfils a requirement when its
+* content is substantive (≥ `minContentLength` chars) AND recalls ≥ `minRecall`
+* of the requirement title's significant tokens. No network.
+*
+* Polarity-blind: token recall credits a negation that contains the
+* requirement's tokens ("I will NOT produce the comparison" recalls every token
+* of "produce the comparison"). The structural match stage is ALSO lexical, so
+* pairing the two collapses to a single gameable gate. Use this only as an
+* opt-in structural pre-filter or for tasks whose requirements have no polarity
+* to invert; for produced-state grading the correctness checker MUST be semantic
+* (`createLlmCorrectnessChecker`). See the anti-game fixtures in the test suite.
+*/
+function createTokenRecallChecker(opts = {}) {
+	const minRecall = opts.minRecall ?? .5;
+	const minLen = opts.minContentLength ?? 120;
+	return async (requirement, content) => {
+		const body = content.trim();
+		if (body.length < minLen) return {
+			correct: false,
+			reason: `content too thin (${body.length} chars) to be the deliverable`
+		};
+		const titleTokens = requirement.title.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 2 && !TITLE_STOPWORDS.has(t));
+		if (titleTokens.length === 0) return {
+			correct: true,
+			reason: "requirement title has no significant tokens — structural match accepted"
+		};
+		const lower = body.toLowerCase();
+		const hits = titleTokens.filter((t) => lower.includes(t)).length;
+		return hits / titleTokens.length >= minRecall ? {
+			correct: true,
+			reason: `content recalls ${hits}/${titleTokens.length} requirement tokens`
+		} : {
+			correct: false,
+			reason: `content recalls only ${hits}/${titleTokens.length} requirement tokens`
+		};
+	};
+}
+//#endregion
+//#region src/produced-state.ts
+function artifactKind(mimeType) {
+	if (!mimeType) return "file";
+	if (mimeType.includes("json")) return "json";
+	if (mimeType.startsWith("text/")) return "text";
+	return "file";
+}
+/**
+* Normalize a run's runtime event stream into `ProducedState`.
+*
+* Pure and total — unrecognized event types are skipped. `toolCalls` is
+* deduplicated by name in first-seen order (completion cares about a tool's
+* presence, not its call count). An artifact with neither a name nor a uri
+* still yields an entry keyed by its `artifactId` so it is never silently
+* dropped; an artifact with no `content` yields empty content, which the
+* completion oracle's structural check then rejects on its own.
+*/
+function extractProducedState(events) {
+	const artifacts = [];
+	const proposals = [];
+	const toolCalls = [];
+	const seenTools = /* @__PURE__ */ new Set();
+	for (const ev of events) if (ev.type === "tool_call") {
+		const name = ev.toolName;
+		if (name && !seenTools.has(name)) {
+			seenTools.add(name);
+			toolCalls.push(name);
+		}
+	} else if (ev.type === "artifact") {
+		const a = ev;
+		artifacts.push({
+			kind: artifactKind(a.mimeType),
+			path: a.name ?? a.uri ?? a.artifactId,
+			content: a.content ?? ""
+		});
+	} else if (ev.type === "proposal_created") {
+		const p = ev;
+		proposals.push({
+			id: p.proposalId,
+			title: p.title,
+			status: p.status ?? "pending",
+			...p.content !== void 0 ? { content: p.content } : {}
+		});
+	}
+	return {
+		artifacts,
+		proposals,
+		toolCalls
+	};
+}
+//#endregion
+//#region src/agent-profile.ts
+/**
+* The agentic coding harnesses an eval sweeps by default — the ones we care about
+* ranking. This is the SINGLE source of that list; consumers import it instead of
+* re-declaring their own (a re-declared list is how the fleet drifts). Pass an
+* explicit `harnesses` (e.g. `harnessTypeSchema.options` for literally every known
+* harness) to widen beyond these.
+*/
+const CODING_HARNESSES = [
+	"opencode",
+	"claude-code",
+	"codex",
+	"kimi-code"
+];
+/** Model sentinel for a vendor-locked harness that supports none of the swept models:
+*  it carries no provider prefix, so `harnessSupportsModel` accepts it and the harness
+*  resolves it to its own native default model at runtime (e.g. kimi-code → its Kimi
+*  model). Lets `expandProfileAxes` snap-instead-of-drop without a per-harness flagship
+*  table that would rot as router catalogs change. */
+const HARNESS_NATIVE_MODEL = "default";
+/**
+* Expand a base profile across the harness × model matrix into the `AgentProfile[]`
+* that `runProfileMatrix` / `selfImprove` score — the ONE place "which harnesses ×
+* which models do we evaluate" lives, so no product hand-rolls its own harness list
+* or column→profile mapping (the pattern that let those copies drift and silently
+* break the harness pivot).
+*
+* Each cell clones `base`, sets `model.default`, and stamps `metadata.harness` +
+* `metadata.harnessModel` (both hash-bearing, so every cell gets a distinct
+* `agentProfileId` row and results join back by harness/model via {@link harnessAxisOf}
+* with no hand-recomputed key). A vendor-locked harness snaps to its family's swept
+* models — or its native default ({@link HARNESS_NATIVE_MODEL}) when it supports none —
+* so every requested harness runs; `keepIncompatible` forces every pair verbatim.
+*
+* Omit `harnesses`/`models` to sweep the full default set — the "turn it on for
+* everything we care about" switch, identical in shape whether one harness or all.
+*/
+function expandProfileAxes(spec) {
+	const harnesses = spec.harnesses ?? CODING_HARNESSES;
+	if (harnesses.length === 0) throw new ValidationError("expandProfileAxes: no harnesses to sweep");
+	const baseModel = spec.base.model?.default;
+	const models = spec.models ?? (baseModel ? [baseModel] : []);
+	if (models.length === 0) throw new ValidationError("expandProfileAxes: no models to sweep — base profile has no model.default and none were supplied");
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const harness of harnesses) {
+		const supported = spec.keepIncompatible ? models : models.filter((model) => harnessSupportsModel(harness, model));
+		const effective = supported.length > 0 ? supported : [HARNESS_NATIVE_MODEL];
+		for (const model of effective) {
+			const profile = {
+				...spec.base,
+				name: `${spec.base.name ?? "agent"}/${harness}/${model}`,
+				model: {
+					...spec.base.model,
+					default: model
+				},
+				metadata: {
+					...spec.base.metadata ?? {},
+					harness,
+					harnessModel: model
+				}
+			};
+			const id = agentProfileId(profile);
+			if (seen.has(id)) continue;
+			seen.add(id);
+			out.push(profile);
+		}
+	}
+	if (out.length === 0) throw new ValidationError(`expandProfileAxes: produced no profiles (harnesses=[${harnesses.join(", ")}], models=[${models.join(", ")}]).`);
+	return out;
+}
+/**
+* Read the (harness, model) a matrix cell ran under, off a profile or a result row's
+* profile — the join-back for a `byHarness` pivot. Returns undefined when the profile
+* wasn't produced by {@link expandProfileAxes}. Callers group `result.byProfile` by
+* this instead of recomputing an id (recomputing the wrong key is what broke the pivot
+* in the hand-rolled copies).
+*/
+function harnessAxisOf(profile) {
+	const m = profile.metadata;
+	const harness = m?.harness;
+	const model = m?.harnessModel;
+	if (typeof harness === "string" && typeof model === "string") return {
+		harness,
+		model
+	};
+}
+/**
+* Collision-resistant, path-safe, human-readable profile id for eval artifacts.
+* Scorecard joins still use `agentProfileHash`; this id is for run ids, matrix
+* keys, and directory names where two profiles must not collapse onto one row.
+* The suffix is the first 64 bits of the behaviour hash, enough for ordinary
+* eval matrices while keeping filenames readable.
+*/
+function agentProfileId(profile) {
+	return `${pathSafeProfileLabel(agentProfileDisplayLabel(profile)) ?? "profile"}-${agentProfileHash(profile).slice(0, 16)}`;
+}
+/**
+* Model snapshot used for `RunRecord.model`. Eval surfaces require a concrete
+* model id because run records reject bare/missing model aliases.
+*/
+function agentProfileModelId(profile) {
+	const model = profile.model?.default?.trim();
+	if (!model) throw new ValidationError(`AgentProfile "${agentProfileDisplayLabel(profile) ?? "unnamed profile"}" has no model.default — cannot record eval run`);
+	return model;
+}
+function agentProfileDisplayLabel(profile) {
+	return profile.name?.trim() || profile.version?.trim() || void 0;
+}
+function pathSafeProfileLabel(label) {
+	return label?.trim().replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || void 0;
+}
+function compact(input) {
+	const out = {};
+	for (const [key, value] of Object.entries(input)) if (value !== void 0) out[key] = value;
+	return out;
+}
+/**
+* Deterministic behaviour identity for the canonical
+* `@tangle-network/agent-interface` AgentProfile.
+*
+* `name` and `description` are labels and do not affect the hash. Profile
+* `version`, prompt, model hints, tools, resources, hooks, modes, permissions,
+* and extensions do affect the hash. Resource array order is hash-bearing
+* because mount order can change agent behaviour. Undefined fields are treated
+* as absent; explicit `null` fields remain hash-bearing.
+*/
+function agentProfileHash(profile) {
+	const model = agentProfileModelId(profile);
+	const behaviour = {
+		...profile,
+		name: void 0,
+		description: void 0,
+		tags: profile.tags ? [...profile.tags].sort() : void 0,
+		model: compact({
+			...profile.model,
+			default: model
+		})
+	};
+	return createHash("sha256").update(JSON.stringify(canonicalize(behaviour))).digest("hex");
+}
+//#endregion
+//#region src/campaign/analyst-surface.ts
+function surfaceToText(surface) {
+	if (typeof surface === "string") return surface;
+	throw new Error(`buildAnalystSurfaceDispatch: the analyst surface must be a string actorDescription, got a ${surface.kind}-tier surface. The analyst prompt is prompt-tier.`);
+}
+/**
+* Build the `dispatchWithSurface(surface, scenario, ctx)` the improvement loop
+* calls: run the analyst with `surface` as its actorDescription over the
+* scenario's trace corpus and return its findings.
+*/
+function buildAnalystSurfaceDispatch(opts) {
+	const analyze = opts.analyze ?? analyzeTraces;
+	return async (surface, scenario, _ctx) => {
+		const actorDescription = surfaceToText(surface);
+		const res = await analyze({ question: scenario.question }, {
+			...opts.analystOptions,
+			actorDescription,
+			source: scenario.source
+		});
+		return {
+			answer: res.answer,
+			findings: res.findings,
+			actorPromptVersion: res.actorPromptVersion
+		};
+	};
+}
+/**
+* Deterministic, ground-truth judge for analyst findings. Composite =
+* recall of the scenario's `expectedFailureModes` (optionally blended with a
+* precision term that penalizes findings tripping `forbiddenCues`). No LLM —
+* the score is a function of the labels, so the analyst prompt is optimized
+* toward surfacing real failures, not toward a judge it can flatter.
+*/
+function failureModeRecallJudge(opts = {}) {
+	const recallWeight = opts.recallWeight ?? .5;
+	return {
+		name: "failure-mode-recall",
+		dimensions: [{
+			key: "recall",
+			description: "fraction of ground-truth failure modes the analyst surfaced"
+		}, {
+			key: "precision",
+			description: "1 − share of findings that named a failure/tool/error absent from this corpus"
+		}],
+		appliesTo: (s) => s.kind === "analyst-surface",
+		score({ artifact, scenario }) {
+			const modes = scenario.expectedFailureModes;
+			if (modes.length === 0) throw new Error(`failureModeRecallJudge: scenario '${scenario.id}' has no expectedFailureModes — refusing to score (a vacuous 1.0 would corrupt the comparison)`);
+			const hay = artifact.findings.join("\n").toLowerCase();
+			const matched = modes.filter((m) => m.cues.some((c) => hay.includes(c.toLowerCase())));
+			const recall = matched.length / modes.length;
+			const forbidden = (scenario.forbiddenCues ?? []).map((c) => c.toLowerCase());
+			let precision = 1;
+			let hallucinated = 0;
+			if (forbidden.length > 0) {
+				const denom = Math.max(1, artifact.findings.length);
+				hallucinated = artifact.findings.filter((f) => forbidden.some((c) => f.toLowerCase().includes(c))).length;
+				precision = 1 - hallucinated / denom;
+			}
+			const composite = forbidden.length > 0 ? recallWeight * recall + (1 - recallWeight) * precision : recall;
+			const missed = modes.filter((m) => !matched.includes(m)).map((m) => m.id);
+			const notes = `matched ${matched.length}/${modes.length} failure modes` + (missed.length ? `; missed [${missed.join(", ")}]` : "") + (hallucinated ? `; ${hallucinated} out-of-corpus finding(s)` : "");
+			return {
+				dimensions: {
+					recall,
+					precision
+				},
+				composite,
+				notes
+			};
+		}
+	};
+}
+//#endregion
+//#region src/campaign/cross-surface-context.ts
+function validateCrossSurfaceInput(input) {
+	assertNonEmptyUnique(input.taskOrder, "taskOrder");
+	assertNonEmptyUnique(input.componentOrder, "componentOrder");
+	if (input.componentOrder.length < 2) throw new ValidationError("analyzeCrossSurfaceInteractions: componentOrder must contain at least two surfaces");
+	assertNonEmptyUnique(input.candidateOrder, "candidateOrder");
+	assertNonEmptyUnique(input.costMetricOrder, "costMetricOrder");
+	if (input.costMetricOrder.includes("score")) throw new ValidationError(`analyzeCrossSurfaceInteractions: costMetricOrder cannot contain reserved metric 'score'`);
+	validateBootstrap(input);
+	validateSelection(input);
+	const componentById = indexUnique(input.components, (component) => component.componentId, "component");
+	assertExactSet(input.componentOrder, componentById.keys(), "componentOrder", "components");
+	const surfaces = /* @__PURE__ */ new Set();
+	for (const component of componentById.values()) {
+		assertNonEmpty(component.componentId, "componentId");
+		assertNonEmpty(component.surfaceId, `surfaceId for component '${component.componentId}'`);
+		if (surfaces.has(component.surfaceId)) throw new ValidationError(`analyzeCrossSurfaceInteractions: surfaceId '${component.surfaceId}' has more than one component; the interaction stage requires one independently selected finalist per surface`);
+		surfaces.add(component.surfaceId);
+		if (typeof component.bestSingleEligible !== "boolean") throw new ValidationError(`analyzeCrossSurfaceInteractions: component '${component.componentId}' must declare bestSingleEligible`);
+	}
+	const componentIndex = new Map(input.componentOrder.map((id, index) => [id, index]));
+	const candidateById = indexUnique(input.candidates, (candidate) => candidate.candidateId, "candidate");
+	assertExactSet(input.candidateOrder, candidateById.keys(), "candidateOrder", "candidates");
+	if (!candidateById.has(input.baselineCandidateId)) throw new ValidationError(`analyzeCrossSurfaceInteractions: unknown baselineCandidateId '${input.baselineCandidateId}'`);
+	const candidateByComponents = /* @__PURE__ */ new Map();
+	const singleByComponent = /* @__PURE__ */ new Map();
+	for (const candidate of candidateById.values()) {
+		validateCandidate(candidate, componentById, componentIndex, input.baselineCandidateId);
+		const key = crossSurfaceComponentSetKey(candidate.componentIds);
+		const duplicate = candidateByComponents.get(key);
+		if (duplicate) throw new ValidationError(`analyzeCrossSurfaceInteractions: candidates '${duplicate.candidateId}' and '${candidate.candidateId}' materialize the same component set`);
+		candidateByComponents.set(key, candidate);
+		if (candidate.componentIds.length === 1) singleByComponent.set(candidate.componentIds[0], candidate);
+	}
+	const baseline = candidateById.get(input.baselineCandidateId);
+	if (baseline.componentIds.length !== 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: baseline '${baseline.candidateId}' must have zero components`);
+	for (const componentId of input.componentOrder) if (!singleByComponent.has(componentId)) throw new ValidationError(`analyzeCrossSurfaceInteractions: no single-surface candidate for component '${componentId}'`);
+	for (let left = 0; left < input.componentOrder.length; left++) for (let right = left + 1; right < input.componentOrder.length; right++) {
+		const ids = [input.componentOrder[left], input.componentOrder[right]];
+		if (!candidateByComponents.has(crossSurfaceComponentSetKey(ids))) throw new ValidationError(`analyzeCrossSurfaceInteractions: missing pair candidate for components [${ids.join(", ")}]`);
+	}
+	const rowsByCandidate = /* @__PURE__ */ new Map();
+	const taskIds = new Set(input.taskOrder);
+	for (const row of input.rows) {
+		const candidate = candidateById.get(row.candidateId);
+		if (!candidate) throw new ValidationError(`analyzeCrossSurfaceInteractions: row for task '${row.taskId}' names unknown candidate '${row.candidateId}'`);
+		if (!taskIds.has(row.taskId)) throw new ValidationError(`analyzeCrossSurfaceInteractions: row for candidate '${row.candidateId}' names task '${row.taskId}' outside the declared taskOrder`);
+		validateRow(input, row, candidate);
+		const byTask = rowsByCandidate.get(row.candidateId) ?? /* @__PURE__ */ new Map();
+		if (byTask.has(row.taskId)) throw new ValidationError(`analyzeCrossSurfaceInteractions: duplicate row for candidate '${row.candidateId}' and task '${row.taskId}'`);
+		byTask.set(row.taskId, row);
+		rowsByCandidate.set(row.candidateId, byTask);
+	}
+	for (const candidateId of input.candidateOrder) {
+		const byTask = rowsByCandidate.get(candidateId);
+		const missing = input.taskOrder.filter((taskId) => !byTask?.has(taskId));
+		if (missing.length > 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: candidate '${candidateId}' is missing declared task row(s) [${missing.join(", ")}]; encode failed attempts explicitly instead of changing the task axis`);
+	}
+	const expectedRows = input.candidateOrder.length * input.taskOrder.length;
+	if (input.rows.length !== expectedRows) throw new ValidationError(`analyzeCrossSurfaceInteractions: expected exactly ${expectedRows} candidate × task rows, got ${input.rows.length}`);
+	return {
+		input,
+		components: input.componentOrder.map((id) => componentById.get(id)),
+		candidates: input.candidateOrder.map((id) => candidateById.get(id)),
+		componentById,
+		candidateById,
+		candidateByComponents,
+		singleByComponent,
+		rowsByCandidate,
+		componentIndex,
+		candidateIndex: new Map(input.candidateOrder.map((id, index) => [id, index]))
+	};
+}
+function crossSurfaceRowsFor(context, candidateId) {
+	return context.input.taskOrder.map((taskId) => crossSurfaceRowFor(context, candidateId, taskId));
+}
+function crossSurfaceRowFor(context, candidateId, taskId) {
+	return context.rowsByCandidate.get(candidateId).get(taskId);
+}
+function canonicalCrossSurfaceComponents(context, componentIds) {
+	return [...componentIds].sort((left, right) => context.componentIndex.get(left) - context.componentIndex.get(right));
+}
+function crossSurfaceComponentSetKey(componentIds) {
+	return JSON.stringify(componentIds);
+}
+function validateBootstrap(input) {
+	const { seed, resamples, confidence } = input.bootstrap;
+	if (!Number.isInteger(seed)) throw new ValidationError(`analyzeCrossSurfaceInteractions: bootstrap.seed must be an integer`);
+	if (!Number.isInteger(resamples) || resamples <= 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: bootstrap.resamples must be a positive integer`);
+	if (!Number.isFinite(confidence) || confidence <= 0 || confidence >= 1) throw new ValidationError(`analyzeCrossSurfaceInteractions: bootstrap.confidence must be in (0,1)`);
+}
+function validateSelection(input) {
+	const policy = input.selection;
+	for (const [name, value] of [["minimumFiringTasks", policy.minimumFiringTasks], ["minimumEffectTasks", policy.minimumEffectTasks]]) if (!Number.isInteger(value) || value < 0 || value > input.taskOrder.length) throw new ValidationError(`analyzeCrossSurfaceInteractions: selection.${name} must be an integer in [0,${input.taskOrder.length}]`);
+	if (!Number.isInteger(policy.minimumBundleComponents) || policy.minimumBundleComponents < 2 || policy.minimumBundleComponents > input.componentOrder.length) throw new ValidationError(`analyzeCrossSurfaceInteractions: selection.minimumBundleComponents must be an integer in [2,${input.componentOrder.length}]`);
+	for (const [metric, limit] of Object.entries(policy.maximumMedianCostRatioToBaseline)) {
+		if (!input.costMetricOrder.includes(metric)) throw new ValidationError(`analyzeCrossSurfaceInteractions: cost limit names undeclared metric '${metric}'`);
+		if (!Number.isFinite(limit) || limit <= 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: cost ratio limit for '${metric}' must be positive and finite`);
+	}
+}
+function validateCandidate(candidate, componentById, componentIndex, baselineCandidateId) {
+	assertNonEmpty(candidate.candidateId, "candidateId");
+	assertNonEmpty(candidate.contentHash, `contentHash for candidate '${candidate.candidateId}'`);
+	if (!Number.isInteger(candidate.artifactBytes) || candidate.artifactBytes < 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: artifactBytes for candidate '${candidate.candidateId}' must be a non-negative integer`);
+	assertUnique$1(candidate.componentIds, `componentIds for candidate '${candidate.candidateId}'`);
+	for (const componentId of candidate.componentIds) if (!componentById.has(componentId)) throw new ValidationError(`analyzeCrossSurfaceInteractions: candidate '${candidate.candidateId}' names unknown component '${componentId}'`);
+	const canonical = [...candidate.componentIds].sort((left, right) => componentIndex.get(left) - componentIndex.get(right));
+	if (!arraysEqual(candidate.componentIds, canonical)) throw new ValidationError(`analyzeCrossSurfaceInteractions: candidate '${candidate.candidateId}' components must follow componentOrder`);
+	if (candidate.candidateId !== baselineCandidateId && candidate.componentIds.length === 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: only baseline '${baselineCandidateId}' may have zero components`);
+}
+function validateRow(input, row, candidate) {
+	if (!arraysEqual(row.componentIds, candidate.componentIds)) throw new ValidationError(`analyzeCrossSurfaceInteractions: row '${row.candidateId}/${row.taskId}' componentIds do not match its candidate`);
+	if (![
+		"complete",
+		"missing",
+		"invalid"
+	].includes(row.completeness)) throw new ValidationError(`analyzeCrossSurfaceInteractions: row '${row.candidateId}/${row.taskId}' has unknown completeness '${String(row.completeness)}'`);
+	if (row.completeness === "complete") {
+		if (typeof row.pass !== "boolean" || !Number.isFinite(row.score)) throw new ValidationError(`analyzeCrossSurfaceInteractions: complete row '${row.candidateId}/${row.taskId}' requires boolean pass and finite score`);
+		if (row.rejectReason !== null) throw new ValidationError(`analyzeCrossSurfaceInteractions: complete row '${row.candidateId}/${row.taskId}' cannot carry rejectReason`);
+	} else {
+		if (row.pass !== null || row.score !== null) throw new ValidationError(`analyzeCrossSurfaceInteractions: ${row.completeness} row '${row.candidateId}/${row.taskId}' must use null pass and score`);
+		if (typeof row.rejectReason !== "string" || row.rejectReason.trim() === "") throw new ValidationError(`analyzeCrossSurfaceInteractions: ${row.completeness} row '${row.candidateId}/${row.taskId}' requires rejectReason`);
+	}
+	assertExactSet(input.costMetricOrder, Object.keys(row.cost), `cost keys for row '${row.candidateId}/${row.taskId}'`, "costMetricOrder");
+	for (const metric of input.costMetricOrder) {
+		const value = row.cost[metric];
+		if (value === null || value === void 0 || !Number.isFinite(value) || value < 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: unknown or invalid cost '${metric}' on row '${row.candidateId}/${row.taskId}'; every attempt must report a non-negative finite value`);
+	}
+	const evidenceByComponent = indexUnique(row.componentEvidence, (evidence) => evidence.componentId, `componentEvidence on row '${row.candidateId}/${row.taskId}'`);
+	assertExactSet(candidate.componentIds, evidenceByComponent.keys(), `componentEvidence on row '${row.candidateId}/${row.taskId}'`, "candidate components");
+	for (const evidence of evidenceByComponent.values()) {
+		assertTriState(evidence.fired, "fired", row);
+		assertTriState(evidence.effectObserved, "effectObserved", row);
+		if (evidence.effectObserved === true && evidence.fired !== true) throw new ValidationError(`analyzeCrossSurfaceInteractions: effectObserved=true requires fired=true for component '${evidence.componentId}' on row '${row.candidateId}/${row.taskId}'`);
+	}
+}
+function assertTriState(value, field, row) {
+	if (value !== true && value !== false && value !== null) throw new ValidationError(`analyzeCrossSurfaceInteractions: ${field} on row '${row.candidateId}/${row.taskId}' must be boolean or null`);
+}
+function indexUnique(items, id, label) {
+	const result = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = id(item);
+		assertNonEmpty(key, `${label} id`);
+		if (result.has(key)) throw new ValidationError(`analyzeCrossSurfaceInteractions: duplicate ${label} id '${key}'`);
+		result.set(key, item);
+	}
+	return result;
+}
+function assertNonEmptyUnique(values, label) {
+	if (values.length === 0) throw new ValidationError(`analyzeCrossSurfaceInteractions: ${label} is empty`);
+	assertUnique$1(values, label);
+	for (const value of values) assertNonEmpty(value, label);
+}
+function assertUnique$1(values, label) {
+	if (new Set(values).size !== values.length) throw new ValidationError(`analyzeCrossSurfaceInteractions: ${label} contains duplicates`);
+}
+function assertNonEmpty(value, label) {
+	if (typeof value !== "string" || value.trim() === "") throw new ValidationError(`analyzeCrossSurfaceInteractions: ${label} must be a non-empty string`);
+}
+function assertExactSet(expected, actualIterable, actualLabel, expectedLabel) {
+	const actual = [...actualIterable];
+	const expectedSet = new Set(expected);
+	const actualSet = new Set(actual);
+	const missing = expected.filter((value) => !actualSet.has(value));
+	const extra = actual.filter((value) => !expectedSet.has(value));
+	if (missing.length > 0 || extra.length > 0 || actual.length !== expected.length) throw new ValidationError(`analyzeCrossSurfaceInteractions: ${actualLabel} does not match ${expectedLabel}; missing=[${missing.join(", ")}], extra=[${extra.join(", ")}]`);
+}
+function arraysEqual(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+//#endregion
+//#region src/campaign/cross-surface-interaction.ts
+/**
+* Task-paired comparison and deterministic selection for independently
+* proposed agent surfaces. Unlike factorial cell-mean attribution, every
+* benefit, regression, and interaction remains attached to its task row.
