@tangle-network/agent-eval 0.174.0 → 0.176.0

package/dist/{llm-judge-DmNaBrXB.js → llm-judge-DliimmRb.js}

@@ -1,15 +1,16 @@
-import { i as JudgeError, s as ValidationError, t as AgentEvalError } from "./errors-Dngq5h35.js";
+import { i as JudgeError, s as ValidationError } from "./errors-Dngq5h35.js";
 import { a as hashCanonical, i as compareCodeUnits, r as canonicalString } from "./canonical-DPyQ_rpt.js";
 import { o as summarizeNumberSeries, s as weightedComposite, t as confidenceInterval } from "./descriptive-1V17A-qa.js";
 import { r as pairedBootstrap } from "./paired-tests-C8iCsioC.js";
-import { i as modelHasSnapshot } from "./run-record-ZIsR9Fif.js";
+import { i as modelHasSnapshot } from "./run-record-DQpSf7t-.js";
 import { n as contentHash } from "./verdict-cache-B3eCVQtY.js";
-import { a as campaignCellCostProvenance, o as campaignCellExecutionEvidence, t as detectRewardHacking, u as projectCampaignCellQuality } from "./reward-hacking-CKW4teig.js";
+import { o as projectCampaignCellQuality, t as campaignCellCostProvenance } from "./run-record-CR63CpHK.js";
 import { i as CostLedger, t as CostAccountingIncompleteError } from "./cost-ledger-B1qx30B4.js";
-import { u as mapConcurrent } from "./ledger-core-PIfjCbKn.js";
-import { S as fsCampaignStorage, g as isRecord, h as isExternalTextCandidate, x as createRunCostLedger } from "./external-optimizer-subprocess-CQi27uEI.js";
+import { $ as campaignScenarioIdentity, C as campaignMeanCompositeOrNull, G as surfaceHashMatches, H as surfaceContentHash, K as BackendIntegrityError, M as heldoutSignificance, N as pairHoldout, Q as campaignCoverage, S as campaignMeanComposite, U as surfaceDispatchRef, V as renderSurfaceDiff, W as surfaceHash, X as assertCampaignSplitIdentity, Y as assertCampaignDesign, Z as assertCompleteCampaign, b as assertFiniteRankKey, et as campaignSplitDigest, j as dimensionRegressions, nt as formatCoverageFailures, t as createCampaignEvidenceReceipt, w as compareRankKeys, x as campaignBreakdown } from "./campaign-evidence-D8DBLqLI.js";
+import { d as mapConcurrent, n as replayLedgerText, t as FileLedgerJournal } from "./ledger-core-Cs9f7385.js";
+import { D as SearchLedgerIntegrityError, E as SearchLedgerError, S as fsCampaignStorage, T as SearchLedgerConflictError, g as isRecord, h as isExternalTextCandidate, w as SEARCH_LEDGER_FILE_CONTEXT, x as createRunCostLedger } from "./external-optimizer-subprocess-q3VzlGAO.js";
 import { t as DEFAULT_REDACTION_RULES } from "./redact-7Aq1ukl-.js";
-import { a as heldoutSignificance, i as dimensionRegressions, o as pairHoldout } from "./power-preflight-CFXm0Vjo.js";
+import { t as detectRewardHacking } from "./reward-hacking-D0XwhVWE.js";
 import { n as assertProposalFindings, t as combineAbortSignals } from "./abort-signal-CtzAM_sJ.js";
 import { l as deepFreezeCanonicalJson } from "./types-DQ0e2E7y.js";
 import { d as stripFencedJson, o as costReceiptFromLlm, s as costReceiptFromLlmError, u as maximumChargeForLlmRequest } from "./llm-client-CGlSi8sb.js";
@@ -19,6 +20,7 @@ import { z } from "zod";
 import { basename, isAbsolute, join } from "node:path";
 import { homedir, tmpdir } from "node:os";
 import { execSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 //#region src/campaign/campaign-manifest.ts
 /**
 * Campaign identity: the manifest hash over (scenarios, judges, dispatch,
@@ -286,251 +288,6 @@ function invalidCachedCellsError(cells) {