+*/
+/**
+* Build the complete cross-surface evidence matrix and derive all three frozen
+* candidates. The task/candidate/component orders are part of the input so
+* neither insertion order nor an after-the-fact tie-break can change a result.
+*/
+function analyzeCrossSurfaceInteractions(input) {
+	const context = validateCrossSurfaceInput(input);
+	const baseline = context.candidateById.get(input.baselineCandidateId);
+	const preliminary = context.candidates.map((candidate) => summarizeCandidate(context, candidate, baseline));
+	const baselineSummary = preliminary.find((summary) => summary.candidate.candidateId === input.baselineCandidateId);
+	const summaries = preliminary.map((summary) => summary.candidate.candidateId === input.baselineCandidateId ? summary : {
+		...summary,
+		eligibility: candidateEligibility(context, summary, baselineSummary)
+	});
+	const summaryById = new Map(summaries.map((summary) => [summary.candidate.candidateId, summary]));
+	const eligibleSingles = rankedEligibleSingles(context, summaryById);
+	const interactionReadySingles = rankedInteractionReadySingles(context, summaryById);
+	const pairwise = buildPairwise(context, summaryById, interactionReadySingles, baselineSummary);
+	const selections = selectCandidates(context, summaryById, eligibleSingles, interactionReadySingles, pairwise);
+	const rows = context.candidates.flatMap((candidate) => input.taskOrder.map((taskId) => context.rowsByCandidate.get(candidate.candidateId).get(taskId)));
+	return {
+		taskIds: [...input.taskOrder],
+		componentIds: [...input.componentOrder],
+		candidateIds: [...input.candidateOrder],
+		costMetrics: [...input.costMetricOrder],
+		rows,
+		missingAttempts: rows.filter((row) => row.completeness === "missing"),
+		invalidAttempts: rows.filter((row) => row.completeness === "invalid"),
+		candidates: summaries,
+		pairwise,
+		selections
+	};
+}
+function summarizeCandidate(context, candidate, baseline) {
+	const rows = crossSurfaceRowsFor(context, candidate.candidateId);
+	const outcome = summarizeOutcome(context, rows, crossSurfaceRowsFor(context, baseline.candidateId), candidate.candidateId === baseline.candidateId);
+	const completeScores = rows.filter((row) => row.completeness === "complete").map((row) => row.score);
+	const costs = Object.fromEntries(context.input.costMetricOrder.map((metric) => [metric, distribution(rows.map((row) => row.cost[metric]))]));
+	return {
+		candidate,
+		outcome,
+		score: completeScores.length === 0 ? null : distribution(completeScores),
+		costs,
+		firing: summarizeCandidateEvidence(rows, candidate.componentIds, "fired"),
+		effect: summarizeCandidateEvidence(rows, candidate.componentIds, "effectObserved"),
+		comparisonToBaseline: candidate.candidateId === baseline.candidateId ? null : pairedComparison(context, baseline.candidateId, candidate.candidateId),
+		eligibility: null
+	};
+}
+function summarizeOutcome(context, rows, baselineRows, isBaseline) {
+	const resolvedTaskIds = [];
+	const failedTaskIds = [];
+	const missingTaskIds = [];
+	const invalidTaskIds = [];
+	const benefitTaskIds = [];
+	const regressionTaskIds = [];
+	const comparisonMissingTaskIds = [];
+	for (let index = 0; index < context.input.taskOrder.length; index++) {
+		const row = rows[index];
+		const baseline = baselineRows[index];
+		if (row.completeness === "missing") missingTaskIds.push(row.taskId);
+		else if (row.completeness === "invalid") invalidTaskIds.push(row.taskId);
+		else if (row.pass) resolvedTaskIds.push(row.taskId);
+		else failedTaskIds.push(row.taskId);
+		if (isBaseline) continue;
+		if (row.completeness !== "complete" || baseline.completeness !== "complete") comparisonMissingTaskIds.push(row.taskId);
+		else if (row.pass && !baseline.pass) benefitTaskIds.push(row.taskId);
+		else if (!row.pass && baseline.pass) regressionTaskIds.push(row.taskId);
+	}
+	return {
+		resolvedTaskIds,
+		failedTaskIds,
+		missingTaskIds,
+		invalidTaskIds,
+		benefitTaskIds,
+		regressionTaskIds,
+		comparisonMissingTaskIds,
+		netBenefit: benefitTaskIds.length - regressionTaskIds.length
+	};
+}
+function summarizeCandidateEvidence(rows, componentIds, field) {
+	if (componentIds.length === 0) return {
+		byComponent: [],
+		allObservedTaskIds: [],
+		someObservedTaskIds: [],
+		noneObservedTaskIds: [],
+		unobservedTaskIds: []
+	};
+	const byComponent = componentIds.map((componentId) => {
+		const observedTaskIds = [];
+		const notObservedTaskIds = [];
+		const unobservedTaskIds = [];
+		for (const row of rows) {
+			const value = evidenceValue(row, componentId, field);
+			if (value === true) observedTaskIds.push(row.taskId);
+			else if (value === false) notObservedTaskIds.push(row.taskId);
+			else unobservedTaskIds.push(row.taskId);
+		}
+		return {
+			componentId,
+			observedTaskIds,
+			notObservedTaskIds,
+			unobservedTaskIds
+		};
+	});
+	const allObservedTaskIds = [];
+	const someObservedTaskIds = [];
+	const noneObservedTaskIds = [];
+	const unobservedTaskIds = [];
+	for (const row of rows) {
+		const values = componentIds.map((componentId) => evidenceValue(row, componentId, field));
+		if (values.some((value) => value === null)) unobservedTaskIds.push(row.taskId);
+		else if (values.every(Boolean)) allObservedTaskIds.push(row.taskId);
+		else if (values.some(Boolean)) someObservedTaskIds.push(row.taskId);
+		else noneObservedTaskIds.push(row.taskId);
+	}
+	return {
+		byComponent,
+		allObservedTaskIds,
+		someObservedTaskIds,
+		noneObservedTaskIds,
+		unobservedTaskIds
+	};
+}
+function candidateEligibility(context, summary, baseline) {
+	const reasons = [];
+	if (summary.outcome.missingTaskIds.length > 0) reasons.push("missing_attempt");
+	if (summary.outcome.invalidTaskIds.length > 0) reasons.push("invalid_attempt");
+	if (summary.outcome.comparisonMissingTaskIds.length > 0) reasons.push("baseline_outcome_missing");
+	if (summary.outcome.benefitTaskIds.length <= summary.outcome.regressionTaskIds.length) reasons.push("benefit_not_greater_than_regression");
+	appendEvidenceEligibilityReasons(reasons, summary.firing, context.input.selection.minimumFiringTasks, context.input.selection.requireObservedFiring, "firing_below_minimum", "firing_unobserved");
+	appendEvidenceEligibilityReasons(reasons, summary.effect, context.input.selection.minimumEffectTasks, context.input.selection.requireObservedEffect, "effect_below_minimum", "effect_unobserved");
+	if (!withinCostLimits(context, summary, baseline)) reasons.push("cost_limit_exceeded");
+	return {
+		eligible: reasons.length === 0,
+		reasons: unique(reasons)
+	};
+}
+function appendEvidenceEligibilityReasons(reasons, evidence, minimum, requireObserved, belowReason, unobservedReason) {
+	if (evidence.byComponent.some((component) => component.observedTaskIds.length < minimum)) reasons.push(belowReason);
+	if (requireObserved && evidence.byComponent.some((component) => component.unobservedTaskIds.length > 0)) reasons.push(unobservedReason);
+}
+function rankedEligibleSingles(context, summaryById) {
+	return [...context.singleByComponent.values()].map((candidate) => summaryById.get(candidate.candidateId)).filter((summary) => summary.eligibility?.eligible).sort((left, right) => compareSingleSummaries(context, left, right));
+}
+/**
+* A neutral constituent may seed a composition when it has complete, bounded,
+* observed evidence and causes no baseline regression. Individual benefit is
+* deliberately left to the best-single arm rather than used as a pair gate.
+*/
+function rankedInteractionReadySingles(context, summaryById) {
+	return [...context.singleByComponent.values()].map((candidate) => summaryById.get(candidate.candidateId)).filter((summary) => summary.outcome.regressionTaskIds.length === 0 && summary.eligibility?.reasons.every((reason) => reason === "benefit_not_greater_than_regression")).sort((left, right) => compareSingleSummaries(context, left, right));
+}
+function compareSingleSummaries(context, left, right) {
+	const byNetBenefit = right.outcome.netBenefit - left.outcome.netBenefit;
+	if (byNetBenefit !== 0) return byNetBenefit;
+	const byBenefit = right.outcome.benefitTaskIds.length - left.outcome.benefitTaskIds.length;
+	if (byBenefit !== 0) return byBenefit;
+	const byRegression = left.outcome.regressionTaskIds.length - right.outcome.regressionTaskIds.length;
+	if (byRegression !== 0) return byRegression;
+	for (const metric of context.input.costMetricOrder) {
+		const byCost = left.costs[metric].median - right.costs[metric].median;
+		if (byCost !== 0) return byCost;
+	}
+	const byBytes = left.candidate.artifactBytes - right.candidate.artifactBytes;
+	if (byBytes !== 0) return byBytes;
+	return context.candidateIndex.get(left.candidate.candidateId) - context.candidateIndex.get(right.candidate.candidateId);
+}
+function buildPairwise(context, summaryById, interactionReadySingles, baseline) {
+	const interactionReadyIds = new Set(interactionReadySingles.map((summary) => summary.candidate.candidateId));
+	const entries = [];
+	for (let leftIndex = 0; leftIndex < context.components.length; leftIndex++) for (let rightIndex = leftIndex + 1; rightIndex < context.components.length; rightIndex++) {
+		const leftComponent = context.components[leftIndex];
+		const rightComponent = context.components[rightIndex];
+		const leftSingle = context.singleByComponent.get(leftComponent.componentId);
+		const rightSingle = context.singleByComponent.get(rightComponent.componentId);
+		const pair = context.candidateByComponents.get(crossSurfaceComponentSetKey([leftComponent.componentId, rightComponent.componentId]));
+		const pairSummary = summaryById.get(pair.candidateId);
+		const leftSummary = summaryById.get(leftSingle.candidateId);
+		const rightSummary = summaryById.get(rightSingle.candidateId);
+		const synergyTaskIds = [];
+		const interferenceTaskIds = [];
+		for (const taskId of context.input.taskOrder) {
+			const pairRow = crossSurfaceRowFor(context, pair.candidateId, taskId);
+			const leftRow = crossSurfaceRowFor(context, leftSingle.candidateId, taskId);
+			const rightRow = crossSurfaceRowFor(context, rightSingle.candidateId, taskId);
+			if (![
+				pairRow,
+				leftRow,
+				rightRow
+			].every((row) => row.completeness === "complete")) continue;
+			if (pairRow.pass && !leftRow.pass && !rightRow.pass) synergyTaskIds.push(taskId);
+			if (!pairRow.pass && (leftRow.pass || rightRow.pass)) interferenceTaskIds.push(taskId);
+		}
+		const incrementalVsConstituents = [compareCandidates(context, summaryById, leftSingle.candidateId, pair.candidateId), compareCandidates(context, summaryById, rightSingle.candidateId, pair.candidateId)];
+		const betterSingle = compareSingleSummaries(context, leftSummary, rightSummary) <= 0 ? leftSummary : rightSummary;
+		const firing = summarizePairEvidence(crossSurfaceRowsFor(context, pair.candidateId), leftComponent.componentId, rightComponent.componentId, "fired");
+		const effect = summarizePairEvidence(crossSurfaceRowsFor(context, pair.candidateId), leftComponent.componentId, rightComponent.componentId, "effectObserved");
+		const compatibility = pairCompatibility(context, pairSummary, baseline, betterSingle, incrementalVsConstituents, interactionReadyIds.has(leftSingle.candidateId) && interactionReadyIds.has(rightSingle.candidateId), interferenceTaskIds, firing, effect);
+		entries.push({
+			componentIds: [leftComponent.componentId, rightComponent.componentId],
+			singleCandidateIds: [leftSingle.candidateId, rightSingle.candidateId],
+			compositionCandidateId: pair.candidateId,
+			benefitTaskIds: [...pairSummary.outcome.benefitTaskIds],
+			regressionTaskIds: [...pairSummary.outcome.regressionTaskIds],
+			synergyTaskIds,
+			interferenceTaskIds,
+			incrementalVsConstituents,
+			relativeCostToBaseline: relativeCosts(context, pairSummary, baseline),
+			firing,
+			effect,
+			interaction: interactionEffect(context, baseline.candidate, [leftSingle, rightSingle], pair),
+			compatibility
+		});
+	}
+	return entries;
+}
+function pairCompatibility(context, pair, baseline, betterSingle, comparisons, constituentsReady, interferenceTaskIds, firing, effect) {
+	const reasons = [];
+	if (!constituentsReady) reasons.push("constituent_not_ready");
+	if (pair.outcome.missingTaskIds.length > 0 || pair.outcome.invalidTaskIds.length > 0 || pair.outcome.comparisonMissingTaskIds.length > 0) reasons.push("pair_incomplete");
+	if (pair.outcome.regressionTaskIds.length > 0) reasons.push("baseline_regression");
+	if (interferenceTaskIds.length > 0) reasons.push("interference");
+	if (comparisons.find((comparison) => comparison.comparatorCandidateId === betterSingle.candidate.candidateId).winsTaskIds.length === 0) reasons.push("no_incremental_resolution");
+	appendPairEvidenceReasons(reasons, firing, context.input.selection.minimumFiringTasks, context.input.selection.requireObservedFiring, "firing_below_minimum", "firing_unobserved");
+	appendPairEvidenceReasons(reasons, effect, context.input.selection.minimumEffectTasks, context.input.selection.requireObservedEffect, "effect_below_minimum", "effect_unobserved");
+	if (!withinCostLimits(context, pair, baseline)) reasons.push("cost_limit_exceeded");
+	return {
+		compatible: reasons.length === 0,
+		reasons: unique(reasons),
+		betterSingleCandidateId: betterSingle.candidate.candidateId
+	};
+}
+function appendPairEvidenceReasons(reasons, evidence, minimum, requireObserved, belowReason, unobservedReason) {
+	const leftObserved = evidence.bothTaskIds.length + evidence.leftOnlyTaskIds.length;
+	const rightObserved = evidence.bothTaskIds.length + evidence.rightOnlyTaskIds.length;
+	if (leftObserved < minimum || rightObserved < minimum) reasons.push(belowReason);
+	if (requireObserved && evidence.unobservedTaskIds.length > 0) reasons.push(unobservedReason);
+}
+function interactionEffect(context, baseline, singles, composition) {
+	const perTask = context.input.taskOrder.map((taskId) => {
+		const baselineRow = crossSurfaceRowFor(context, baseline.candidateId, taskId);
+		const singleRows = singles.map((single) => crossSurfaceRowFor(context, single.candidateId, taskId));
+		const compositionRow = crossSurfaceRowFor(context, composition.candidateId, taskId);
+		if (![
+			baselineRow,
+			...singleRows,
+			compositionRow
+		].every((row) => row.completeness === "complete")) return {
+			taskId,
+			passInteraction: null,
+			scoreInteraction: null
+		};
+		const additivePass = singleRows.reduce((sum, row) => sum + Number(row.pass), 0) - (singles.length - 1) * Number(baselineRow.pass);
+		const additiveScore = singleRows.reduce((sum, row) => sum + row.score, 0) - (singles.length - 1) * baselineRow.score;
+		return {
+			taskId,
+			passInteraction: Number(compositionRow.pass) - additivePass,
+			scoreInteraction: compositionRow.score - additiveScore
+		};
+	});
+	const complete = perTask.filter((row) => row.passInteraction !== null && row.scoreInteraction !== null);
+	const passInteractions = complete.map((row) => row.passInteraction);
+	const scoreInteractions = complete.map((row) => row.scoreInteraction);
+	return {
+		perTask,
+		n: complete.length,
+		nMissing: perTask.length - complete.length,
+		meanPassInteraction: meanOrNull$1(passInteractions),
+		meanScoreInteraction: meanOrNull$1(scoreInteractions),
+		passBootstrap: bootstrapInteraction(passInteractions, context),
+		scoreBootstrap: bootstrapInteraction(scoreInteractions, context)
+	};
+}
+function bootstrapInteraction(interactions, context) {
+	if (interactions.length === 0) return null;
+	return pairedBootstrap(new Array(interactions.length).fill(0), interactions, {
+		...context.input.bootstrap,
+		statistic: "mean"
+	});
+}
+function selectCandidates(context, summaryById, eligibleSingles, interactionReadySingles, pairwise) {
+	const bestSingleRanking = eligibleSingles.filter((summary) => {
+		const componentId = summary.candidate.componentIds[0];
+		return context.componentById.get(componentId).bestSingleEligible;
+	});
+	const ranking = bestSingleRanking.map((summary, index) => ({
+		rank: index + 1,
+		candidateId: summary.candidate.candidateId,
+		componentId: summary.candidate.componentIds[0]
+	}));
+	const best = bestSingleRanking[0];
+	return {
+		bestSingle: best ? {
+			candidateId: best.candidate.candidateId,
+			componentId: best.candidate.componentIds[0],
+			ranking
+		} : null,
+		naiveStack: selectNaiveStack(context, eligibleSingles),
+		interactionAware: selectInteractionAware(context, summaryById, interactionReadySingles, pairwise)
+	};
+}
+function selectNaiveStack(context, eligibleSingles) {
+	if (eligibleSingles.length === 0) return null;
+	const componentIds = eligibleSingles.map((summary) => summary.candidate.componentIds[0]).sort((left, right) => context.componentIndex.get(left) - context.componentIndex.get(right));
+	const candidate = context.candidateByComponents.get(crossSurfaceComponentSetKey(componentIds));
+	if (!candidate) throw new ValidationError(`analyzeCrossSurfaceInteractions: naive stack [${componentIds.join(", ")}] was not evaluated`);
+	return {
+		candidateId: candidate.candidateId,
+		componentIds
+	};
+}
+function selectInteractionAware(context, summaryById, interactionReadySingles, pairwise) {
+	const baseline = summaryById.get(context.input.baselineCandidateId);
+	const pairByComponents = new Map(pairwise.map((entry) => [crossSurfaceComponentSetKey(entry.componentIds), entry]));
+	const paths = pairwise.filter((entry) => entry.compatibility.compatible).map((entry) => growInteractionPath(context, summaryById, interactionReadySingles, pairByComponents, baseline, summaryById.get(entry.compositionCandidateId)));
+	if (paths.length === 0) return null;
+	const qualified = paths.filter((path) => path.qualified).sort((left, right) => compareInteractionPaths(context, summaryById, left, right));
+	const winning = qualified[0] ?? [...paths].sort((left, right) => compareInteractionPaths(context, summaryById, left, right))[0];
+	return {
+		seedCandidateId: winning.seedCandidateId,
+		terminalCandidateId: winning.terminalCandidateId,
+		terminalComponentIds: [...winning.terminalComponentIds],
+		selectedCandidateId: qualified.length > 0 ? winning.terminalCandidateId : null,
+		qualified: qualified.length > 0,
+		evaluatedPaths: paths,
+		steps: winning.steps
+	};
+}
+function growInteractionPath(context, summaryById, interactionReadySingles, pairByComponents, baseline, seed) {
+	let current = seed;
+	let retained = [...seed.candidate.componentIds];
+	let remaining = interactionReadySingles.filter((summary) => !retained.includes(summary.candidate.componentIds[0]));
+	const steps = [];
+	while (remaining.length > 0) {
+		const decisions = remaining.map((addition) => evaluateAddition(context, summaryById, pairByComponents, baseline, current, retained, addition));
+		const selected = decisions.filter((decision) => decision.eligible).sort((left, right) => compareAdditionDecisions(context, summaryById, left, right))[0];
+		if (selected) selected.selected = true;
+		steps.push({
+			fromCandidateId: current.candidate.candidateId,
+			retainedComponentIds: [...retained],
+			considered: decisions.sort((left, right) => context.candidateIndex.get(left.additionCandidateId) - context.candidateIndex.get(right.additionCandidateId)),
+			selectedCandidateId: selected?.bundleCandidateId ?? null
+		});
+		if (!selected?.bundleCandidateId) break;
+		current = summaryById.get(selected.bundleCandidateId);
+		retained = [...current.candidate.componentIds];
+		remaining = remaining.filter((summary) => summary.candidate.candidateId !== selected.additionCandidateId);
+	}
+	const qualified = retained.length >= context.input.selection.minimumBundleComponents;
+	return {
+		seedCandidateId: seed.candidate.candidateId,
+		terminalCandidateId: current.candidate.candidateId,
+		terminalComponentIds: retained,
+		qualified,
+		steps
+	};
+}
+function compareInteractionPaths(context, summaryById, left, right) {
+	const leftSummary = summaryById.get(left.terminalCandidateId);
+	const rightSummary = summaryById.get(right.terminalCandidateId);
+	const byNetBenefit = rightSummary.outcome.netBenefit - leftSummary.outcome.netBenefit;
+	if (byNetBenefit !== 0) return byNetBenefit;
+	const byBenefit = rightSummary.outcome.benefitTaskIds.length - leftSummary.outcome.benefitTaskIds.length;
+	if (byBenefit !== 0) return byBenefit;
+	const byRegression = leftSummary.outcome.regressionTaskIds.length - rightSummary.outcome.regressionTaskIds.length;
+	if (byRegression !== 0) return byRegression;
+	for (const metric of context.input.costMetricOrder) {
+		const byCost = leftSummary.costs[metric].median - rightSummary.costs[metric].median;
+		if (byCost !== 0) return byCost;
+	}
+	const byBytes = leftSummary.candidate.artifactBytes - rightSummary.candidate.artifactBytes;
+	if (byBytes !== 0) return byBytes;
+	const byCandidateOrder = context.candidateIndex.get(left.terminalCandidateId) - context.candidateIndex.get(right.terminalCandidateId);
+	if (byCandidateOrder !== 0) return byCandidateOrder;
+	return context.candidateIndex.get(left.seedCandidateId) - context.candidateIndex.get(right.seedCandidateId);
+}
+function evaluateAddition(context, summaryById, pairByComponents, baseline, current, retained, addition) {
+	const additionComponentId = addition.candidate.componentIds[0];
+	const reasons = [];
+	for (const retainedComponentId of retained) if (!pairByComponents.get(crossSurfaceComponentSetKey(canonicalCrossSurfaceComponents(context, [retainedComponentId, additionComponentId])))?.compatibility.compatible) reasons.push("pair_incompatible");
+	const bundleComponents = canonicalCrossSurfaceComponents(context, [...retained, additionComponentId]);
+	const bundle = context.candidateByComponents.get(crossSurfaceComponentSetKey(bundleComponents));
+	if (!bundle) {
+		reasons.push("full_bundle_not_evaluated");
+		return emptyAdditionDecision(addition, additionComponentId, reasons);
+	}
+	const bundleSummary = summaryById.get(bundle.candidateId);
+	if (bundleSummary.outcome.missingTaskIds.length > 0 || bundleSummary.outcome.invalidTaskIds.length > 0 || bundleSummary.outcome.comparisonMissingTaskIds.length > 0) reasons.push("bundle_incomplete");
+	if (bundleSummary.outcome.regressionTaskIds.length > 0) reasons.push("baseline_regression");
+	const comparison = compareCandidates(context, summaryById, current.candidate.candidateId, bundle.candidateId);
+	if (comparison.winsTaskIds.length === 0) reasons.push("no_incremental_resolution");
+	if (comparison.regressionTaskIds.length > 0) reasons.push("incremental_regression");
+	appendBundleEvidenceReasons(reasons, bundleSummary.firing, context.input.selection.minimumFiringTasks, context.input.selection.requireObservedFiring, "firing_below_minimum", "firing_unobserved");
+	appendBundleEvidenceReasons(reasons, bundleSummary.effect, context.input.selection.minimumEffectTasks, context.input.selection.requireObservedEffect, "effect_below_minimum", "effect_unobserved");
+	if (!withinCostLimits(context, bundleSummary, baseline)) reasons.push("cost_limit_exceeded");
+	return {
+		additionCandidateId: addition.candidate.candidateId,
+		additionComponentId,
+		bundleCandidateId: bundle.candidateId,
+		incrementalResolutionTaskIds: comparison.winsTaskIds,
+		incrementalRegressionTaskIds: comparison.regressionTaskIds,
+		incrementalMedianCost: Object.fromEntries(context.input.costMetricOrder.map((metric) => [metric, bundleSummary.costs[metric].median - current.costs[metric].median])),
+		eligible: reasons.length === 0,
+		selected: false,
+		reasons: unique(reasons)
+	};
+}
+function emptyAdditionDecision(addition, additionComponentId, reasons) {
+	return {
+		additionCandidateId: addition.candidate.candidateId,
+		additionComponentId,
+		bundleCandidateId: null,
+		incrementalResolutionTaskIds: [],
+		incrementalRegressionTaskIds: [],
+		incrementalMedianCost: null,
+		eligible: false,
+		selected: false,
+		reasons: unique(reasons)
+	};
+}
+function appendBundleEvidenceReasons(reasons, evidence, minimum, requireObserved, belowReason, unobservedReason) {
+	if (evidence.byComponent.some((component) => component.observedTaskIds.length < minimum)) reasons.push(belowReason);
+	if (requireObserved && evidence.byComponent.some((component) => component.unobservedTaskIds.length > 0)) reasons.push(unobservedReason);
+}
+function compareAdditionDecisions(context, summaryById, left, right) {
+	const byWins = right.incrementalResolutionTaskIds.length - left.incrementalResolutionTaskIds.length;
+	if (byWins !== 0) return byWins;
+	for (const metric of context.input.costMetricOrder) {
+		const byCost = left.incrementalMedianCost[metric] - right.incrementalMedianCost[metric];
+		if (byCost !== 0) return byCost;
+	}
+	const byBytes = summaryById.get(left.additionCandidateId).candidate.artifactBytes - summaryById.get(right.additionCandidateId).candidate.artifactBytes;
+	if (byBytes !== 0) return byBytes;
+	return context.candidateIndex.get(left.additionCandidateId) - context.candidateIndex.get(right.additionCandidateId);
+}
+function compareCandidates(context, summaryById, comparatorCandidateId, treatmentCandidateId) {
+	const winsTaskIds = [];
+	const regressionTaskIds = [];
+	const missingTaskIds = [];
+	for (const taskId of context.input.taskOrder) {
+		const comparator = crossSurfaceRowFor(context, comparatorCandidateId, taskId);
+		const treatment = crossSurfaceRowFor(context, treatmentCandidateId, taskId);
+		if (comparator.completeness !== "complete" || treatment.completeness !== "complete") missingTaskIds.push(taskId);
+		else if (treatment.pass && !comparator.pass) winsTaskIds.push(taskId);
+		else if (!treatment.pass && comparator.pass) regressionTaskIds.push(taskId);
+	}
+	return {
+		comparatorCandidateId,
+		treatmentCandidateId,
+		winsTaskIds,
+		regressionTaskIds,
+		missingTaskIds,
+		paired: pairedComparison(context, comparatorCandidateId, treatmentCandidateId),
+		relativeCost: relativeCosts(context, summaryById.get(treatmentCandidateId), summaryById.get(comparatorCandidateId))
+	};
+}
+function pairedComparison(context, comparatorCandidateId, treatmentCandidateId) {
+	const rows = [];
+	for (const taskId of context.input.taskOrder) {
+		rows.push(toPairedArmRow(context, crossSurfaceRowFor(context, comparatorCandidateId, taskId)));
+		rows.push(toPairedArmRow(context, crossSurfaceRowFor(context, treatmentCandidateId, taskId)));
+	}
+	return comparePairedArms(rows, {
+		baselineArm: comparatorCandidateId,
+		treatmentArm: treatmentCandidateId,
+		metricNames: ["score", ...context.input.costMetricOrder],
+		bootstrap: {
+			...context.input.bootstrap,
+			statistic: "mean"
+		}
+	});
+}
+function toPairedArmRow(context, row) {
+	const metrics = Object.fromEntries(context.input.costMetricOrder.map((metric) => [metric, row.cost[metric]]));
+	if (row.completeness === "complete") metrics.score = row.score;
+	return {
+		pairKey: row.taskId,
+		arm: row.candidateId,
+		...row.completeness === "complete" ? { pass: row.pass } : {},
+		metrics
+	};
+}
+function summarizePairEvidence(rows, leftComponentId, rightComponentId, field) {
+	const bothTaskIds = [];
+	const leftOnlyTaskIds = [];
+	const rightOnlyTaskIds = [];
+	const neitherTaskIds = [];
+	const unobservedTaskIds = [];
+	for (const row of rows) {
+		const left = evidenceValue(row, leftComponentId, field);
+		const right = evidenceValue(row, rightComponentId, field);
+		if (left === null || right === null) unobservedTaskIds.push(row.taskId);
+		else if (left && right) bothTaskIds.push(row.taskId);
+		else if (left) leftOnlyTaskIds.push(row.taskId);
+		else if (right) rightOnlyTaskIds.push(row.taskId);
+		else neitherTaskIds.push(row.taskId);
+	}
+	return {
+		bothTaskIds,
+		leftOnlyTaskIds,
+		rightOnlyTaskIds,
+		neitherTaskIds,
+		unobservedTaskIds
+	};
+}
+function relativeCosts(context, treatment, comparator) {
+	return Object.fromEntries(context.input.costMetricOrder.map((metric) => {
+		const treatmentMedian = treatment.costs[metric].median;
+		const comparatorMedian = comparator.costs[metric].median;
+		return [metric, {
+			treatmentMedian,
+			comparatorMedian,
+			medianDelta: treatmentMedian - comparatorMedian,
+			medianRatio: comparatorMedian === 0 ? treatmentMedian === 0 ? 1 : null : treatmentMedian / comparatorMedian
+		}];
+	}));
+}
+function withinCostLimits(context, treatment, baseline) {
+	const relative = relativeCosts(context, treatment, baseline);
+	return Object.entries(context.input.selection.maximumMedianCostRatioToBaseline).every(([metric, limit]) => {
+		const ratio = relative[metric].medianRatio;
+		return ratio !== null && ratio <= limit;
+	});
+}
+function distribution(values) {
+	const sorted = [...values].sort((left, right) => left - right);
+	const total = sorted.reduce((sum, value) => sum + value, 0);
+	const middle = Math.floor(sorted.length / 2);
+	const median = sorted.length % 2 === 1 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2;
+	return {
+		n: sorted.length,
+		min: sorted[0],
+		median,
+		mean: total / sorted.length,
+		max: sorted[sorted.length - 1],
+		total
+	};
+}
+function evidenceValue(row, componentId, field) {
+	return row.componentEvidence.find((evidence) => evidence.componentId === componentId)[field];
+}
+function meanOrNull$1(values) {
+	return values.length === 0 ? null : values.reduce((sum, value) => sum + value, 0) / values.length;
+}
+function unique(values) {
+	return [...new Set(values)];
+}
+//#endregion
+//#region src/campaign/fixtures.ts
+/** Walk `evalsDir` and return the relative name of every fixture directory (one containing an exact-case `PROMPT.md`). */
+function discoverEvalFixtures(evalsDir) {
+	const root = resolve(evalsDir);
+	if (!existsSync(root)) throw new Error(`discoverEvalFixtures: evalsDir not found: ${root}`);
+	const fixtures = [];
+	const walk = (dir, base = "") => {
+		for (const entry of readdirSync(dir).sort()) {
+			if (entry.startsWith(".") || entry === "node_modules") continue;
+			const fullPath = join(dir, entry);
+			if (!statSync(fullPath).isDirectory()) continue;
+			const name = base ? `${base}/${entry}` : entry;
+			if (existsWithExactCase(fullPath, "PROMPT.md")) fixtures.push(name);
+			else walk(fullPath, name);
+		}
+	};
+	walk(root);
+	return fixtures;
+}
+/**
+* Load ONE fixture by name: reads `PROMPT.md` (plus `EVAL.ts`/`EVAL.tsx` and `package.json` under
+* `vitest` validation) and content-fingerprints the full file set for cache identity.
+*/
+function loadEvalFixture(evalsDir, name, options = {}) {
+	const validation = options.validation ?? "vitest";
+	const root = resolve(evalsDir);
+	const fixturePath = resolve(root, name);
+	assertInside(root, fixturePath, name);
+	if (!existsSync(fixturePath) || !statSync(fixturePath).isDirectory()) throw new Error(`loadEvalFixture: fixture not found: ${name}`);
+	if (!existsWithExactCase(fixturePath, "PROMPT.md")) throw new Error(`loadEvalFixture: ${name} is missing exact-case PROMPT.md`);
+	const promptPath = join(fixturePath, "PROMPT.md");
+	const evalPath = resolveEvalPath(fixturePath);
+	const packageJsonPath = existsWithExactCase(fixturePath, "package.json") ? join(fixturePath, "package.json") : void 0;
+	if (validation !== "none") {
+		if (!evalPath) throw new Error(`loadEvalFixture: ${name} is missing exact-case EVAL.ts or EVAL.tsx`);
+		if (!packageJsonPath) throw new Error(`loadEvalFixture: ${name} is missing exact-case package.json`);
+		assertModulePackage(packageJsonPath, name);
+	}
+	const files = collectFixtureFiles(fixturePath);
+	return {
+		name,
+		path: fixturePath,
+		promptPath,
+		evalPath,
+		packageJsonPath,
+		prompt: readFileSync(promptPath, "utf8"),
+		files,
+		fingerprint: contentHash({
+			files,
+			config: options.fingerprintConfig ?? null
+		})
+	};
+}
+/** Load fixtures (all discovered, or just `names`) as campaign `Scenario`s tagged `eval-fixture`. */
+function loadEvalFixtureScenarios(evalsDir, options = {}) {
+	return (options.names ?? discoverEvalFixtures(evalsDir)).map((name) => {
+		const fixture = loadEvalFixture(evalsDir, name, options);
+		return {
+			id: fixture.name,
+			kind: "eval-fixture",
+			tags: ["eval-fixture"],
+			fixtureName: fixture.name,
+			fixturePath: fixture.path,
+			promptPath: fixture.promptPath,
+			evalPath: fixture.evalPath,
+			packageJsonPath: fixture.packageJsonPath,
+			prompt: fixture.prompt,
+			fingerprint: fixture.fingerprint
+		};
+	});
+}
+/**
+* Dry-run planner for a fixture campaign: loads the scenarios, delegates to `planCampaignRun`,
+* and returns the plan plus each fixture's name/path/fingerprint.
+*/
+function planEvalFixtureRun(options) {
+	const scenarios = loadEvalFixtureScenarios(options.evalsDir, {
+		names: options.names,
+		validation: options.validation,
+		fingerprintConfig: options.fingerprintConfig
+	});
+	return {
+		...planCampaignRun({
+			scenarios,
+			dispatchRef: options.dispatchRef ?? "eval-fixture-dispatch",
+			judges: options.judges,
+			seed: options.seed,
+			reps: options.reps,
+			resumable: options.resumable,
+			runDir: options.runDir,
+			storage: options.storage
+		}),
+		fixtures: scenarios.map((scenario) => ({
+			fixtureName: scenario.fixtureName,
+			fixturePath: scenario.fixturePath,
+			fingerprint: scenario.fingerprint
+		}))
+	};
+}
+function existsWithExactCase(dirPath, fileName) {
+	try {
+		return readdirSync(dirPath).includes(fileName);
+	} catch {
+		return false;
+	}
+}
+function resolveEvalPath(fixturePath) {
+	if (existsWithExactCase(fixturePath, "EVAL.ts")) return join(fixturePath, "EVAL.ts");
+	if (existsWithExactCase(fixturePath, "EVAL.tsx")) return join(fixturePath, "EVAL.tsx");
+}
+function assertModulePackage(packageJsonPath, name) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+	} catch (err) {
+		throw new Error(`loadEvalFixture: ${name} package.json is invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || parsed.type !== "module") throw new Error(`loadEvalFixture: ${name} package.json must set "type": "module"`);
+}
+function collectFixtureFiles(fixturePath, base = "") {
+	const files = [];
+	for (const entry of readdirSync(join(fixturePath, base)).sort()) {
+		if (entry === "node_modules" || entry === ".git") continue;
+		const relativePath = base ? `${base}/${entry}` : entry;
+		const fullPath = join(fixturePath, relativePath);
+		if (statSync(fullPath).isDirectory()) {
+			files.push(...collectFixtureFiles(fixturePath, relativePath));
+			continue;
+		}
+		const bytes = readFileSync(fullPath);
+		files.push({
+			path: relativePath,
+			sha256: createHash("sha256").update(bytes).digest("hex"),
+			bytes: bytes.byteLength
+		});
+	}
+	return files;
+}
+function assertInside(root, target, label) {
+	const rel = relative(root, target);
+	if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return;
+	throw new Error(`loadEvalFixture: fixture path escapes evalsDir: ${label}`);
+}
+//#endregion
+//#region src/campaign/gates/neutralization-gate.ts
+/** Mean of a numeric array; 0 for an empty array (callers guard n separately). */
+function mean$1(xs) {
+	return xs.length === 0 ? 0 : xs.reduce((a, b) => a + b, 0) / xs.length;
+}
+/** Paired mean held-out lift of `arm` over baseline, on the in-scope cells. */
+function pairedLift(arm, baseline, scenarioIds) {
+	const paired = pairHoldout(arm, baseline, scenarioIds, (s) => s.composite);
+	const deltas = paired.after.map((a, i) => a - (paired.before[i] ?? 0));
+	return {
+		lift: mean$1(deltas),
+		n: deltas.length
+	};
+}
+/**
+* Composable placebo gate: ships only when the candidate's held-out lift is NOT
+* mostly reproduced by a footprint-matched neutralized variant.