 	return new CostAccountingIncompleteError(`runCampaign: cached cell(s) require explicit paid re-dispatch: ${cells.map((cell) => `${cell.cellId} (${cell.reason}${cell.detail ? `: ${cell.detail}` : ""})`).join(", ")}; refusing to begin campaign. Inspect planCampaignRun, then set rerunInvalidCachedCells: true to rerun only these cells while retaining valid caches, or resumable: false when a full rerun is intended.`);
 }
 //#endregion
-//#region src/campaign/coverage.ts
-/** Reject campaign designs whose denominator cannot be identified exactly. */
-function assertCampaignDesign(scenarios, reps) {
-	if (!Number.isSafeInteger(reps) || reps < 1) throw new Error("campaign design requires reps to be a positive safe integer");
-	const scenarioIds = /* @__PURE__ */ new Set();
-	for (const scenario of scenarios) {
-		if (typeof scenario.id !== "string" || scenario.id.trim().length === 0) throw new Error("campaign design requires every scenario to have a non-empty id");
-		if (scenarioIds.has(scenario.id)) throw new Error(`campaign design contains duplicate scenario id '${scenario.id}'`);
-		if (typeof scenario.kind !== "string" || scenario.kind.trim().length === 0) throw new Error("campaign design requires every scenario to have a non-empty kind");
-		if (scenario.seedGroup !== void 0 && (typeof scenario.seedGroup !== "string" || scenario.seedGroup.trim().length === 0)) throw new Error("campaign design requires seedGroup to be a non-empty string when set");
-		scenarioIds.add(scenario.id);
-	}
-}
-/** Redacted but independently verifiable identity of one complete scenario. */
-function campaignScenarioIdentity(scenario) {
-	assertCampaignDesign([scenario], 1);
-	return {
-		id: scenario.id,
-		kind: scenario.kind,
-		scenarioDigest: `sha256:${contentHash(scenario)}`
-	};
-}
-/** Canonical split identity reconstructed from redacted scenario identities. */
-function campaignSplitDigestFromIdentities(scenarios, reps) {
-	assertCampaignDesign(scenarios, reps);
-	for (const scenario of scenarios) if (!/^sha256:[a-f0-9]{64}$/.test(scenario.scenarioDigest)) throw new Error(`campaign scenario '${scenario.id}' has an invalid digest`);
-	return `sha256:${contentHash({
-		schema: "tangle.campaign-split",
-		scenarios: scenarios.map(({ id, kind, scenarioDigest }) => ({
-			id,
-			kind,
-			scenarioDigest
-		})),
-		reps
-	})}`;
-}
-/** Canonical identity of the exact scenario payloads and replicate count. */
-function campaignSplitDigest(scenarios, reps) {
-	assertCampaignDesign(scenarios, reps);
-	return campaignSplitDigestFromIdentities(scenarios.map(campaignScenarioIdentity), reps);
-}
-/** Refuse a campaign whose retained task identities contradict its split digest. */
-function assertCampaignSplitIdentity(scenarios, reps, splitDigest) {
-	if (campaignSplitDigestFromIdentities(scenarios, reps) !== splitDigest) throw new Error("campaign split digest does not match its retained scenario identities");
-}
-/** Exact designed-denominator receipt for one campaign. */
-function campaignCoverage(cells, scenarios, reps, requireJudgeScore) {
-	assertCampaignDesign(scenarios, reps);
-	const expectedCellIds = designedCellIds(scenarios, reps);
-	const cellsById = /* @__PURE__ */ new Map();
-	for (const cell of cells) {
-		const matches = cellsById.get(cell.cellId) ?? [];
-		matches.push(cell);
-		cellsById.set(cell.cellId, matches);
-	}
-	const scorableCellIds = [];
-	const unscorableCells = [];
-	for (const cellId of expectedCellIds) {
-		const matches = cellsById.get(cellId) ?? [];
-		if (matches.length === 0) {
-			unscorableCells.push({
-				cellId,
-				reason: "missing campaign cell"
-			});
-			continue;
-		}
-		if (matches.length > 1) {
-			unscorableCells.push({
-				cellId,
-				reason: `duplicate campaign cell (${matches.length})`