+*/
+function neutralizationGate(options) {
+	const maxDecorativeFraction = options.maxDecorativeFraction ?? .5;
+	return {
+		name: "neutralizationGate",
+		async decide(ctx) {
+			if (!ctx.baselineJudgeScores) throw new Error("neutralizationGate: ctx.baselineJudgeScores is required — the placebo control measures lift OVER baseline.");
+			if (!ctx.neutralizedJudgeScores) throw new Error("neutralizationGate: ctx.neutralizedJudgeScores is required. It is populated by runImprovementLoop only when a `neutralize` function is supplied — composing this gate without that wiring would pass an unproven candidate.");
+			const scenarioIds = new Set(options.scenarios.map((s) => s.id));
+			const cand = pairedLift(ctx.judgeScores, ctx.baselineJudgeScores, scenarioIds);
+			const neut = pairedLift(ctx.neutralizedJudgeScores, ctx.baselineJudgeScores, scenarioIds);
+			if (cand.lift <= 0) return {
+				decision: "hold",
+				reasons: [`neutralization: candidate held-out lift ${cand.lift.toFixed(3)} ≤ 0 — no positive lift to attribute to content`],
+				contributingGates: [{
+					name: "neutralizationGate",
+					status: "fail",
+					detail: {
+						candidateLift: cand.lift,
+						neutralizedLift: neut.lift,
+						n: cand.n
+					}
+				}],
+				delta: cand.lift
+			};
+			const decorativeFraction = neut.lift / cand.lift;
+			const passed = decorativeFraction < maxDecorativeFraction;
+			const pct = (decorativeFraction * 100).toFixed(0);
+			return {
+				decision: passed ? "ship" : "hold",
+				reasons: passed ? [`neutralization: content is causal — blanked variant reproduces ${pct}% of the lift (< ${(maxDecorativeFraction * 100).toFixed(0)}%); candidate Δ ${cand.lift.toFixed(3)}, neutralized Δ ${neut.lift.toFixed(3)}`] : [`neutralization: lift is DECORATIVE — blanking the content (footprint-matched) reproduces ${pct}% of the lift (≥ ${(maxDecorativeFraction * 100).toFixed(0)}%); candidate Δ ${cand.lift.toFixed(3)}, neutralized Δ ${neut.lift.toFixed(3)}`],
+				contributingGates: [{
+					name: "neutralizationGate",
+					status: passed ? "pass" : "fail",
+					detail: {
+						candidateLift: cand.lift,
+						neutralizedLift: neut.lift,
+						decorativeFraction,
+						maxDecorativeFraction,
+						n: cand.n
+					}
+				}],
+				delta: cand.lift
+			};
+		}
+	};
+}
+//#endregion
+//#region src/campaign/gates/sequential.ts
+/**
+* Anytime-valid sequential promotion gate — an e-process (betting
+* test-martingale, see `eProcess` in `statistics.ts`) over paired
+* per-scenario deltas, so a campaign stops the MOMENT evidence decides
+* instead of burning a fixed-n budget. Decisions remain valid at any
+* data-dependent stopping time (Ville's inequality), which is exactly what
+* fixed-n machinery cannot offer: peeking at a bootstrap CI after every
+* observation and stopping on the first significant peek inflates type-I
+* error far beyond alpha.
+*
+* REPLACES, never layers on, a fixed-n gate. Running `heldoutSignificance`
+* or `paretoSignificanceGate` repeatedly on a growing sample and stopping
+* early is optional stopping no matter how it is dressed up; this gate is
+* the valid way to stop early. Use one or the other per evidence stream.
+*
+* Pre-registration binding: anytime validity holds only for the
+* PRE-REGISTERED statistic. When a `SignedManifest` is bound, the gate takes
+* alpha from `manifest.alpha`, the observation budget from
+* `manifest.preRegisteredN`, orients deltas by `manifest.direction`, and
+* shifts the null boundary by `manifest.minEffect` — re-deciding the same
+* stream under different parameters after seeing data would reopen optional
+* stopping under a fancier name. The manifest's content hash is verified at
+* construction (sync, same `sha256-content` scheme as `signManifest`).
+*
+* Non-iid caveat (stated honestly): the supermartingale guarantee needs each
+* delta's conditional mean under H0 to stay ≤ the null boundary given the
+* past — exchangeable scenario deltas suffice. Scenario streams ordered by
+* difficulty or by scenario family violate this; `decide(ctx)` therefore
+* shuffles the paired deltas with a SEEDED permutation by default (the
+* permutation is data-independent, so bet predictability is preserved).
+* Stratified betting (per-stratum λ) is future work, not implemented here.
+*/
+/** Sync twin of `verifyManifest` — same `sha256-content` scheme
+*  (sha256 over the canonicalized manifest minus contentHash/algo), via
+*  node:crypto so gate construction can stay synchronous and fail loud
+*  before any observation is consumed. */
+function verifyManifestSync(m) {
+	if (m.algo !== void 0 && m.algo !== "sha256-content") throw new Error(`sequentialPairedGate: unrecognized manifest hash algo '${m.algo}'`);
+	const { contentHash, algo: _algo, ...rest } = m;
+	const bytes = JSON.stringify(canonicalize(rest));
+	return createHash("sha256").update(bytes, "utf8").digest("hex") === contentHash;
+}
+function resolveConfig(opts) {
+	const m = opts.preRegistration;
+	let alpha;
+	let maxN;
+	let direction;
+	let minEffect;
+	if (m) {
+		if (!verifyManifestSync(m)) throw new Error(`sequentialPairedGate: pre-registration manifest '${m.id}' content hash mismatch (tampered)`);
+		if (opts.alpha !== void 0 && opts.alpha !== m.alpha) throw new Error(`sequentialPairedGate: alpha ${opts.alpha} conflicts with pre-registered alpha ${m.alpha} — the registered statistic is the only one anytime validity covers`);
+		if (opts.maxN !== void 0 && opts.maxN !== m.preRegisteredN) throw new Error(`sequentialPairedGate: maxN ${opts.maxN} conflicts with pre-registered N ${m.preRegisteredN}`);
+		alpha = m.alpha;
+		maxN = m.preRegisteredN;
+		direction = m.direction;
+		minEffect = m.minEffect;
+	} else {
+		alpha = opts.alpha ?? .05;
+		if (opts.maxN === void 0) throw new Error("sequentialPairedGate: maxN is required (or bind a preRegistration manifest whose preRegisteredN is the budget) — an unbounded stream has no pre-registered budget");
+		maxN = opts.maxN;
+		direction = "increase";
+		minEffect = 0;
+	}
+	const scale = opts.scale ?? 1;
+	if (!Number.isFinite(scale) || scale <= 0) throw new Error(`sequentialPairedGate: scale must be > 0, got ${scale}`);
+	if (!Number.isInteger(maxN) || maxN < 1) throw new Error(`sequentialPairedGate: maxN must be a positive integer, got ${maxN}`);
+	const minN = opts.minN ?? 5;
+	if (!Number.isInteger(minN) || minN < 1 || minN > maxN) throw new Error(`sequentialPairedGate: minN must be an integer in [1, maxN=${maxN}], got ${minN}`);
+	if (!Number.isFinite(minEffect) || minEffect < 0 || minEffect >= scale) throw new Error(`sequentialPairedGate: minEffect must be in [0, scale=${scale}), got ${minEffect}`);
+	const nullMean = .5 + minEffect / (2 * scale);
+	return {
+		alpha,
+		minN,
+		maxN,
+		maxBet: opts.maxBet ?? .5,
+		scale,
+		shuffleSeed: opts.shuffleSeed ?? 1337,
+		direction,
+		nullMean,
+		minEffect
+	};
+}
+function makeStream(cfg) {
+	const proc = eProcess({
+		alpha: cfg.alpha,
+		maxBet: cfg.maxBet,
+		nullMean: cfg.nullMean
+	});
+	const threshold = 1 / cfg.alpha;
+	let terminal;
+	return {
+		observe(delta) {
+			if (terminal === "undecided-at-maxN") throw new Error(`sequentialPairedGate: pre-registered maxN=${cfg.maxN} exhausted — extending the stream after seeing the result reopens optional stopping; start a NEW pre-registered test`);
+			if (!Number.isFinite(delta) || Math.abs(delta) > cfg.scale) throw new Error(`sequentialPairedGate: delta ${delta} outside ±scale=${cfg.scale} — pass the judge's native scale explicitly (detectScale helps pick 1 vs 100)`);
+			const d = cfg.direction === "decrease" ? -delta : delta;
+			const step = proc.update((d / cfg.scale + 1) / 2);
+			if (terminal === void 0 && step.n >= cfg.minN && step.wealth >= threshold) terminal = "promote";
+			if (terminal === "promote") return {
+				decision: "promote",
+				eValue: step.wealth,
+				n: step.n,
+				reason: `e-value ${step.wealth.toFixed(2)} ≥ 1/α=${threshold.toFixed(2)} at n=${step.n} (minN=${cfg.minN}): the paired improvement exceeds ${cfg.minEffect} at anytime-valid level α=${cfg.alpha}`
+			};
+			if (step.n >= cfg.maxN) {
+				terminal = "undecided-at-maxN";
+				return {
+					decision: "undecided-at-maxN",
+					eValue: step.wealth,
+					n: step.n,
+					reason: `undecided at pre-registered maxN=${cfg.maxN} (e-value ${step.wealth.toFixed(2)} < 1/α=${threshold.toFixed(2)}). This is NOT evidence of no effect — the effect may be real but smaller than this budget can detect; re-register with a larger N to test that`
+				};
+			}
+			return {
+				decision: "continue",
+				eValue: step.wealth,
+				n: step.n,
+				reason: `e-value ${step.wealth.toFixed(2)} < 1/α=${threshold.toFixed(2)} at n=${step.n}/${cfg.maxN} — keep observing`
+			};
+		},
+		state() {
+			return {
+				...proc.state(),
+				decision: terminal ?? "continue"
+			};
+		}
+	};
+}
+/** Data-independent in-place Fisher–Yates with a seeded PRNG — the permutation
+*  depends only on the seed, never the values, so bet predictability survives. */
+function seededShuffle(items, seed) {
+	const rng = mulberry32(seed);
+	for (let i = items.length - 1; i > 0; i--) {
+		const j = Math.floor(rng() * (i + 1));
+		const tmp = items[i];
+		items[i] = items[j];
+		items[j] = tmp;
+	}
+	return items;
+}
+/**
+* Anytime-valid sequential paired gate. Conforms to the existing `Gate`
+* contract (`decide(ctx)` consumes candidate vs baseline judge scores via
+* `pairHoldout` — same pairing granularity as the fixed-n gates: full cellId,
+* never scenarioId) and adds a streaming `observe(delta)` entry for campaigns
+* that score cells incrementally and want to stop mid-stream.
+*
+* Decision mapping onto the substrate's five-valued `GateDecision`:
+*   - 'promote'            → 'ship'
+*   - 'continue'           → 'need_more_work' (stream ended before maxN with
+*                            the e-value undecided — more reps could decide)
+*   - 'undecided-at-maxN'  → 'hold', with the reason stating it is NOT
+*                            evidence of no effect (never a silent default)
+*/
+function sequentialPairedGate(options) {
+	const cfg = resolveConfig(options);
+	const name = options.name ?? "sequentialPairedGate";
+	const manifest = options.preRegistration;
+	const observeStream = makeStream(cfg);
+	return {
+		name,
+		observe(delta) {
+			return observeStream.observe(delta);
+		},
+		state() {
+			return observeStream.state();
+		},
+		async decide(ctx) {
+			if (!ctx.baselineJudgeScores) throw new Error(`${name}: ctx.baselineJudgeScores is required — falling back to the candidate's own scores would compare the candidate against itself (delta 0, silent no-op)`);
+			const scenarioIds = new Set(ctx.scenarios.map((s) => s.id));
+			const paired = pairHoldout(ctx.judgeScores, ctx.baselineJudgeScores, scenarioIds, (s) => s.composite);
+			const deltas = paired.after.map((a, i) => a - paired.before[i]);
+			seededShuffle(deltas, cfg.shuffleSeed);
+			const stream = makeStream(cfg);
+			let last;
+			for (const d of deltas) {
+				last = stream.observe(d);
+				if (last.decision !== "continue") break;
+			}
+			const detail = {
+				...stream.state(),
+				minN: cfg.minN,
+				maxN: cfg.maxN,
+				scale: cfg.scale,
+				shuffleSeed: cfg.shuffleSeed,
+				direction: cfg.direction,
+				minEffect: cfg.minEffect,
+				pairedN: deltas.length,
+				...manifest ? {
+					preRegisteredId: manifest.id,
+					metric: manifest.metric
+				} : {}
+			};
+			const meanDelta = deltas.length === 0 ? void 0 : deltas.reduce((s, d) => s + d, 0) / deltas.length;
+			if (last === void 0) return {
+				decision: "need_more_work",
+				reasons: [`${name}: no paired holdout observations — nothing to test`],
+				contributingGates: [{
+					name,
+					status: "not_evaluated",
+					detail
+				}]
+			};
+			const decision = last.decision === "promote" ? "ship" : last.decision === "continue" ? "need_more_work" : "hold";
+			return {
+				decision,
+				reasons: [`${name}: ${last.reason}`],
+				contributingGates: [{
+					name,
+					status: decision === "ship" ? "pass" : decision === "need_more_work" ? "not_evaluated" : "fail",
+					detail
+				}],
+				delta: meanDelta
+			};
+		}
+	};
+}
+/**
+* `SurfaceProposer.decide` adapter — stops the optimization loop the moment
+* the e-process decides the loop has produced a real improvement, instead of
+* always running `maxGenerations`.
+*
+* Stream: for each generation g ≥ 1, the per-scenario composite deltas of
+* generation g's top candidate vs the generation-0 top candidate (the
+* incumbent the loop set out to beat), paired by scenarioId. H0: no proposed
+* surface improves any scenario's expected composite over the incumbent —
+* under it every delta has conditional mean ≤ 0 and the e-process is valid.
+* Once wealth ≥ 1/alpha the loop stops and hands the winner to the promotion
+* gate (which re-scores on HELD-OUT data — this adapter only spends the
+* exploration budget, it never promotes).
+*
+* Honesty caveats: (1) the incumbent's scores are measured once and shared
+* across all generations' deltas, so type-I control is exact only insofar as
+* those scores approximate the incumbent's true per-scenario means (more reps
+* → tighter); (2) an UNDECIDED process never stops the loop — absence of a
+* crossing is NOT evidence of no effect, so the loop simply runs its normal
+* course. Calling the adapter repeatedly with a growing history consumes each
+* generation exactly once (re-feeding an already-seen record would double-count
+* evidence).
+*/
+function sequentialDecide(options = {}) {
+	const alpha = options.alpha ?? .05;
+	const minN = options.minN ?? 5;
+	const scale = options.scale ?? 1;
+	if (!Number.isFinite(scale) || scale <= 0) throw new Error(`sequentialDecide: scale must be > 0, got ${scale}`);
+	const proc = eProcess({
+		alpha,
+		maxBet: options.maxBet ?? .5,
+		nullMean: .5
+	});
+	const threshold = 1 / alpha;
+	let processedGenerations = 0;
+	let reference;
+	let stopped;
+	const topCandidate = (record) => {
+		if (record.candidates.length === 0) throw new Error(`sequentialDecide: generation ${record.generationIndex} has no candidates — cannot extract a top candidate`);
+		return record.candidates.reduce((best, candidate) => {
+			if (best.composite === null) return candidate;
+			if (candidate.composite === null) return best;
+			return candidate.composite > best.composite ? candidate : best;
+		});
+	};
+	const decide = ({ history }) => {
+		if (stopped) return stopped;
+		if (history.length === 0) return { stop: false };
+		if (reference === void 0) reference = new Map(topCandidate(history[0]).scenarios.map((s) => [s.scenarioId, s.composite]));
+		for (let g = Math.max(1, processedGenerations); g < history.length; g++) {
+			const top = topCandidate(history[g]);
+			const byScenario = new Map(top.scenarios.map((s) => [s.scenarioId, s.composite]));
+			for (const [scenarioId, refComposite] of reference) {
+				const candComposite = byScenario.get(scenarioId);
+				if (candComposite === void 0) throw new Error(`sequentialDecide: generation ${history[g].generationIndex} top candidate is missing scenario '${scenarioId}' — generations must score the same scenario set to pair`);
+				const delta = candComposite - refComposite;
+				if (!Number.isFinite(delta) || Math.abs(delta) > scale) throw new Error(`sequentialDecide: paired delta ${delta} outside ±scale=${scale} on scenario '${scenarioId}' — pass the composite scale explicitly`);
+				const step = proc.update((delta / scale + 1) / 2);
+				if (step.n >= minN && step.wealth >= threshold) {
+					stopped = {
+						stop: true,
+						reason: `sequential e-process decided at generation ${history[g].generationIndex}: e-value ${step.wealth.toFixed(2)} ≥ 1/α=${threshold.toFixed(2)} after n=${step.n} paired deltas vs the generation-0 incumbent — the improvement is real at α=${alpha}; stop exploring and promote via the gate`
+					};
+					processedGenerations = history.length;
+					return stopped;
+				}
+			}
+		}
+		processedGenerations = history.length;
+		return { stop: false };
+	};
+	decide.state = () => proc.state();
+	return decide;
+}
+//#endregion
+//#region src/campaign/grounded-reflection.ts
+/**
+* Deterministic per-field diff of call arguments between passing and failing
+* rollouts. A field set by failing rollouts but left unset by passing ones is
+* the classic poison-input signature; a field whose values differ across the
+* split points at the correct value. Feed `text` to the reviser verbatim.
+*/
+function rolloutArgumentDiff(rollouts, opts = {}) {
+	const passThreshold = opts.passThreshold ?? 1;
+	const maxValues = opts.maxValuesPerField ?? 4;
+	const collect = (pass) => {
+		const byField = /* @__PURE__ */ new Map();
+		for (const r of rollouts) {
+			if (pass !== r.score >= passThreshold) continue;
+			for (const c of r.calls) for (const [k, v] of Object.entries(c.args)) {
+				const set = byField.get(k) ?? /* @__PURE__ */ new Set();
+				set.add(String(v));
+				byField.set(k, set);
+			}
+		}
+		return byField;
+	};
+	const passing = collect(true);
+	const failing = collect(false);
+	const lines = [];
+	for (const field of /* @__PURE__ */ new Set([...passing.keys(), ...failing.keys()])) {
+		const pv = [...passing.get(field) ?? []].slice(0, maxValues);
+		const fv = [...failing.get(field) ?? []].slice(0, maxValues);
+		const render = (vals) => vals.length ? JSON.stringify(vals) : "NOT SET (omitted)";
+		lines.push(`  ${field}: passing runs -> ${render(pv)} | failing runs -> ${render(fv)}`);
+	}
+	const lower = (m) => {
+		const out = /* @__PURE__ */ new Set();
+		for (const vals of m.values()) for (const v of vals) out.add(v.toLowerCase());
+		return out;
+	};
+	return {
+		text: lines.join("\n") || "  (no calls observed)",
+		passingValues: lower(passing),
+		failingValues: lower(failing)
+	};
+}
+/**
+* Scan revised artifact text for single-quoted single-word literals (the
+* "use exactly 'new'" pattern) that appear in no passing rollout's argument
+* values. Multi-word quotes pass (they are prose, not prescriptions).
+* Callers should reject on `harmful` (with a bounded retry) and at most log
+* `ungrounded` - see the module header for why the severities differ.
+*/
+function classifyUngroundedLiterals(text, diff) {
+	const ungrounded = /* @__PURE__ */ new Set();
+	for (const m of text.matchAll(/'([a-z][a-z_-]{1,19})'/gi)) {
+		const w = m[1].toLowerCase();
+		if (!diff.passingValues.has(w)) ungrounded.add(w);
+	}
+	const all = [...ungrounded];
+	return {
+		ungrounded: all,
+		harmful: all.filter((w) => diff.failingValues.has(w))
+	};
+}
+//#endregion
+//#region src/campaign/labeled-store/fs-adapter.ts
+/**
+* Filesystem `LabeledScenarioStore` adapter. The default capture sink for
+* traces + eval artifacts. Production deployments typically swap for a
+* Turso/SQLite adapter (same interface).
+*
+* Records land as one JSONL file per source under `<root>/<source>.jsonl`.
+* Each line is a `LabeledScenarioRecord`. Append-only — no in-place edits.
+*
+* Safety properties enforced at write-time:
+*
+*   - **Provenance required**: writes without `source`, `sourceVersionHash`,
+*     `capturedAt`, `redactionStatus` are rejected. Closes the alignment
+*     reviewer's data-poisoning gap.
+*   - **Per-source rate limits**: optional `rateLimitBucket` + `maxWritesPerMinute`
+*     stops a single tenant/source from flooding the store.
+*
+* Safety properties enforced at sample-time:
+*
+*   - **Required split + capturedBefore**: substrate refuses to sample without
+*     an explicit `split` ('train' | 'test') AND a temporal cutoff. Eliminates
+*     accidental train/test contamination.
+*   - **Default training-source filter**: when the store is sampled with
+*     `split: 'train'`, production-trace records are EXCLUDED unless the
+*     caller passes `filter.source: 'production-trace'` explicitly. Closes
+*     the contamination-by-default gap flagged by the senior eval engineer.
+*/
+/** Typed rejection from a labeled-scenario store (bad provenance, rate limit, invalid sample args) — carries a stable string `code`. */
+var LabeledScenarioStoreError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "LabeledScenarioStoreError";
+	}
+};
+/**
+* Filesystem `LabeledScenarioStore`: appends one JSONL file per source with provenance and
+* rate-limit guards. For tests, local dev, and small workloads — high-throughput lands in Turso.
+*/
+var FsLabeledScenarioStore = class {
+	options;
+	now;
+	rateLimits = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.options = options;
+		if (!existsSync(options.root)) mkdirSync(options.root, { recursive: true });
+		this.now = options.now ?? Date.now;
+	}
+	async observe(write) {
+		this.assertProvenance(write);
+		this.assertRateLimit(write);
+		const record = this.toRecord(write);
+		appendLine(this.pathForSource(write.source), `${JSON.stringify(record)}\n`);
+	}
+	async sample(args) {
+		if (!args.split) throw new LabeledScenarioStoreError("split_required", "sample() requires an explicit `split` (train | test) — substrate refuses ambiguous reads");
+		if (!args.capturedBefore) throw new LabeledScenarioStoreError("capturedBefore_required", "sample() requires an explicit `capturedBefore` timestamp for temporal-split discipline");
+		const all = [];
+		for (const source of ALL_SOURCES) {
+			if (args.split === "train" && source === "production-trace") {
+				if (!sourceFilterContains(args.filter?.source, "production-trace")) continue;
+			}
+			const path = this.pathForSource(source);
+			if (!existsSync(path)) continue;
+			const lines = readFileSync(path, "utf8").split("\n").filter(Boolean);
+			for (const line of lines) {
+				let record;
+				try {
+					record = JSON.parse(line);
+				} catch {
+					continue;
+				}
+				if (!matchesFilter(record, args, source)) continue;
+				all.push(record);
+			}
+		}
+		all.sort((a, b) => {
+			if (a.capturedAt !== b.capturedAt) return a.capturedAt.localeCompare(b.capturedAt);
+			return a.recordHash.localeCompare(b.recordHash);
+		});
+		return all.slice(0, args.count);
+	}
+	async size() {
+		const bySource = {};
+		const byTrust = {
+			unverified: 0,
+			"verified-signal": 0,
+			"human-rated": 0
+		};
+		let total = 0;
+		for (const source of ALL_SOURCES) {
+			const path = this.pathForSource(source);
+			if (!existsSync(path)) {
+				bySource[source] = 0;
+				continue;
+			}
+			const lines = readFileSync(path, "utf8").split("\n").filter(Boolean);
+			bySource[source] = lines.length;
+			total += lines.length;
+			for (const line of lines) {
+				let trust = "unverified";
+				try {
+					trust = JSON.parse(line).labelTrust ?? "unverified";
+				} catch {}
+				byTrust[trust] += 1;
+			}
+		}
+		return {
+			train: total,
+			test: total,
+			bySource,
+			byTrust
+		};
+	}
+	assertProvenance(write) {
+		if (!write.source) throw new LabeledScenarioStoreError("missing_source", "LabeledScenarioWrite requires `source`");
+		if (!write.sourceVersionHash || write.sourceVersionHash.length === 0) throw new LabeledScenarioStoreError("missing_source_version", "LabeledScenarioWrite requires `sourceVersionHash` (git sha or substrate version)");
+		if (!write.capturedAt) throw new LabeledScenarioStoreError("missing_captured_at", "LabeledScenarioWrite requires `capturedAt` ISO timestamp");
+		if (!write.redactionStatus) throw new LabeledScenarioStoreError("missing_redaction_status", "LabeledScenarioWrite requires explicit `redactionStatus` — raw / redacted-pii / redacted-secrets / fully-redacted");
+		if (!ALL_SOURCES.includes(write.source)) throw new LabeledScenarioStoreError("unknown_source", `LabeledScenarioWrite.source must be one of: ${ALL_SOURCES.join(", ")}`);
+	}
+	assertRateLimit(write) {
+		const cap = this.options.maxWritesPerMinutePerBucket;
+		if (!cap || !write.rateLimitBucket) return;
+		const now = this.now();
+		const windowMs = 6e4;
+		let state = this.rateLimits.get(write.rateLimitBucket);
+		if (!state || now - state.windowStartMs >= windowMs) {
+			state = {
+				bucket: write.rateLimitBucket,
+				windowStartMs: now,
+				count: 0
+			};
+			this.rateLimits.set(write.rateLimitBucket, state);
+		}
+		if (state.count >= cap) throw new LabeledScenarioStoreError("rate_limit_exceeded", `LabeledScenarioStore: bucket ${write.rateLimitBucket} exceeded ${cap} writes/min`);
+		state.count += 1;
+	}
+	toRecord(write) {
+		const recordHash = sha256$1(JSON.stringify({
+			id: write.scenario.id,
+			src: write.source,
+			at: write.capturedAt,
+			ver: write.sourceVersionHash
+		}));
+		return {
+			...write,
+			recordHash,
+			split: "train"
+		};
+	}
+	pathForSource(source) {
+		return join(this.options.root, `${source}.jsonl`);
+	}
+};
+const ALL_SOURCES = [
+	"production-trace",
+	"eval-run",
+	"manual",
+	"red-team",
+	"synthetic"
+];
+function sourceFilterContains(filter, needle) {
+	if (!filter) return false;
+	if (Array.isArray(filter)) return filter.includes(needle);
+	return filter === needle;
+}
+function matchesFilter(record, args, source) {
+	if (args.split === "train" && record.capturedAt >= args.capturedBefore) return false;
+	if (args.split === "test" && record.capturedAt < args.capturedBefore) return false;
+	const f = args.filter;
+	if (!f) return true;
+	if (f.kind && record.scenario.kind !== f.kind) return false;
+	if (f.source) {
+		if (!(Array.isArray(f.source) ? f.source : [f.source]).includes(source)) return false;
+	}
+	if (f.minComposite !== void 0 || f.maxComposite !== void 0) {
+		const composites = Object.values(record.judgeScores).map((s) => s.composite);
+		const max = composites.length === 0 ? 0 : Math.max(...composites);
+		if (f.minComposite !== void 0 && max < f.minComposite) return false;
+		if (f.maxComposite !== void 0 && max > f.maxComposite) return false;
+	}
+	if (f.minTrust !== void 0 && labelTrustRank(record.labelTrust) < labelTrustRank(f.minTrust)) return false;
+	return true;
+}
+function sha256$1(input) {
+	return createHash("sha256").update(input).digest("hex").slice(0, 16);
+}
+function appendLine(path, line) {
+	if (existsSync(path)) writeFileSync(path, readFileSync(path, "utf8") + line);
+	else writeFileSync(path, line);
+}
+//#endregion
+//#region src/campaign/neutralize.ts
+/**
+* @module
+* Footprint-matched neutralization — the placebo control for content-vs-footprint
+* attribution in a promotion gate.
+*
+* A promoted surface can raise a held-out score two different ways:
+*  1. its CONTENT is informative (the thing we want to promote), or
+*  2. it merely added prompt/mount FOOTPRINT — more bytes, more lines, a longer
+*     more authoritative-looking prompt — that the model spends attention on
+*     regardless of what the bytes say.
+*
+* A held-out gate proves the candidate beat baseline; it cannot separate (1) from
+* (2). `neutralizeText` produces a variant that keeps the input's layout and
+* length while carrying ZERO information, so scoring it isolates the footprint
+* contribution (2). Feed the neutralized variant's scores to `neutralizationGate`:
+* any lift it still holds over baseline is decorative, and a candidate whose lift
+* survives neutralization is rejected however large its raw lift.
+*/
+/** Filler for blanked content. A single ASCII byte, so a run of it preserves an
+*  ASCII source's exact byte length; for multibyte sources it preserves CHARACTER
+*  count and layout (what the tokenizer footprint tracks), not raw byte count. */
+const FILLER = "#";
+/**
+* Blank every non-whitespace character to a 1-byte filler while preserving all
+* whitespace. Line count, indentation, and word/line lengths are unchanged — so
+* the neutralized variant has the same layout and (for ASCII) the same byte
+* footprint as the input, but no readable content. Whitespace is preserved
+* deliberately: collapsing it would change the token structure and stop the
+* variant from being a true footprint match.
+*/
+function neutralizeText(content) {
+	return content.replace(/\S/g, FILLER);
+}
+//#endregion
+//#region src/campaign/presets/playback.ts
+/**
+* Adapt a `PlaybackDriver` into a `runProfileMatrix` dispatch. The artifact the
+* matrix scores is the `ProducedState` extracted from the driver's event
+* stream — grade it with `scoreUserStory` (or a judge wrapping it).
+*/
+function makePlaybackDispatch(driver) {
+	return async (profile, scenario, ctx) => {
+		return extractProducedState(await driver.run(scenario, {
+			...ctx,
+			profile
+		}));
+	};
+}
+/**
+* Score one story's produced state against its requirements. Thin wrapper over
+* `verifyCompletion` that builds the gold from the story and returns a
+* per-requirement PASS/FAIL verdict. `checkCorrectness` is injected — a
+* deterministic stub in tests, `createLlmCorrectnessChecker` in production.
+*/
+async function scoreUserStory(story, state, checkCorrectness) {
+	return {
+		...await verifyCompletion({
+			taskId: story.id,
+			requirements: story.requirements
+		}, state, checkCorrectness),
+		title: story.title
+	};
+}
+/**
+* Flatten story verdicts into the per-requirement scoreboard — the literal
+* Jira tick-off: one row per (story, requirement) with PASS/FAIL and the
+* evidence behind the verdict.
+*/
+function userStoryScoreboard(verdicts) {
+	const rows = [];
+	for (const v of verdicts) for (const r of v.requirements) rows.push({
+		storyId: v.taskId,
+		storyTitle: v.title,
+		reqId: r.reqId,
+		reqTitle: r.title,
+		status: r.satisfied ? "PASS" : "FAIL",
+		evidence: r.evidence
+	});
+	return rows;
+}
+/** Roll the per-requirement rows up into the launch headline counts. */
+function scoreboardSummary(rows) {
+	const byStory = /* @__PURE__ */ new Map();
+	let passed = 0;
+	for (const r of rows) {
+		const s = byStory.get(r.storyId) ?? {
+			total: 0,
+			passed: 0
+		};
+		s.total++;
+		if (r.status === "PASS") {
+			s.passed++;
+			passed++;
+		}
+		byStory.set(r.storyId, s);
+	}
+	let storiesFullyComplete = 0;
+	for (const s of byStory.values()) if (s.total > 0 && s.passed === s.total) storiesFullyComplete++;
+	return {
+		stories: byStory.size,
+		storiesFullyComplete,
+		requirements: rows.length,
+		passed,
+		failed: rows.length - passed,
+		passRate: rows.length === 0 ? 0 : passed / rows.length
+	};
+}
+function escapeCell(s) {
+	return s.replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
+}
+function truncate(s, max) {
+	return s.length <= max ? s : `${s.slice(0, Math.max(0, max - 1))}…`;
+}
+/**
+* Render the scoreboard as a launch-readiness Markdown document — the literal
+* "tick off every user story" artifact: a headline roll-up, the open tickets
+* (FAIL rows) up top as the launch blockers, then a per-story table of
+* requirement → PASS/FAIL with the evidence behind each verdict. Pure: same
+* rows in, same bytes out (no clock/random), so it is safe to snapshot.
+*/
+function renderScoreboardMarkdown(rows, opts = {}) {
+	const maxEv = opts.maxEvidenceChars ?? 160;
+	const sum = scoreboardSummary(rows);
+	const pct = (n) => `${Math.round(n * 100)}%`;
+	const ev = (e) => escapeCell(truncate(e.join("; "), maxEv)) || "—";
+	const out = [`# ${opts.title ?? "Product-flow playback scoreboard"}`, ""];
+	if (opts.meta) {
+		for (const [k, v] of Object.entries(opts.meta)) out.push(`- **${k}:** ${v}`);
+		out.push("");
+	}
+	out.push(`**${sum.storiesFullyComplete}/${sum.stories}** user stories fully shipped · **${sum.passed}/${sum.requirements}** requirements passing (${pct(sum.passRate)}) · **${sum.failed}** open`, "");
+	const fails = rows.filter((r) => r.status === "FAIL");
+	if (fails.length > 0) {
+		out.push("## Open tickets", "", "| Story | Requirement | Evidence |", "| --- | --- | --- |");
+		for (const r of fails) out.push(`| ${escapeCell(r.storyTitle)} | ${escapeCell(r.reqTitle)} | ${ev(r.evidence)} |`);
+		out.push("");
+	} else out.push("_All requirements passing — no open tickets._", "");
+	out.push("## Per-story tick-off", "");
+	for (const storyId of [...new Set(rows.map((r) => r.storyId))]) {
+		const storyRows = rows.filter((r) => r.storyId === storyId);
+		const passed = storyRows.filter((r) => r.status === "PASS").length;
+		const mark = passed === storyRows.length ? "✅" : "⚠️";
+		out.push(`### ${escapeCell(storyRows[0].storyTitle)} — ${passed}/${storyRows.length} ${mark}`, "", "| Requirement | Status | Evidence |", "| --- | --- | --- |");
+		for (const r of storyRows) out.push(`| ${escapeCell(r.reqTitle)} | ${r.status === "PASS" ? "✅ PASS" : "❌ FAIL"} | ${ev(r.evidence)} |`);
+		out.push("");
+	}
+	return out.join("\n");
+}
+//#endregion
+//#region src/campaign/presets/run-profile-matrix.ts
+/**
+* `runProfileMatrix` — the missing keystone between `runAgentMatrix` and the
+* backend-integrity guard.
+*
+* The gap it closes: `runAgentMatrix` is a topology-opaque scheduler whose
+* cells return a bare `{ output, verdict, costUsd }` — no `tokenUsage`, not a
+* `RunRecord`. `assertRealBackend` / `summarizeBackendIntegrity` key on
+* `RunRecord.tokenUsage`, so they cannot run on a raw matrix result. Every
+* consumer therefore hand-writes the same bridge: fan a profile × scenario
+* cartesian, call dispatch, fabricate a `RunRecord` with token usage, thread it
+* back, run the integrity guard. That hand-rolled bridge is exactly the pile of
+* bespoke `eval:*` scripts the adoption skills keep trying (and failing) to
+* forbid.
+*
+* `runProfileMatrix` IS that bridge, once:
+*
+*   - axis 3 (PROFILE) = `profiles: AgentProfile[]`
+*   - axis 1 (PERSONA/SCENARIO) = `scenarios: Scenario[]` (each scenario carries
+*     its persona; `personaOf` groups them for the `byPersona` pivot)
+*   - the scoring axis = `judges`
+*
+* It runs `runCampaign` once per profile (reusing its seeds, reps, bootstrap
+* CIs, resumability, and the `LabeledScenarioStore` capture flywheel), maps
+* every cell to a validated `RunRecord` carrying the real `tokenUsage` the
+* dispatch committed via `ctx.cost.runPaidCall`, and runs `assertRealBackend`
+* BY CONSTRUCTION before returning — so a stub-backend run fails loudly instead
+* of reporting a clean 0/N leaderboard.
+*
+* Dispatch contract: a dispatch that calls an LLM MUST report usage via
+* `ctx.cost.runPaidCall({ execute, receipt })`.
+* A dispatch that reports zero tokens is indistinguishable from a stub and the
+* integrity guard treats it as one.
+*/
+/** Thrown when the matrix is misconfigured (no profiles, a profile whose model
+*  lacks a snapshot version, etc.). Distinct from `BackendIntegrityError`,
+*  which signals a stub backend at run time. */
+var ProfileMatrixError = class extends AgentEvalError {
+	constructor(message) {
+		super("profile_matrix", message);
+	}
+};
+function sanitize(id) {
+	return id.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+function sha(input) {
+	return createHash("sha256").update(JSON.stringify(input)).digest("hex");
+}
+function mean(xs) {
+	return xs.length === 0 ? 0 : xs.reduce((a, b) => a + b, 0) / xs.length;
+}
+/**
+* Resolve the concrete, snapshot-bearing model for a cell whose profile
+* declared the `HARNESS_NATIVE_MODEL` sentinel (a vendor-locked harness that
+* resolves its model at runtime). The dispatch must have reported it via
+* the model in a paid-call receipt — surfaced as `cell.resolvedModel`. Throws when it is
+* missing or lacks a snapshot, so a provenance-broken row can never be
+* recorded as the bare sentinel.
+*/
+function requireResolvedModel(cell, profileId) {
+	const resolved = cell.resolvedModel?.trim();
+	if (!resolved) throw new ProfileMatrixError(`profile '${profileId}' declared the '${HARNESS_NATIVE_MODEL}' runtime-resolved model but its dispatch reported no resolved model for cell '${cell.cellId}' — return it in the ctx.cost.runPaidCall receipt so the RunRecord pins the real model (never records '${HARNESS_NATIVE_MODEL}')`);
+	if (!modelHasSnapshot(resolved)) throw new ProfileMatrixError(`profile '${profileId}' resolved to model '${resolved}' for cell '${cell.cellId}', which lacks a snapshot version — pin it (name@YYYY-MM-DD or name-YYYYMMDD) in the paid-call receipt`);
+	return resolved;
+}
+function buildRunRecord(args) {
+	const { cell, profile, profileHash, configHash, experimentId, splitTag, commitSha, matrixId } = args;
+	const profileId = agentProfileId(profile);
+	const declaredModel = agentProfileModelId(profile);
+	const model = declaredModel === "default" ? requireResolvedModel(cell, profileId) : declaredModel;
+	const record = campaignCellToRunRecord(cell, {
+		runId: `${matrixId}:${profileId}:${cell.cellId}`,
+		experimentId,
+		candidateId: profileId,
+		model,
+		promptHash: profileHash,
+		configHash,
+		commitSha,
+		splitTag,
+		agentProfile: args.agentProfileCell
+	});
+	if (args.corpusText && args.scenario) try {
+		const text = args.corpusText(cell.artifact, args.scenario);
+		if (text && typeof text.prompt === "string" && typeof text.completion === "string") {
+			record.prompt = text.prompt;
+			record.completion = text.completion;
+		}
+	} catch {}
+	return record;
+}
+/**
+* Profile × scenario matrix runner: fan N agent profiles across M scenarios, project each cell to a validated `RunRecord` with real token usage, and enforce the backend-integrity guard before returning.
+*/
+async function runProfileMatrix(opts) {
+	if (opts.profiles.length === 0) throw new ProfileMatrixError("profiles must not be empty");
+	if (opts.scenarios.length === 0) throw new ProfileMatrixError("scenarios must not be empty");
+	const splitTag = opts.splitTag ?? "search";
+	const seed = opts.seed ?? 42;
+	const validate = opts.validate ?? true;
+	const integrityMode = opts.integrity ?? "assert";
+	const profileIds = opts.profiles.map(agentProfileId);
+	const experimentId = opts.experimentId ?? `pm_${sha({
+		profileIds,
+		scenarios: opts.scenarios.map((s) => s.id)
+	}).slice(0, 16)}`;
+	const matrixId = `mtx_${sha({
+		experimentId,
+		profileIds,
+		seed,
+		splitTag
+	}).slice(0, 16)}`;
+	const scenarioById = new Map(opts.scenarios.map((s) => [s.id, s]));
+	for (const profile of opts.profiles) {
+		const profileHash = agentProfileHash(profile);
+		const profileId = agentProfileId(profile);
+		const declaredModel = agentProfileModelId(profile);
+		const model = declaredModel === "default" ? `${HARNESS_NATIVE_MODEL}@runtime-resolved` : declaredModel;
+		try {
+			validateRunRecord({
+				runId: `${matrixId}:${profileId}:probe`,
+				experimentId,
+				candidateId: profileId,
+				seed,
+				model,
+				promptHash: profileHash,
+				configHash: profileHash,
+				commitSha: opts.commitSha,
+				wallMs: 0,
+				costUsd: null,
+				costProvenance: {
+					kind: "uncaptured",
+					usd: null
+				},
+				tokenUsage: {
+					input: 0,
+					output: 0
+				},
+				terminalOutcome: "succeeded",
+				outcome: { raw: { execution_error_count: 0 } },
+				splitTag,
+				scenarioId: "recordability-probe"
+			});
+		} catch (err) {
+			throw new ProfileMatrixError(`profile '${profileId}' is not recordable: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
+	const records = [];
+	const campaigns = {};
+	const byProfile = {};
+	for (const profile of opts.profiles) {
+		const profileHash = agentProfileHash(profile);
+		const profileId = agentProfileId(profile);
+		const declaredModel = agentProfileModelId(profile);
+		const configHash = sha({
+			profile: profileHash,
+			judges: (opts.judges ?? []).map((j) => j.name),
+			seed,
+			splitTag
+		});
+		const dispatch = (scenario, ctx) => opts.dispatch(profile, scenario, ctx);
+		Object.defineProperty(dispatch, "name", { value: `profile_${sanitize(profileId)}` });
+		const campaign = await runCampaign({
+			scenarios: opts.scenarios,
+			dispatch,
+			judges: opts.judges,
+			seed,
+			reps: opts.reps,
+			maxConcurrency: opts.maxConcurrency,
+			costCeiling: opts.costCeiling,
+			labeledStore: opts.labeledStore,
+			captureSource: opts.captureSource,
+			storage: opts.storage,
+			now: opts.now,
+			runDir: join(opts.runDir, sanitize(profileId))
+		});
+		const axis = harnessAxisOf(profile);
+		const buildCellIdentity = (cellModel) => buildAgentProfileCell({
+			profileId,
+			sourceProfile: {
+				kind: "agent-interface-profile",
+				hash: profileHash
+			},
+			model: cellModel,
+			...axis ? { harness: { id: axis.harness } } : {}
+		});
+		const sharedCellIdentity = declaredModel === "default" ? void 0 : await buildCellIdentity(declaredModel);
+		const profileRecords = [];
+		for (const cell of campaign.cells) {
+			const agentProfileCell = sharedCellIdentity ?? await buildCellIdentity(requireResolvedModel(cell, profileId));
+			const record = buildRunRecord({
+				cell,
+				profile,
+				profileHash,
+				configHash,
+				experimentId,
+				splitTag,
+				commitSha: opts.commitSha,
+				matrixId,
+				agentProfileCell,
+				scenario: scenarioById.get(cell.scenarioId),
+				corpusText: opts.corpusText
+			});
+			if (validate) validateRunRecord(record);
+			profileRecords.push(record);
+			records.push(record);
+		}
+		const totalCostUsd = campaign.aggregates.cost.totalCostUsd;
+		campaigns[profileId] = campaign;
+		byProfile[profileId] = {
+			profileId,
+			profileHash,
+			model: declaredModel === "default" ? profileRecords[0]?.model ?? declaredModel : declaredModel,
+			records: profileRecords.length,
+			meanComposite: meanOrNull(profileRecords.map(scoreOf).filter((score) => score !== void 0)),
+			totalCostUsd,
+			integrity: summarizeBackendIntegrity(profileRecords)
+		};
+	}
+	const integrity = summarizeBackendIntegrity(records);
+	if (integrityMode === "assert") assertRealBackend(records, { allowMixed: opts.allowMixed ?? true });
+	else if (integrityMode === "warn" && integrity.verdict !== "real") console.warn(`[runProfileMatrix] backend integrity: ${integrity.verdict} — ${integrity.diagnosis}`);
+	return {
+		matrixId,
+		experimentId,
+		records,
+		byProfile,
+		byScenario: rollup(records, (r) => r.scenarioId),
+		byPersona: opts.personaOf ? rollupByPersona(records, opts.scenarios, opts.personaOf) : void 0,
+		integrity,
+		campaigns
+	};
+}
+/** Score for a produced RunRecord, absent when the campaign cell was unscored.