-			});
-			continue;
-		}
-		const cell = matches[0];
-		const scoreEntries = Object.entries(cell.judgeScores);
-		const successfulScores = scoreEntries.map(([, score]) => score).filter((score) => score.failed !== true && Number.isFinite(score.composite));
-		const nonFiniteScores = scoreEntries.filter(([, score]) => score.failed !== true && (!Number.isFinite(score.composite) || Object.values(score.dimensions).some((value) => !Number.isFinite(value))));
-		const reasons = [];
-		if (cell.error) reasons.push(cell.error);
-		if (cell.artifact === null || cell.artifact === void 0) reasons.push("missing artifact");
-		if (!cell.error && requireJudgeScore && successfulScores.length === 0) reasons.push("no successful finite judge score");
-		if (scoreEntries.some(([, score]) => score.failed === true)) reasons.push("judge score marked failed");
-		const failedPanelJudges = [...new Set(scoreEntries.flatMap(([, score]) => score.failedJudges ?? []))].sort();
-		if (failedPanelJudges.length > 0) reasons.push(`judge panel incomplete: ${failedPanelJudges.join(", ")}`);
-		if (nonFiniteScores.length > 0) reasons.push(`non-finite judge score: ${nonFiniteScores.map(([name]) => name).sort().join(", ")}`);
-		if (reasons.length > 0) unscorableCells.push({
-			cellId,
-			reason: reasons.join("; ")
-		});
-		else scorableCellIds.push(cellId);
-	}
-	const expected = new Set(expectedCellIds);
-	for (const cell of cells) {
-		if (cell.cellId !== `${cell.scenarioId}:${cell.rep}`) {
-			unscorableCells.push({
-				cellId: cell.cellId,
-				reason: "campaign cell id does not match scenario id and rep"
-			});
-			continue;
-		}
-		if (!expected.has(cell.cellId)) unscorableCells.push({
-			cellId: cell.cellId,
-			reason: "unexpected campaign cell"
-		});
-	}
-	return {
-		complete: unscorableCells.length === 0 && scorableCellIds.length === expectedCellIds.length,
-		expectedCellIds,
-		scorableCellIds,
-		unscorableCells
-	};
-}
-function formatCoverageFailures(coverage) {
-	const shown = coverage.unscorableCells.slice(0, 3).map((cell) => `${cell.cellId}: ${cell.reason}`).join("; ");
-	const remainder = coverage.unscorableCells.length - Math.min(3, coverage.unscorableCells.length);
-	return remainder > 0 ? `${shown}; +${remainder} more` : shown || "unknown coverage failure";
-}
-function designedCellIds(scenarios, reps) {
-	const ids = [];
-	for (const scenario of scenarios) for (let rep = 0; rep < reps; rep++) ids.push(`${scenario.id}:${rep}`);
-	return ids;
-}
-/** Require the complete designed denominator before a final comparison. */
-function assertCompleteCampaign(campaign, scenarios, reps, requireJudgeScore, label) {
-	const coverage = campaignCoverage(campaign.cells, scenarios, reps, requireJudgeScore);
-	if (!coverage.complete) throw new Error(`${label} is incomplete (${coverage.scorableCellIds.length}/${coverage.expectedCellIds.length} designed cells scorable) — ${formatCoverageFailures(coverage)}. Refusing to compare unequal results.`);
-}
-//#endregion
-//#region src/integrity/backend-integrity.ts
-/**
-* Error thrown when an integrity assertion fails. Caller can pattern-match
-* by `code === 'AGENT_EVAL_BACKEND_STUB'` to differentiate from other
-* errors.
-*/
-var BackendIntegrityError = class extends AgentEvalError {
-	report;
-	constructor(message, report) {
-		super("backend_integrity", message);
-		this.report = report;
-	}
-};
-/**
-* Inspect a batch of RunRecords and return an integrity report. Pure
-* function — no I/O, no logging. The caller decides what to do with the
-* verdict (print warning, throw, gate CI, etc.).