+*  Ungated (`runTaskScore` is raw) — a matrix pivot reports measured scores;
+*  it is not a training input. */
+function scoreOf(r) {
+	return runTaskScore(r);
+}
+function meanOrNull(values) {
+	return values.length === 0 ? null : mean(values);
+}
+function rollup(records, keyOf) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const r of records) {
+		const key = keyOf(r);
+		if (key === void 0) continue;
+		const score = scoreOf(r);
+		if (score === void 0) continue;
+		const arr = groups.get(key) ?? [];
+		arr.push(score);
+		groups.set(key, arr);
+	}
+	const out = {};
+	for (const [key, xs] of groups) out[key] = {
+		meanComposite: mean(xs),
+		n: xs.length
+	};
+	return out;
+}
+function rollupByPersona(records, scenarios, personaOf) {
+	const personaByScenarioId = /* @__PURE__ */ new Map();
+	for (const s of scenarios) personaByScenarioId.set(s.id, personaOf(s));
+	return rollup(records, (r) => r.scenarioId ? personaByScenarioId.get(r.scenarioId) : void 0);
+}
+//#endregion
+//#region src/campaign/scenario-selection.ts
+const DEFAULT_SATURATION_CEILING = .999;
+/** Variance below this is treated as "every candidate scored the same". */
+const VARIANCE_EPSILON = 1e-9;
+/** Population mean + variance of the candidate scores. Empty ⇒ zeros (a signal
+*  with no observations cannot discriminate). */
+function moments(scores) {
+	const n = scores.length;
+	if (n === 0) return {
+		meanScore: 0,
+		variance: 0
+	};
+	let sum = 0;
+	for (const s of scores) sum += s;
+	const meanScore = sum / n;
+	let sqDev = 0;
+	for (const s of scores) {
+		const d = s - meanScore;
+		sqDev += d * d;
+	}
+	return {
+		meanScore,
+		variance: sqDev / n
+	};
+}
+/** Deterministic ordering: discrimination desc, then meanScore asc (more
+*  headroom first), then scenarioId asc. */
+function compareDiscrimination(a, b) {
+	if (b.discrimination !== a.discrimination) return b.discrimination - a.discrimination;
+	if (a.meanScore !== b.meanScore) return a.meanScore - b.meanScore;
+	return a.scenarioId < b.scenarioId ? -1 : a.scenarioId > b.scenarioId ? 1 : 0;
+}
+/**
+* Rank scenarios by how well they DISCRIMINATE candidates.
+*
+* `discrimination = variance` (spread of the candidate scores) — kept simple on
+* purpose; the headroom term (`saturationCeiling - meanScore`) only breaks ties
+* so that, among equally spread scenarios, the one with more room to improve
+* ranks first. Returned sorted by the deterministic order above.
+*/
+function scoreDiscrimination(signals, opts) {
+	const saturationCeiling = opts?.saturationCeiling ?? DEFAULT_SATURATION_CEILING;
+	return signals.map((signal) => {
+		const { meanScore, variance } = moments(signal.scores);
+		const tied = variance < VARIANCE_EPSILON && meanScore >= saturationCeiling;
+		return {
+			scenarioId: signal.scenarioId,
+			discrimination: variance,
+			meanScore,
+			variance,
+			tied
+		};
+	}).sort(compareDiscrimination);
+}
+/**
+* Select the top-`k` most discriminative scenario ids for a holdout, EXCLUDING
+* fully saturated ties when enough non-tied scenarios exist (a tie in the
+* holdout wastes a paired cell).
+*
+* Prefers non-tied scenarios; if fewer than `k` non-tied exist, fills with the
+* least-saturated tied ones (tied scenarios are already ordered least-saturated
+* first by `meanScore` asc). Deterministic. Throws if `k < 1`. If
+* `signals.length <= k`, returns all ids in discrimination order.
+*/
+function selectDiscriminative(signals, k, opts) {
+	if (k < 1) throw new Error(`selectDiscriminative: k must be >= 1 (got ${k})`);
+	const ranked = scoreDiscrimination(signals, opts);
+	if (ranked.length <= k) return ranked.map((s) => s.scenarioId);
+	const nonTied = ranked.filter((s) => !s.tied);
+	if (nonTied.length >= k) return nonTied.slice(0, k).map((s) => s.scenarioId);
+	const fill = ranked.filter((s) => s.tied).slice(0, k - nonTied.length);
+	return [...nonTied, ...fill].map((s) => s.scenarioId);
+}
+//#endregion
+//#region src/campaign/search-ledger.ts
+/**
+* Durable append-only audit log for improvement searches.
+*
+* Existing campaign artifacts keep their own rich records: `RunRecord` owns a
+* measured run and `CostLedger` owns per-call accounting. This ledger does not
+* copy those structures. It binds their immutable ids and receipts into one replayable event stream so a
+* search can answer, after a crash, exactly which candidates and task attempts
+* existed, which surfaces actually fired, what they cost, and why they were
+* selected or rejected.
+*
+* The file format is canonical JSONL with a SHA-256 hash chain. Every append is
+* serialized across processes, fsynced before acknowledgement, and idempotent
+* by `eventId`. A malformed, non-canonical, truncated, reordered, or conflicting
+* log fails loudly; the implementation never skips a bad row.
+*
+* The journal machinery itself (hash chain, locking, fsync, idempotent append)
+* is the generic `ledger-core` journal; this module supplies the campaign
+* codec: event schemas, canonical event ordering, and the search state machine.
+*/
+const SEARCH_LEDGER_SCHEMA = "tangle.search-ledger.v1";
+const NON_EMPTY = z.string().min(1).refine((value) => value.trim() === value, "must not contain surrounding whitespace");
+const HASH = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const LINEAGE_NODE_ID = z.string().regex(/^[a-f0-9]{16}$/);
+const IMMUTABLE_REVISION = z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|sha256:[a-f0-9]{64}|sha512:[A-Za-z0-9+/=]+)$/);
+const ISO_TIMESTAMP = z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/).refine((value) => Number.isFinite(Date.parse(value)), "invalid timestamp");
+const NON_NEGATIVE_INT = z.number().int().nonnegative().safe();
+const FINITE_NUMBER = z.number().finite();
+const ArtifactRefSchema = z.object({
+	role: NON_EMPTY,
+	uri: NON_EMPTY,
+	sha256: HASH,
+	byteLength: NON_NEGATIVE_INT
+}).strict();
+const SourceRefSchema = z.object({
+	uri: NON_EMPTY,
+	revision: IMMUTABLE_REVISION
+}).strict();
+const FailureReasonSchema = z.object({
+	code: NON_EMPTY,
+	message: NON_EMPTY
+}).strict();
+const EventBaseShape = {
+	eventId: NON_EMPTY,
+	occurredAt: ISO_TIMESTAMP,
+	artifacts: z.array(ArtifactRefSchema).min(1)
+};
+const OperationKindSchema = z.enum([
+	"candidate-generation",
+	"analysis",
+	"selection",
+	"judge",
+	"other"
+]);
+const SearchPlannedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-planned"),
+	plan: z.object({
+		candidateSlots: z.array(z.object({
+			slotId: NON_EMPTY,
+			generationOperationId: NON_EMPTY
+		}).strict()).min(1),
+		tasks: z.array(z.object({
+			taskId: NON_EMPTY,
+			source: SourceRefSchema,
+			benchmark: SourceRefSchema,
+			maxAttempts: z.number().int().positive().safe()
+		}).strict()).min(1),
+		operations: z.array(z.object({
+			operationId: NON_EMPTY,
+			kind: OperationKindSchema
+		}).strict()).min(1)
+	}).strict()
+}).strict();
+const CandidateRegisteredSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-registered"),
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY,
+	candidateId: NON_EMPTY,
+	lineage: z.object({
+		lineageNodeId: LINEAGE_NODE_ID,
+		parentCandidateIds: z.array(NON_EMPTY),
+		generation: NON_NEGATIVE_INT,
+		proposer: NON_EMPTY,
+		proposerSource: SourceRefSchema
+	}).strict(),
+	surfaces: z.array(z.object({
+		surfaceId: NON_EMPTY,
+		kind: z.enum([
+			"prompt",
+			"tool-contract",
+			"runtime-config",
+			"memory",
+			"knowledge",
+			"agent-profile",
+			"code",
+			"deployment"
+		]),
+		artifact: ArtifactRefSchema
+	}).strict()).min(1)
+}).strict();
+const CandidateSlotClosedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-slot-closed"),
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY,
+	reason: FailureReasonSchema
+}).strict();
+const KnownTokensSchema = z.object({
+	status: z.literal("known"),
+	inputTokens: NON_NEGATIVE_INT,
+	outputTokens: NON_NEGATIVE_INT,
+	cachedTokens: NON_NEGATIVE_INT
+}).strict();
+const UnknownSchema = z.object({
+	status: z.literal("unknown"),
+	reason: NON_EMPTY
+}).strict();
+const KnownCostSchema = z.object({
+	status: z.literal("known"),
+	usd: z.number().finite().nonnegative(),
+	source: z.enum([
+		"provider",
+		"pricing-table",
+		"free"
+	])
+}).strict().superRefine((cost, ctx) => {
+	if (cost.source === "free" && cost.usd !== 0) ctx.addIssue({
+		code: "custom",
+		message: "free cost source must have usd 0"
+	});
+});
+const UnknownCostSchema = z.object({
+	status: z.literal("unknown"),
+	knownLowerBoundUsd: z.number().finite().nonnegative(),
+	reason: NON_EMPTY
+}).strict();
+const AccountingSchema = z.object({
+	tokens: z.discriminatedUnion("status", [KnownTokensSchema, UnknownSchema]),
+	cost: z.discriminatedUnion("status", [KnownCostSchema, UnknownCostSchema])
+}).strict();
+const MetricsSchema = z.record(NON_EMPTY, FINITE_NUMBER).superRefine((metrics, ctx) => {
+	for (const key of Object.keys(metrics)) if (key === "__proto__" || key === "constructor" || key === "prototype") ctx.addIssue({
+		code: "custom",
+		message: `unsafe metric key ${key}`
+	});
+});
+const OutcomeSchema = z.discriminatedUnion("status", [
+	z.object({
+		status: z.literal("passed"),
+		score: FINITE_NUMBER,
+		metrics: MetricsSchema
+	}).strict(),
+	z.object({
+		status: z.literal("failed"),
+		score: FINITE_NUMBER,
+		metrics: MetricsSchema,
+		failure: FailureReasonSchema
+	}).strict(),
+	z.object({
+		status: z.literal("errored"),
+		metrics: MetricsSchema,
+		error: FailureReasonSchema.extend({ retryable: z.boolean() }).strict()
+	}).strict()
+]);
+const EffectSchema = z.discriminatedUnion("status", [z.object({
+	status: z.literal("measured"),
+	metric: NON_EMPTY,
+	baselineValue: FINITE_NUMBER,
+	candidateValue: FINITE_NUMBER,
+	delta: FINITE_NUMBER
+}).strict().superRefine((effect, ctx) => {
+	const expected = effect.candidateValue - effect.baselineValue;
+	const tolerance = Number.EPSILON * Math.max(1, Math.abs(expected), Math.abs(effect.delta)) * 8;
+	if (Math.abs(effect.delta - expected) > tolerance) ctx.addIssue({
+		code: "custom",
+		message: "delta must equal candidateValue - baselineValue"
+	});
+}), z.object({
+	status: z.literal("not-measured"),
+	reason: NON_EMPTY
+}).strict()]);
+const SurfaceEvidenceSchema = z.object({
+	surfaceId: NON_EMPTY,
+	fired: z.boolean(),
+	firingCount: NON_NEGATIVE_INT,
+	effect: EffectSchema,
+	evidence: z.array(ArtifactRefSchema).min(1)
+}).strict().superRefine((evidence, ctx) => {
+	if (evidence.fired && evidence.firingCount === 0) ctx.addIssue({
+		code: "custom",
+		message: "a fired surface must have firingCount >= 1"
+	});
+	if (!evidence.fired && evidence.firingCount !== 0) ctx.addIssue({
+		code: "custom",
+		message: "a surface that did not fire must have firingCount 0"
+	});
+	if (!evidence.fired && evidence.effect.status === "measured" && evidence.effect.delta !== 0) ctx.addIssue({
+		code: "custom",
+		message: "a surface that did not fire cannot claim non-zero effect"
+	});
+});
+const TaskAttemptedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("task-attempted"),
+	candidateId: NON_EMPTY,
+	runId: NON_EMPTY,
+	attemptIndex: NON_NEGATIVE_INT,
+	task: z.object({
+		taskId: NON_EMPTY,
+		source: SourceRefSchema
+	}).strict(),
+	identity: z.object({
+		model: z.object({
+			provider: NON_EMPTY,
+			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
+		}).strict(),
+		agent: SourceRefSchema,
+		benchmark: SourceRefSchema
+	}).strict(),
+	outcome: OutcomeSchema,
+	accounting: AccountingSchema,
+	surfaceEvidence: z.array(SurfaceEvidenceSchema).min(1)
+}).strict();
+const SearchOperationRecordedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-operation-recorded"),
+	operationId: NON_EMPTY,
+	operationKind: OperationKindSchema,
+	execution: z.discriminatedUnion("kind", [z.object({
+		kind: z.literal("model"),
+		model: z.object({
+			provider: NON_EMPTY,
+			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
+		}).strict(),
+		source: SourceRefSchema
+	}).strict(), z.object({
+		kind: z.literal("deterministic"),
+		source: SourceRefSchema
+	}).strict()]),
+	outcome: z.discriminatedUnion("status", [
+		z.object({ status: z.literal("completed") }).strict(),
+		z.object({
+			status: z.literal("partial"),
+			failure: FailureReasonSchema
+		}).strict(),
+		z.object({
+			status: z.literal("failed"),
+			failure: FailureReasonSchema
+		}).strict()
+	]),
+	accounting: AccountingSchema
+}).strict();
+const CandidateDecidedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-decided"),
+	candidateId: NON_EMPTY,
+	decision: z.discriminatedUnion("status", [z.object({ status: z.literal("selected") }).strict(), z.object({
+		status: z.literal("rejected"),
+		reason: FailureReasonSchema
+	}).strict()])
+}).strict();
+const SearchCompletedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-completed"),
+	result: z.discriminatedUnion("status", [z.object({
+		status: z.literal("selected"),
+		candidateId: NON_EMPTY
+	}).strict(), z.object({
+		status: z.literal("all-rejected"),
+		reason: FailureReasonSchema
+	}).strict()])
+}).strict();
+const EventSchema = z.discriminatedUnion("kind", [
+	SearchPlannedSchema,
+	CandidateRegisteredSchema,
+	CandidateSlotClosedSchema,
+	TaskAttemptedSchema,
+	SearchOperationRecordedSchema,
+	CandidateDecidedSchema,
+	SearchCompletedSchema
+]);
+const EntrySchema = z.object({
+	schema: z.literal(SEARCH_LEDGER_SCHEMA),
+	campaignId: NON_EMPTY,
+	sequence: NON_NEGATIVE_INT,
+	previousHash: z.union([HASH, z.null()]),
+	event: EventSchema,
+	entryHash: HASH
+}).strict();
+/** Validate and return a canonical copy. Arrays whose order is not semantic are
+* sorted so retries from different processes produce byte-identical events. */
+function validateSearchLedgerEvent(input) {
+	const parsed = EventSchema.safeParse(input);
+	if (!parsed.success) throw new SearchLedgerError(`invalid search ledger event: ${formatZodError(parsed.error)}`);
+	return normalizeEvent(parsed.data);
+}
+/** Open a durable filesystem search ledger. Construction performs no I/O; the
+* first `append` or `replay` validates the complete existing file. */
+function openSearchLedger(options) {
+	if (options.path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
+	return new FileSearchLedger(options.path, options.campaignId);
+}
+function searchLedgerCodec(campaignId) {
+	return {
+		...SEARCH_LEDGER_FILE_CONTEXT,
+		header: {
+			schema: SEARCH_LEDGER_SCHEMA,
+			campaignId
+		},
+		conflictError: (message) => new SearchLedgerConflictError(message),
+		parseEntry: parseSearchLedgerEntry,
+		checkEntryHeader: (entry, index) => {
+			if (entry.campaignId !== campaignId) throw new SearchLedgerIntegrityError(`entry ${index} belongs to campaign ${entry.campaignId}, expected ${campaignId}`);
+		},
+		createProjector: () => createSearchLedgerProjector(campaignId)
+	};
+}
+/** Append-only file-backed search ledger with idempotent writes and replay. */
+var FileSearchLedger = class {
+	path;
+	campaignId;
+	journal;
+	constructor(path, campaignId) {
+		if (path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
+		if (campaignId.length === 0) throw new SearchLedgerError("campaignId is empty");
+		if (campaignId.trim() !== campaignId) throw new SearchLedgerError("campaignId must not contain surrounding whitespace");
+		this.campaignId = campaignId;
+		this.journal = new FileLedgerJournal(path, searchLedgerCodec(campaignId));
+		this.path = this.journal.path;
+	}
+	async replay() {
+		return (await this.journal.replay()).projection;
+	}
+	async append(input) {
+		const event = validateSearchLedgerEvent(input);
+		const { entry, appended, projection } = await this.journal.append(event);
+		return {
+			entry,
+			appended,
+			replay: projection
+		};
+	}
+};
+function parseSearchLedgerEntry(raw, context) {
+	const parsed = EntrySchema.safeParse(raw);
+	if (!parsed.success) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has a malformed entry at line ${context.line}: ${formatZodError(parsed.error)}`);
+	const entry = parsed.data;
+	if (canonicalString(validateSearchLedgerEvent(entry.event)) !== canonicalString(entry.event)) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has non-canonical event ordering at line ${context.line}`);
+	return entry;
+}
+/** Replay the campaign search state machine over chain-verified entries. The
+* generic journal owns sequence, hash, and eventId-uniqueness checks; this
+* projector owns every campaign invariant and builds the replay projection. */
+function createSearchLedgerProjector(campaignId) {
+	const candidates = /* @__PURE__ */ new Map();
+	const candidateBySlot = /* @__PURE__ */ new Map();
+	const closedSlots = /* @__PURE__ */ new Map();
+	const lineageNodes = /* @__PURE__ */ new Map();
+	const runIds = /* @__PURE__ */ new Set();
+	const attemptKeys = /* @__PURE__ */ new Set();
+	const candidateEvents = [];
+	const closedSlotEvents = [];
+	const attempts = [];
+	const operationEvents = [];
+	const operationsById = /* @__PURE__ */ new Map();
+	const decisions = [];
+	let planEvent = null;
+	let completion = null;
+	let previousOccurredAt = Number.NEGATIVE_INFINITY;
+	const apply = (entry, index) => {
+		const event = entry.event;
+		if (completion) throw new SearchLedgerIntegrityError(`event ${event.eventId} appears after terminal event ${completion.eventId}`);
+		const occurredAt = Date.parse(event.occurredAt);
+		if (occurredAt < previousOccurredAt) throw new SearchLedgerIntegrityError(`event ${event.eventId} occurred before the preceding durable event`);
+		previousOccurredAt = occurredAt;
+		assertUnique(event.artifacts.map(artifactKey), "artifact receipt", event.eventId);
+		if (event.kind === "search-planned") {
+			if (index !== 0 || planEvent) throw new SearchLedgerIntegrityError("search plan must be the first and only plan event");
+			assertUnique(event.plan.candidateSlots.map((slot) => slot.slotId), "candidate slot", event.eventId);
+			assertUnique(event.plan.tasks.map((task) => task.taskId), "planned taskId", event.eventId);
+			assertUnique(event.plan.operations.map((operation) => operation.operationId), "planned operationId", event.eventId);
+			for (const slot of event.plan.candidateSlots) if (event.plan.operations.find((operation) => operation.operationId === slot.generationOperationId)?.kind !== "candidate-generation") throw new SearchLedgerIntegrityError(`candidate slot ${slot.slotId} references unplanned candidate-generation operation ${slot.generationOperationId}`);
+			planEvent = event;
+			return;
+		}
+		if (!planEvent) throw new SearchLedgerIntegrityError(`event ${event.eventId} appears before the required search plan`);
+		if (event.kind === "candidate-registered") {
+			if (candidates.has(event.candidateId)) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} was registered twice`);
+			const plannedSlot = planEvent.plan.candidateSlots.find((slot) => slot.slotId === event.slotId);
+			if (!plannedSlot) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} binds unknown slot ${event.slotId}`);
+			if (candidateBySlot.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was bound twice`);
+			if (closedSlots.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was already closed`);
+			if (event.generationOperationId !== plannedSlot.generationOperationId) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} generation operation ${event.generationOperationId} does not match slot ${event.slotId} plan ${plannedSlot.generationOperationId}`);
+			const generationOperation = operationsById.get(event.generationOperationId);
+			if (!generationOperation) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} precedes generation operation ${event.generationOperationId}`);
+			if (generationOperation.outcome.status === "failed") throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} cannot bind failed generation operation ${event.generationOperationId}`);
+			const previousCandidate = lineageNodes.get(event.lineage.lineageNodeId);
+			if (previousCandidate) throw new SearchLedgerIntegrityError(`lineage node ${event.lineage.lineageNodeId} is already bound to ${previousCandidate}`);
+			assertUnique(event.lineage.parentCandidateIds, "parentCandidateId", event.eventId);
+			const parents = event.lineage.parentCandidateIds.map((id) => {
+				const parent = candidates.get(id);
+				if (!parent) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} references unknown parent ${id}`);
+				return parent;
+			});
+			const expectedGeneration = parents.length === 0 ? 0 : Math.max(...parents.map((parent) => parent.registered.lineage.generation)) + 1;
+			if (event.lineage.generation !== expectedGeneration) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} generation ${event.lineage.generation} does not follow its parents (expected ${expectedGeneration})`);
+			assertUnique(event.surfaces.map((surface) => surface.surfaceId), "surfaceId", event.eventId);
+			candidates.set(event.candidateId, {
+				registered: event,
+				attempts: [],
+				decision: null
+			});
+			candidateBySlot.set(event.slotId, event.candidateId);
+			lineageNodes.set(event.lineage.lineageNodeId, event.candidateId);
+			candidateEvents.push(event);
+			return;
+		}
+		if (event.kind === "task-attempted") {
+			const candidate = candidates.get(event.candidateId);
+			if (!candidate) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} references unknown candidate ${event.candidateId}`);
+			if (candidate.decision) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} appears after candidate ${event.candidateId} was decided`);
+			const plannedTask = planEvent.plan.tasks.find((task) => task.taskId === event.task.taskId);
+			if (!plannedTask) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} references unplanned task ${event.task.taskId}`);
+			if (canonicalString(plannedTask.source) !== canonicalString(event.task.source) || canonicalString(plannedTask.benchmark) !== canonicalString(event.identity.benchmark)) throw new SearchLedgerIntegrityError(`task ${event.task.taskId} does not match its planned source identity`);
+			if (event.attemptIndex >= plannedTask.maxAttempts) throw new SearchLedgerIntegrityError(`task ${event.task.taskId} attempt ${event.attemptIndex} exceeds planned maxAttempts ${plannedTask.maxAttempts}`);
+			if (runIds.has(event.runId)) throw new SearchLedgerIntegrityError(`runId ${event.runId} was recorded twice`);
+			runIds.add(event.runId);
+			const attemptKey = canonicalString([
+				event.candidateId,
+				event.task.taskId,
+				event.attemptIndex
+			]);
+			if (attemptKeys.has(attemptKey)) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} attempt ${event.attemptIndex} was recorded twice`);
+			const expectedAttemptIndex = candidate.attempts.filter((attempt) => attempt.task.taskId === event.task.taskId).length;
+			if (event.attemptIndex !== expectedAttemptIndex) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} attempt index ${event.attemptIndex} is not contiguous (expected ${expectedAttemptIndex})`);
+			const previousAttempt = candidate.attempts.find((attempt) => attempt.task.taskId === event.task.taskId);
+			if (previousAttempt?.outcome.status !== void 0 && previousAttempt.outcome.status !== "errored") throw new SearchLedgerIntegrityError(`task ${event.task.taskId} was retried after a measured outcome`);
+			if (previousAttempt && canonicalString({
+				task: previousAttempt.task,
+				identity: previousAttempt.identity
+			}) !== canonicalString({
+				task: event.task,
+				identity: event.identity
+			})) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} changed immutable execution identity between attempts`);
+			attemptKeys.add(attemptKey);
+			const declared = candidate.registered.surfaces.map((surface) => surface.surfaceId).sort();
+			const observed = event.surfaceEvidence.map((surface) => surface.surfaceId).sort();
+			assertUnique(observed, "surface evidence", event.eventId);
+			for (const evidence of event.surfaceEvidence) assertUnique(evidence.evidence.map(artifactKey), "surface evidence receipt", event.eventId);
+			if (canonicalString(declared) !== canonicalString(observed)) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} surface evidence does not exactly cover candidate ${event.candidateId}`);
+			candidate.attempts.push(event);
+			attempts.push(event);
+			return;
+		}
+		if (event.kind === "search-operation-recorded") {
+			const plannedOperation = planEvent.plan.operations.find((operation) => operation.operationId === event.operationId);
+			if (!plannedOperation) throw new SearchLedgerIntegrityError(`operation ${event.operationId} was not declared in the search plan`);
+			if (plannedOperation.kind !== event.operationKind) throw new SearchLedgerIntegrityError(`operation ${event.operationId} kind ${event.operationKind} does not match planned ${plannedOperation.kind}`);
+			if (operationsById.has(event.operationId)) throw new SearchLedgerIntegrityError(`operation ${event.operationId} was recorded twice`);
+			operationsById.set(event.operationId, event);
+			operationEvents.push(event);
+			return;
+		}
+		if (event.kind === "candidate-slot-closed") {
+			const plannedSlot = planEvent.plan.candidateSlots.find((slot) => slot.slotId === event.slotId);
+			if (!plannedSlot) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} references unknown slot ${event.slotId}`);
+			if (event.generationOperationId !== plannedSlot.generationOperationId) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} generation operation ${event.generationOperationId} does not match slot ${event.slotId} plan ${plannedSlot.generationOperationId}`);
+			if (candidateBySlot.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was already bound to a candidate`);
+			if (closedSlots.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was closed twice`);
+			const operation = operationsById.get(event.generationOperationId);
+			if (!operation) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} precedes operation ${event.generationOperationId}`);
+			if (operation.outcome.status === "completed") throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} cannot close from completed operation ${event.generationOperationId}`);
+			closedSlots.set(event.slotId, event);
+			closedSlotEvents.push(event);
+			return;
+		}
+		if (event.kind === "candidate-decided") {
+			const candidate = candidates.get(event.candidateId);
+			if (!candidate) throw new SearchLedgerIntegrityError(`decision ${event.eventId} references unknown candidate ${event.candidateId}`);
+			if (candidate.decision) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} was decided twice`);
+			if (event.decision.status === "selected") {
+				if (!candidate.attempts.some((attempt) => attempt.outcome.status !== "errored")) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} cannot be selected without a measured task outcome`);
+				if (decisions.some((decision) => decision.decision.status === "selected")) throw new SearchLedgerIntegrityError("more than one candidate was selected");
+			}
+			candidate.decision = event;
+			decisions.push(event);
+			return;
+		}
+		const missingCandidateSlots = planEvent.plan.candidateSlots.filter((slot) => !candidateBySlot.has(slot.slotId) && !closedSlots.has(slot.slotId)).map((slot) => slot.slotId);
+		if (missingCandidateSlots.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing candidate slots: ${missingCandidateSlots.join(", ")}`);
+		const missingTaskOutcomes = plannedTaskOutcomeKeys(planEvent, candidates);
+		if (missingTaskOutcomes.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing task outcomes: ${missingTaskOutcomes.join(", ")}`);
+		const missingOperations = planEvent.plan.operations.filter((operation) => !operationsById.has(operation.operationId)).map((operation) => operation.operationId);
+		if (missingOperations.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing search operations: ${missingOperations.join(", ")}`);
+		for (const operation of planEvent.plan.operations) {
+			if (operation.kind !== "candidate-generation") continue;
+			const generationOutcome = operationsById.get(operation.operationId).outcome.status;
+			const slots = planEvent.plan.candidateSlots.filter((slot) => slot.generationOperationId === operation.operationId);
+			if (slots.length === 0) continue;
+			const registeredCount = slots.filter((slot) => candidateBySlot.has(slot.slotId)).length;
+			const closedCount = slots.filter((slot) => closedSlots.has(slot.slotId)).length;
+			if (generationOutcome === "completed" && closedCount > 0) throw new SearchLedgerIntegrityError(`completed generation operation ${operation.operationId} contains ${closedCount} closed slot(s)`);
+			if (generationOutcome === "failed" && registeredCount > 0) throw new SearchLedgerIntegrityError(`failed generation operation ${operation.operationId} contains ${registeredCount} registered candidate(s)`);
+			if (generationOutcome === "partial" && (registeredCount === 0 || closedCount === 0)) throw new SearchLedgerIntegrityError(`partial generation operation ${operation.operationId} must contain both a registered candidate and a closed slot`);
+		}
+		const pending = [...candidates.values()].filter((candidate) => candidate.decision === null);
+		if (pending.length > 0) throw new SearchLedgerIntegrityError(`search completed with ${pending.length} candidate decision(s) missing`);
+		const selected = decisions.filter((decision) => decision.decision.status === "selected");
+		if (event.result.status === "selected") {
+			if (selected.length !== 1 || selected[0].candidateId !== event.result.candidateId) throw new SearchLedgerIntegrityError(`search completion winner ${event.result.candidateId} does not match candidate decisions`);
+		} else if (selected.length !== 0) throw new SearchLedgerIntegrityError("all-rejected completion contains a selected candidate");
+		completion = event;
+	};
+	const finish = (entries) => {
+		const selectedDecisions = decisions.filter((decision) => decision.decision.status === "selected");
+		const rejectedDecisions = decisions.filter((decision) => decision.decision.status === "rejected");
+		const outcomeCounts = {
+			passed: 0,
+			failed: 0,
+			errored: 0
+		};
+		const operationOutcomeCounts = {
+			completed: 0,
+			partial: 0,
+			failed: 0
+		};
+		let inputTokens = 0;
+		let outputTokens = 0;
+		let cachedTokens = 0;
+		let costUsd = 0;
+		const unknownTokenEventIds = [];
+		const unknownCostEventIds = [];
+		for (const attempt of attempts) outcomeCounts[attempt.outcome.status] += 1;
+		for (const operation of operationEvents) operationOutcomeCounts[operation.outcome.status] += 1;
+		for (const costedEvent of [...attempts, ...operationEvents]) {
+			if (costedEvent.accounting.tokens.status === "known") {
+				inputTokens += costedEvent.accounting.tokens.inputTokens;
+				outputTokens += costedEvent.accounting.tokens.outputTokens;
+				cachedTokens += costedEvent.accounting.tokens.cachedTokens;
+			} else unknownTokenEventIds.push(costedEvent.eventId);
+			if (costedEvent.accounting.cost.status === "known") costUsd += costedEvent.accounting.cost.usd;
+			else {
+				costUsd += costedEvent.accounting.cost.knownLowerBoundUsd;
+				unknownCostEventIds.push(costedEvent.eventId);
+			}
+		}
+		const accounting = unknownTokenEventIds.length === 0 && unknownCostEventIds.length === 0 ? {
+			status: "known",
+			inputTokens,
+			outputTokens,
+			cachedTokens,
+			costUsd
+		} : {
+			status: "partial",
+			knownInputTokens: inputTokens,
+			knownOutputTokens: outputTokens,
+			knownCachedTokens: cachedTokens,
+			knownCostUsd: costUsd,
+			unknownTokenEventIds,
+			unknownCostEventIds
+		};
+		const selectedCandidateId = completion?.result.status === "selected" ? completion.result.candidateId : null;
+		const status = completion?.result.status === "selected" ? "selected" : completion?.result.status === "all-rejected" ? "all-rejected" : "in-progress";
+		const missingCandidateSlots = planEvent?.plan.candidateSlots.filter((slot) => !candidateBySlot.has(slot.slotId) && !closedSlots.has(slot.slotId)).map((slot) => slot.slotId) ?? [];
+		const missingTaskOutcomes = planEvent ? plannedTaskOutcomeKeys(planEvent, candidates) : [];
+		const missingOperations = planEvent?.plan.operations.filter((operation) => !operationsById.has(operation.operationId)).map((operation) => operation.operationId) ?? [];
+		return {
+			entries: [...entries],
+			plan: planEvent,
+			candidates: candidateEvents,
+			closedCandidateSlots: closedSlotEvents,
+			attempts,
+			operations: operationEvents,
+			decisions,
+			completion,
+			audit: {
+				campaignId,
+				eventCount: entries.length,
+				candidateCount: candidates.size,
+				closedCandidateSlotCount: closedSlots.size,
+				attemptCount: attempts.length,
+				operationCount: operationEvents.length,
+				outcomes: outcomeCounts,
+				operationOutcomes: operationOutcomeCounts,
+				decisions: {
+					selected: selectedDecisions.length,
+					rejected: rejectedDecisions.length,
+					pending: candidates.size - decisions.length
+				},
+				expected: {
+					candidateSlots: planEvent?.plan.candidateSlots.length ?? 0,
+					taskOutcomes: candidates.size * (planEvent?.plan.tasks.length ?? 0),
+					operations: planEvent?.plan.operations.length ?? 0,
+					missingCandidateSlots,
+					missingTaskOutcomes,
+					missingOperations
+				},
+				status,
+				selectedCandidateId,
+				accounting,
+				headHash: entries.at(-1)?.entryHash ?? null
+			}
+		};
+	};
+	return {
+		apply,
+		finish
+	};
+}
+function plannedTaskOutcomeKeys(planEvent, candidates) {
+	const missing = [];
+	const registeredCandidates = [...candidates.values()].sort((a, b) => compareStrings(a.registered.slotId, b.registered.slotId));
+	for (const candidate of registeredCandidates) {
+		const slotId = candidate.registered.slotId;
+		for (const task of planEvent.plan.tasks) if (!candidate.attempts.some((attempt) => attempt.task.taskId === task.taskId && attempt.outcome.status !== "errored")) missing.push(`${slotId}/${task.taskId}`);
+	}
+	return missing;
+}
+function normalizeEvent(event) {
+	const artifacts = sortArtifacts(event.artifacts);
+	if (event.kind === "search-planned") return {
+		...event,
+		artifacts,
+		plan: {
+			candidateSlots: [...event.plan.candidateSlots].sort((a, b) => compareStrings(a.slotId, b.slotId)),
+			tasks: [...event.plan.tasks].sort((a, b) => compareStrings(a.taskId, b.taskId)),
+			operations: [...event.plan.operations].sort((a, b) => compareStrings(a.operationId, b.operationId))
+		}
+	};
+	if (event.kind === "candidate-registered") return {
+		...event,
+		artifacts,
+		lineage: {
+			...event.lineage,
+			parentCandidateIds: sortedStrings(event.lineage.parentCandidateIds)
+		},
+		surfaces: [...event.surfaces].map((surface) => ({
+			...surface,
+			artifact: { ...surface.artifact }
+		})).sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
+	};
+	if (event.kind === "task-attempted") return {
+		...event,
+		artifacts,
+		surfaceEvidence: [...event.surfaceEvidence].map((evidence) => ({
+			...evidence,
+			evidence: sortArtifacts(evidence.evidence)
+		})).sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
+	};
+	return {
+		...event,
+		artifacts
+	};
+}
+function sortArtifacts(artifacts) {
+	return [...artifacts].map((artifact) => ({ ...artifact })).sort((a, b) => compareStrings(artifactKey(a), artifactKey(b)));
+}
+function artifactKey(artifact) {
+	return canonicalString(artifact);
+}
+function compareStrings(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+function sortedStrings(values) {
+	return [...values].sort();
+}
+function assertUnique(values, label, eventId) {
+	if (new Set(values).size !== values.length) throw new SearchLedgerIntegrityError(`event ${eventId} contains duplicate ${label} values`);
+}
+function formatZodError(error) {
+	return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`).join("; ");
+}
+//#endregion
+//#region src/campaign/transient-failure.ts
+const BASE_TRANSIENT = /\b50[234]\b|no stream output|produced no stream|admission timed out|admission_rejected|queue_timeout|fetch failed|ECONNRESET|This operation was aborted/i;
+const TIMEOUT_PATTERN = /timeout after \d+ ?ms|cli-bridge timeout/i;
+/**
+* True when the error text describes an infrastructure hiccup that should be
+* retried rather than scored. Empty/undefined input is not transient.
+*/
+function isTransientTransportFailure(message, opts = {}) {
+	if (!message) return false;
+	if (BASE_TRANSIENT.test(message)) return true;
+	if ((opts.retryFullDurationTimeouts ?? false) && TIMEOUT_PATTERN.test(message)) return true;
+	for (const p of opts.extraPatterns ?? []) if (p.test(message)) return true;
+	return false;
+}
+//#endregion
+//#region src/campaign/worktree/index.ts
+/**
+* VCS-pluggable worktree adapter. One improvement = one worktree, PR-like
+* (multiple commits allowed). A code-tier proposer's `propose()` creates a
+* worktree, an agent commits the change into it, and `finalize()` returns a
+* content-addressed `CodeSurface` the measurement verifies before running.
+* On promotion the worktree becomes the PR branch.
+*
+* The interface is VCS-agnostic so a future `jj` ([jj-vcs](https://github.com/jj-vcs/jj))
+* adapter can slot in without touching proposer code. Only the git adapter
+* ships today. See `docs/design/loop-taxonomy.md`.
+*/
+const MAX_GIT_OUTPUT_BYTES = 256 * 1024 * 1024;
+const FILE_HASH_CHUNK_BYTES = 1024 * 1024;
+const GIT_REPOSITORY_ENV = /* @__PURE__ */ new Set([
+	"GIT_ALTERNATE_OBJECT_DIRECTORIES",
+	"GIT_COMMON_DIR",
+	"GIT_DIR",
+	"GIT_INDEX_FILE",
+	"GIT_NAMESPACE",
+	"GIT_OBJECT_DIRECTORY",
+	"GIT_PREFIX",
+	"GIT_QUARANTINE_PATH",
+	"GIT_WORK_TREE"
+]);
+/** Typed failure from a `WorktreeAdapter` operation (create/finalize/discard) — wraps the underlying git error as `cause`. */
+var WorktreeAdapterError = class extends Error {
+	cause;
+	constructor(message, cause) {
+		super(message);
+		this.cause = cause;
+		this.name = "WorktreeAdapterError";
+	}
+};
+function defaultGit(args, cwd, overrides) {
+	try {
+		const env = { ...process.env };
+		for (const key of Object.keys(env)) if (GIT_REPOSITORY_ENV.has(key) || key === "GIT_CONFIG" || key.startsWith("GIT_CONFIG_") || key.startsWith("GIT_ATTR_") || key === "GIT_DIFF_OPTS" || key === "GIT_EXTERNAL_DIFF") delete env[key];
+		Object.assign(env, overrides);
+		env.GIT_NO_REPLACE_OBJECTS = "1";
+		env.LC_ALL = "C";
+		env.LANG = "C";
+		return execFileSync("git", args, {
+			cwd,
+			env,
+			maxBuffer: MAX_GIT_OUTPUT_BYTES
+		});
+	} catch (err) {
+		const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr) : "";
+		throw new WorktreeAdapterError(`git ${args.join(" ")} failed: ${stderr || String(err)}`, err);
+	}
+}
+function gitBytes(git, args, cwd, env) {
+	try {
+		const output = git(args, cwd, env);
+		return typeof output === "string" ? Buffer.from(output, "utf8") : Buffer.from(output);
+	} catch (err) {
+		if (err instanceof WorktreeAdapterError) throw err;
+		throw new WorktreeAdapterError(`git ${args.join(" ")} failed: ${String(err)}`, err);
+	}
+}
+function gitText(git, args, cwd, env) {
+	return gitBytes(git, args, cwd, env).toString("utf8").trim();
+}
+function hasRegisteredWorktree(git, repoRoot, path) {
+	const expected = Buffer.from(`worktree ${resolve(path)}`, "utf8");
+	const records = gitBytes(git, [
+		"worktree",
+		"list",
+		"--porcelain",
+		"-z"
+	], repoRoot);
+	let start = 0;
+	while (start < records.length) {
+		const end = records.indexOf(0, start);
+		if (end < 0) throw new WorktreeAdapterError("Git worktree list output was not NUL-terminated");
+		if (records.subarray(start, end).equals(expected)) return true;
+		start = end + 1;
+	}
+	return false;
+}
+function hasLocalBranch(git, repoRoot, branch) {
+	const ref = `refs/heads/${branch}`;
+	return gitText(git, [
+		"for-each-ref",
+		"--format=%(refname)",
+		"--",
+		ref
+	], repoRoot).split("\n").some((candidate) => candidate === ref);
+}
+function reconcileAbsent(exists, remove) {
+	try {
+		if (!exists()) return void 0;
+	} catch (err) {
+		return err;
+	}
+	try {
+		remove();
+		return;
+	} catch (removeError) {
+		try {
+			if (!exists()) return void 0;
+		} catch (recheckError) {
+			return new AggregateError([removeError, recheckError], "Removal failed and the resulting resource state could not be checked");
+		}
+		return removeError;
+	}
+}
+function sha256(bytes) {
+	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+const PATCH_ARGS = [
+	"-c",
+	"core.compression=0",
+	"-c",
+	`core.attributesFile=${devNull}`,
+	"-c",
+	"core.quotePath=true",
+	"-c",
+	"diff.suppressBlankEmpty=false",
+	"diff",
+	"--unified=3",
+	"--inter-hunk-context=0",
+	`-O${devNull}`,
+	"--binary",
+	"--full-index",
+	"--no-color",
+	"--no-ext-diff",
+	"--no-textconv",
+	"--no-renames",
+	"--diff-algorithm=myers",
+	"--no-indent-heuristic",
+	"--src-prefix=a/",
+	"--dst-prefix=b/"
+];
+const CANONICAL_GIT_ENV = {
+	GIT_ATTR_GLOBAL: devNull,
+	GIT_ATTR_NOSYSTEM: "1",
+	GIT_CONFIG_GLOBAL: devNull,
+	GIT_CONFIG_NOSYSTEM: "1",
+	GIT_CONFIG_SYSTEM: devNull
+};
+/** Render the transport patch from immutable objects through fresh Git metadata.
+*  Source-repository config, info attributes, templates, and caller environment
+*  therefore cannot alter bytes for the same two trees. */
+function patchBytes(git, cwd, baseCommit, candidateCommit) {
+	const scratch = mkdtempSync(join(tmpdir(), "agent-eval-patch-"));
+	const bareRepo = join(scratch, "repo.git");
+	const emptyTemplate = join(scratch, "empty-template");
+	mkdirSync(emptyTemplate);
+	try {
+		const objectFormat = gitObjectHashAlgorithm(candidateCommit);
+		const sourceObjects = realpathSync(gitText(git, [
+			"rev-parse",
+			"--git-path",
+			"objects"
+		], cwd));
+		gitText(git, [
+			"init",
+			"--bare",
+			"--quiet",
+			...objectFormat === "sha256" ? ["--object-format=sha256"] : [],
+			`--template=${emptyTemplate}`,
+			bareRepo
+		], scratch, CANONICAL_GIT_ENV);
+		return gitBytes(git, [
+			`--git-dir=${bareRepo}`,
+			...PATCH_ARGS,
+			baseCommit,
+			candidateCommit,
+			"--"
+		], scratch, {
+			...CANONICAL_GIT_ENV,
+			GIT_ALTERNATE_OBJECT_DIRECTORIES: sourceObjects
+		});
+	} finally {
+		rmSync(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function resolveCommit(git, cwd, ref) {
+	return gitText(git, [
+		"rev-parse",
+		"--verify",
+		`${ref}^{commit}`
+	], cwd);
+}
+function unresolvedWorktreePath(surface, worktreeDir) {
+	if (isAbsolute(surface.worktreeRef)) return surface.worktreeRef;
+	if (worktreeDir) return join(worktreeDir, basename(surface.worktreeRef));
+	return surface.worktreeRef;
+}
+function displayGitPath(path) {
+	return JSON.stringify(path);
+}
+function parseGitTreeEntries(bytes) {
+	const input = Buffer.from(bytes);
+	const entries = [];
+	let start = 0;
+	while (start < input.length) {
+		const end = input.indexOf(0, start);
+		if (end < 0) throw new WorktreeAdapterError("Git tree output was not NUL-terminated");
+		const record = input.subarray(start, end);
+		start = end + 1;
+		if (record.length === 0) continue;
+		const tab = record.indexOf(9);
+		if (tab < 0) throw new WorktreeAdapterError("Git tree entry did not contain a path");
+		const metadata = record.subarray(0, tab).toString("ascii").split(" ");
+		if (metadata.length !== 3) throw new WorktreeAdapterError("Git tree entry was malformed");
+		const mode = metadata[0];
+		const type = metadata[1];
+		const objectId = metadata[2];
+		if (!mode || !type || !objectId) throw new WorktreeAdapterError("Git tree entry was malformed");
+		const pathBytes = record.subarray(tab + 1);
+		const path = pathBytes.toString("utf8");
+		if (!Buffer.from(path, "utf8").equals(pathBytes)) throw new WorktreeAdapterError("CodeSurface paths must be valid UTF-8");
+		if (type !== "blob" && type !== "commit") throw new WorktreeAdapterError(`CodeSurface contains unsupported Git object type ${type} at ${displayGitPath(path)}`);
+		entries.push({
+			mode,
+			objectId,
+			path
+		});
+	}
+	return entries;
+}
+function parseGitPathList(bytes) {
+	const input = Buffer.from(bytes);
+	const paths = [];
+	let start = 0;
+	while (start < input.length) {
+		const end = input.indexOf(0, start);
+		if (end < 0) throw new WorktreeAdapterError("Git path output was not NUL-terminated");
+		const pathBytes = input.subarray(start, end);
+		start = end + 1;
+		if (pathBytes.length === 0) continue;
+		const path = pathBytes.toString("utf8");
+		if (!Buffer.from(path, "utf8").equals(pathBytes)) throw new WorktreeAdapterError("CodeSurface paths must be valid UTF-8");
+		paths.push(path);
+	}
+	return paths;
+}
+function isWithinRoot(root, candidate) {
+	const rel = relative(root, candidate);
+	return rel === "" || !isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`);
+}
+function assertSafeRelativePath(root, path) {
+	if (path.length === 0 || isAbsolute(path)) throw new WorktreeAdapterError(`CodeSurface contains unsafe path ${displayGitPath(path)}`);
+	const absolutePath = resolve(root, path);
+	if (!isWithinRoot(root, absolutePath) || absolutePath === root) throw new WorktreeAdapterError(`CodeSurface path escapes its worktree: ${displayGitPath(path)}`);
+	const segments = path.split(/[\\/]/u);
+	let parent = root;
+	for (const segment of segments.slice(0, -1)) {
+		if (segment.length === 0 || segment === "." || segment === "..") throw new WorktreeAdapterError(`CodeSurface contains unsafe path ${displayGitPath(path)}`);
+		parent = join(parent, segment);
+		const stat = lstatSync(parent);
+		if (!stat.isDirectory() || stat.isSymbolicLink()) throw new WorktreeAdapterError(`CodeSurface path traverses a non-directory or symbolic link: ${displayGitPath(path)}`);
+	}
+	return absolutePath;
+}
+function gitObjectHashAlgorithm(objectId) {
+	if (/^[a-f0-9]{40}$/.test(objectId)) return "sha1";
+	if (/^[a-f0-9]{64}$/.test(objectId)) return "sha256";
+	throw new WorktreeAdapterError(`Unsupported Git object id: ${objectId}`);
+}
+function hashGitBlobBytes(bytes, objectId) {
+	const hash = createHash(gitObjectHashAlgorithm(objectId));
+	hash.update(`blob ${bytes.byteLength}\0`);
+	hash.update(bytes);
+	return hash.digest("hex");
+}
+function hashGitBlobFile(path, objectId) {
+	const before = lstatSync(path);
+	if (!before.isFile() || before.isSymbolicLink()) throw new WorktreeAdapterError(`CodeSurface expected a regular file at ${displayGitPath(path)}`);
+	const noFollow = process.platform === "win32" ? 0 : constants.O_NOFOLLOW;
+	const fd = openSync(path, constants.O_RDONLY | noFollow);
+	try {
+		const opened = fstatSync(fd);
+		if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size) throw new WorktreeAdapterError(`CodeSurface file changed while it was being verified: ${displayGitPath(path)}`);
+		const hash = createHash(gitObjectHashAlgorithm(objectId));
+		hash.update(`blob ${opened.size}\0`);
+		const chunk = Buffer.allocUnsafe(FILE_HASH_CHUNK_BYTES);
+		let total = 0;
+		while (true) {
+			const count = readSync(fd, chunk, 0, chunk.length, null);
+			if (count === 0) break;
+			total += count;
+			hash.update(chunk.subarray(0, count));
+		}
+		if (total !== opened.size) throw new WorktreeAdapterError(`CodeSurface file changed while it was being verified: ${displayGitPath(path)}`);
+		return {
+			hash: hash.digest("hex"),
+			executable: (opened.mode & 73) !== 0
+		};
+	} finally {
+		closeSync(fd);
+	}
+}
+function assertSymlinkTargetIsBound(root, linkPath, trackedPaths) {
+	const targetBytes = readlinkSync(linkPath, { encoding: "buffer" });
+	const target = targetBytes.toString("utf8");
+	if (!Buffer.from(target, "utf8").equals(targetBytes)) throw new WorktreeAdapterError(`CodeSurface symbolic link has an unsafe target at ${displayGitPath(linkPath)}`);
+	if (isAbsolute(target)) throw new WorktreeAdapterError(`CodeSurface symbolic link escapes its worktree at ${displayGitPath(linkPath)}`);
+	if (!isWithinRoot(root, resolve(dirname(linkPath), target))) throw new WorktreeAdapterError(`CodeSurface symbolic link escapes its worktree at ${displayGitPath(linkPath)}`);
+	let resolvedTarget;
+	try {
+		resolvedTarget = realpathSync(linkPath);
+	} catch (err) {
+		throw new WorktreeAdapterError(`CodeSurface symbolic link target is missing or cyclic at ${displayGitPath(linkPath)}`, err);
+	}
+	if (!isWithinRoot(root, resolvedTarget)) throw new WorktreeAdapterError(`CodeSurface symbolic link escapes its worktree at ${displayGitPath(linkPath)}`);
+	const targetRelative = relative(root, resolvedTarget).split(sep).join("/");
+	if (!(trackedPaths.has(targetRelative) || [...trackedPaths].some((trackedPath) => trackedPath.startsWith(`${targetRelative}/`)))) throw new WorktreeAdapterError(`CodeSurface symbolic link resolves to untracked content at ${displayGitPath(linkPath)}`);
+}
+function assertRawTreeMatchesWorktree(git, root, candidateCommit) {
+	const entries = parseGitTreeEntries(gitBytes(git, [
+		"ls-tree",
+		"-r",
+		"-z",
+		"--full-tree",
+		candidateCommit
+	], root));
+	const trackedPaths = new Set(entries.map((entry) => entry.path));
+	for (const entry of entries) {
+		const absolutePath = assertSafeRelativePath(root, entry.path);
+		if (entry.mode === "160000" || entry.mode === "040000") throw new WorktreeAdapterError(`CodeSurface contains a Git submodule whose executable bytes are not bound: ${displayGitPath(entry.path)}`);
+		if (entry.mode === "120000") {
+			if (!lstatSync(absolutePath).isSymbolicLink()) throw new WorktreeAdapterError(`CodeSurface expected a symbolic link at ${displayGitPath(entry.path)}`);
+			if (hashGitBlobBytes(readlinkSync(absolutePath, { encoding: "buffer" }), entry.objectId) !== entry.objectId) throw new WorktreeAdapterError(`CodeSurface raw symbolic-link bytes differ from the candidate tree at ${displayGitPath(entry.path)}`);
+			assertSymlinkTargetIsBound(root, absolutePath, trackedPaths);
+			continue;
+		}
+		if (entry.mode !== "100644" && entry.mode !== "100755") throw new WorktreeAdapterError(`CodeSurface contains unsupported Git mode ${entry.mode} at ${displayGitPath(entry.path)}`);
+		const actual = hashGitBlobFile(absolutePath, entry.objectId);
+		if (actual.hash !== entry.objectId) throw new WorktreeAdapterError(`CodeSurface raw tracked bytes differ from the candidate tree because the worktree changed after finalization at ${displayGitPath(entry.path)}`);
+		if (process.platform !== "win32" && actual.executable !== (entry.mode === "100755")) throw new WorktreeAdapterError(`CodeSurface executable mode differs from the candidate tree at ${displayGitPath(entry.path)}`);
+	}
+}
+function verifyCodeSurfaceWithGit(surface, path, git) {
+	assertCodeSurfaceIdentity(surface);
+	if (!existsSync(path)) throw new WorktreeAdapterError(`CodeSurface worktree does not exist: ${path}`);
+	const lexicalRoot = resolve(path);
+	const canonicalRoot = realpathSync(path);
+	if (lstatSync(lexicalRoot).isSymbolicLink() || process.platform !== "win32" && lexicalRoot !== canonicalRoot) throw new WorktreeAdapterError(`CodeSurface worktree locator must not contain a symbolic link: ${path}`);
+	const repoRoot = gitText(git, ["rev-parse", "--show-toplevel"], path);
+	const canonicalRepoRoot = realpathSync(repoRoot);
+	if (canonicalRepoRoot !== canonicalRoot) throw new WorktreeAdapterError(`CodeSurface worktree locator is not the repository root: expected ${repoRoot}, got ${path}`);
+	const indexFlags = gitText(git, ["ls-files", "-v"], path).split("\n").filter((line) => line.length > 0 && (line.startsWith("S ") || /^[a-z]/.test(line)));
+	if (indexFlags.length > 0) throw new WorktreeAdapterError(`CodeSurface worktree uses hidden index entries that cannot be verified: ${path}\n${indexFlags.join("\n")}`);
+	const extraPaths = [...parseGitPathList(gitBytes(git, [
+		"ls-files",
+		"--others",
+		"--exclude-standard",
+		"-z"
+	], path)), ...parseGitPathList(gitBytes(git, [
+		"ls-files",
+		"--others",
+		"--ignored",
+		"--exclude-standard",
+		"-z"
+	], path))];
+	if (extraPaths.length > 0) throw new WorktreeAdapterError(`CodeSurface worktree changed after finalization: ${path}\n${extraPaths.join("\n")}`);
+	const candidateCommit = resolveCommit(git, path, "HEAD");
+	if (candidateCommit !== surface.candidateCommit) throw new WorktreeAdapterError(`CodeSurface candidate commit mismatch: expected ${surface.candidateCommit}, got ${candidateCommit}`);
+	const baseCommit = resolveCommit(git, path, surface.baseCommit);
+	if (baseCommit !== surface.baseCommit) throw new WorktreeAdapterError(`CodeSurface base commit mismatch: expected ${surface.baseCommit}, got ${baseCommit}`);
+	const baseTree = gitText(git, [
+		"rev-parse",
+		"--verify",
+		`${surface.baseCommit}^{tree}`
+	], path);
+	if (baseTree !== surface.baseTree) throw new WorktreeAdapterError(`CodeSurface base tree mismatch: expected ${surface.baseTree}, got ${baseTree}`);
+	const candidateTree = gitText(git, [
+		"rev-parse",
+		"--verify",
+		`${surface.candidateCommit}^{tree}`
+	], path);
+	if (candidateTree !== surface.candidateTree) throw new WorktreeAdapterError(`CodeSurface tree mismatch: expected ${surface.candidateTree}, got ${candidateTree}`);
+	try {
+		gitText(git, [
+			"diff-index",
+			"--cached",
+			"--quiet",
+			"--no-ext-diff",
+			"--no-textconv",
+			surface.candidateCommit,
+			"--"
+		], path);
+	} catch (err) {
+		throw new WorktreeAdapterError(`CodeSurface index differs from finalized candidate: ${path}`, err);
+	}
+	try {
+		assertRawTreeMatchesWorktree(git, canonicalRepoRoot, surface.candidateCommit);
+	} catch (err) {
+		if (err instanceof WorktreeAdapterError) throw err;
+		throw new WorktreeAdapterError(`CodeSurface raw tree verification failed: ${path}`, err);
+	}
+	if (gitText(git, [
+		"merge-base",
+		surface.baseCommit,
+		surface.candidateCommit
+	], path) !== surface.baseCommit) throw new WorktreeAdapterError(`CodeSurface candidate ${surface.candidateCommit} does not descend from base ${surface.baseCommit}`);
+	const patch = patchBytes(git, path, surface.baseCommit, surface.candidateCommit);
+	const actualPatchHash = sha256(patch);
+	if (actualPatchHash !== surface.patch.sha256 || patch.byteLength !== surface.patch.byteLength) throw new WorktreeAdapterError(`CodeSurface patch mismatch: expected ${surface.patch.sha256}/${surface.patch.byteLength} bytes, got ${actualPatchHash}/${patch.byteLength} bytes`);
+	return {
+		path,
+		repoRoot: canonicalRepoRoot,
+		contentHash: surfaceContentHash(surface),
+		patchBytes: new Uint8Array(patch)
+	};
+}
+/** Slugify a label into a branch-safe segment. */
+function slug(label) {
+	return label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "candidate";
+}
+/**
+* Git-backed `WorktreeAdapter`: creates isolated worktrees on fresh branches, commits agent changes, and discards losers.
+*/
+function gitWorktreeAdapter(opts) {
+	const git = opts.git ?? defaultGit;
+	const worktreeDir = opts.worktreeDir ?? join(opts.repoRoot, ".worktrees");
+	const branchPrefix = opts.branchPrefix ?? "improve";
+	return {
+		async create({ baseRef, label }) {
+			const id = `${slug(label)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
+			const branch = `${branchPrefix}/${id}`;
+			const path = join(worktreeDir, id);
+			const baseCommit = resolveCommit(git, opts.repoRoot, baseRef);
+			const baseTree = gitText(git, [
+				"rev-parse",
+				"--verify",
+				`${baseCommit}^{tree}`
+			], opts.repoRoot);
+			gitText(git, [
+				"worktree",
+				"add",
+				"-b",
+				branch,
+				path,
+				baseCommit
+			], opts.repoRoot);
+			return {
+				path,
+				branch,
+				baseRef,
+				baseCommit,
+				baseTree
+			};
+		},
+		async finalize(worktree, summary) {
+			if (gitText(git, [
+				"status",
+				"--porcelain=v1",
+				"--untracked-files=all"
+			], worktree.path).length > 0) {
+				gitText(git, ["add", "-A"], worktree.path);
+				gitText(git, [
+					"commit",
+					"-m",
+					summary
+				], worktree.path);
+			}
+			const candidateCommit = resolveCommit(git, worktree.path, "HEAD");
+			const candidateTree = gitText(git, [
+				"rev-parse",
+				"--verify",
+				`${candidateCommit}^{tree}`
+			], worktree.path);
+			const patch = patchBytes(git, worktree.path, worktree.baseCommit, candidateCommit);
+			const surface = {
+				kind: "code",
+				worktreeRef: worktree.path,
+				baseRef: worktree.baseRef,
+				baseCommit: worktree.baseCommit,
+				baseTree: worktree.baseTree,
+				candidateCommit,
+				candidateTree,
+				patch: {
+					format: "git-diff-binary",
+					sha256: sha256(patch),
+					byteLength: patch.byteLength
+				},
+				summary
+			};
+			verifyCodeSurfaceWithGit(surface, worktree.path, git);
+			return surface;
+		},
+		async discard(worktree) {
+			const failures = [reconcileAbsent(() => hasRegisteredWorktree(git, opts.repoRoot, worktree.path), () => gitText(git, [
+				"worktree",
+				"remove",
+				"--force",
+				"--",
+				worktree.path
+			], opts.repoRoot)), reconcileAbsent(() => hasLocalBranch(git, opts.repoRoot, worktree.branch), () => gitText(git, [
+				"branch",
+				"-D",
+				"--",
+				worktree.branch
+			], opts.repoRoot))].filter((failure) => failure !== void 0);
+			if (failures.length > 0) {
+				const cause = failures.length === 1 ? failures[0] : new AggregateError(failures, "Multiple Git resources could not be removed");
+				throw new WorktreeAdapterError(`Failed to discard worktree ${worktree.path} and branch ${worktree.branch}`, cause);
+			}
+		}
+	};
+}
+/** Verify a finalized code surface against its current checkout. This rejects
+*  dirty/ignored files, moved refs, missing Git objects, raw byte/mode
+*  mismatches, external symlinks, and submodules. */
+function verifyCodeSurface(surface, worktreeDir) {
+	return verifyCodeSurfaceWithGit(surface, unresolvedWorktreePath(surface, worktreeDir), defaultGit);
+}
+/** Resolve a code candidate for evaluation only after verifying its immutable
+*  identity against the checkout at `worktreeRef`. */
+function resolveWorktreePath(surface, worktreeDir) {
+	return verifyCodeSurface(surface, worktreeDir).path;
+}
+//#endregion
+export { planEvalFixtureRun as A, harnessAxisOf as B, rolloutArgumentDiff as C, discoverEvalFixtures as D, neutralizationGate as E, HARNESS_NATIVE_MODEL as F, parseCorrectnessResponse as G, completionVerdict as H, agentProfileHash as I, verifyCompletion as K, agentProfileId as L, buildAnalystSurfaceDispatch as M, failureModeRecallJudge as N, loadEvalFixture as O, CODING_HARNESSES as P, agentProfileModelId as R, classifyUngroundedLiterals as S, sequentialPairedGate as T, createLlmCorrectnessChecker as U, extractProducedState as V, createTokenRecallChecker as W, scoreboardSummary as _, isTransientTransportFailure as a, FsLabeledScenarioStore as b, openSearchLedger as c, selectDiscriminative as d, ProfileMatrixError as f, scoreUserStory as g, renderScoreboardMarkdown as h, verifyCodeSurface as i, analyzeCrossSurfaceInteractions as j, loadEvalFixtureScenarios as k, validateSearchLedgerEvent as l, makePlaybackDispatch as m, gitWorktreeAdapter as n, FileSearchLedger as o, runProfileMatrix as p, resolveWorktreePath as r, SEARCH_LEDGER_SCHEMA as s, WorktreeAdapterError as t, scoreDiscrimination as u, userStoryScoreboard as v, sequentialDecide as w, LabeledScenarioStoreError as x, neutralizeText as y, expandProfileAxes as z };
+
+//# sourceMappingURL=campaign-aKJt6emI.js.map