-*/
-function summarizeBackendIntegrity(records) {
-	return summarizeBackendUsage(records.map((record) => ({
-		inputTokens: record.tokenUsage.input,
-		outputTokens: record.tokenUsage.output,
-		costUsd: record.costUsd
-	})));
-}
-/** Inspect settled agent calls from the canonical cost ledger. */
-function summarizeAgentReceiptIntegrity(receipts) {
-	return summarizeBackendUsage(receipts.filter((receipt) => receipt.channel === "agent").map((receipt) => ({
-		inputTokens: receipt.inputTokens,
-		outputTokens: receipt.outputTokens,
-		costUsd: receipt.costUsd
-	})));
-}
-function summarizeBackendUsage(records) {
-	const totalRecords = records.length;
-	let stubRecords = 0;
-	let realRecords = 0;
-	let uncostedRecords = 0;
-	let totalInputTokens = 0;
-	let totalOutputTokens = 0;
-	let totalCostUsd = 0;
-	for (const rec of records) {
-		totalInputTokens += rec.inputTokens;
-		totalOutputTokens += rec.outputTokens;
-		totalCostUsd += rec.costUsd ?? 0;
-		if (rec.inputTokens === 0 && rec.outputTokens === 0) stubRecords++;
-		else realRecords++;
-		if (rec.outputTokens > 0 && (rec.costUsd === null || rec.costUsd === 0)) uncostedRecords++;
-	}
-	const verdict = totalRecords === 0 ? "stub" : stubRecords === totalRecords ? "stub" : stubRecords === 0 ? "real" : "mixed";
-	const diagnosis = buildDiagnosis({
-		totalRecords,
-		stubRecords,
-		realRecords,
-		uncostedRecords,
-		totalInputTokens,
-		totalOutputTokens,
-		totalCostUsd,
-		verdict
-	});
-	return {
-		totalRecords,
-		stubRecords,
-		realRecords,
-		uncostedRecords,
-		totalInputTokens,
-		totalOutputTokens,
-		totalCostUsd,
-		verdict,
-		diagnosis
-	};
-}
-function buildDiagnosis(r) {
-	if (r.totalRecords === 0) return "no records — eval produced zero runs; backend likely failed before first turn";
-	if (r.verdict === "stub") return [
-		`all ${r.totalRecords} records have zero token usage — the LLM backend was never called.`,
-		"common causes: --backend sandbox without a sandbox bridge running; stub model returning hard-coded strings;",
-		"auth misconfigured so requests were silently dropped before the LLM. Re-run with --backend tcloud and TANGLE_API_KEY set,",
-		"or boot the cli-bridge / sandbox before invoking the eval."
-	].join(" ");
-	if (r.verdict === "mixed") {
-		const pct = (r.stubRecords / r.totalRecords * 100).toFixed(0);
-		return [
-			`${r.stubRecords}/${r.totalRecords} records (${pct}%) have zero token usage — the backend partially failed.`,
-			"common causes: rate-limit cascade (429s after the first N personas);",
-			"transient auth expiry mid-run; provider outage. Treat the affected records as missing data, not agent failures."
-		].join(" ");
-	}
-	if (r.uncostedRecords > 0) {
-		const pct = (r.uncostedRecords / r.totalRecords * 100).toFixed(0);
-		return [
-			`${r.totalRecords} records with real LLM activity (in=${r.totalInputTokens}, out=${r.totalOutputTokens} tokens).`,
-			`${r.uncostedRecords} (${pct}%) have output tokens but costUsd=0. Two distinct roots:`,
-			"(a) cost ledger mis-wired — no usage propagation from the runtime stream into RunRecord; or",
-			"(b) the model is unpriced at the source (sandbox/router returned $0 despite real tokens).",
-			"For (b), price the measured tokens against the substrate table (estimateCost) instead of leaving $0."
-		].join(" ");
-	}
-	return `${r.totalRecords} records with real LLM activity (in=${r.totalInputTokens}, out=${r.totalOutputTokens} tokens, $${r.totalCostUsd.toFixed(4)}).`;
-}
-/**
-* Throw BackendIntegrityError if the verdict is 'stub' — i.e. every record
-* shows zero LLM activity. Non-strict callers can pass `{ allowMixed: false }`
-* to also reject mixed verdicts (recommended for CI gates).
-*
-* Real backends pass through silently.
-*/
-function assertRealBackend(records, opts = {}) {
-	return assertBackendReport(summarizeBackendIntegrity(records), opts);
-}
-function assertBackendReport(report, opts) {
-	const allowMixed = opts.allowMixed ?? true;
-	if (report.verdict === "stub") throw new BackendIntegrityError(`backend-integrity: ran against a stub or unconfigured backend — ${report.diagnosis}`, report);
-	if (!allowMixed && report.verdict === "mixed") throw new BackendIntegrityError(`backend-integrity: partial backend failure rejected — ${report.diagnosis}`, report);
-	return report;
-}
-//#endregion
 //#region src/campaign/judge-cell.ts
 /**
 * Judge scoring for one cell, with the paid-call accounting guard: a judge
@@ -1218,156 +975,6 @@ async function runEval(opts) {
 	return runCampaign(opts);
 }
 //#endregion
-//#region src/campaign/surface-identity.ts
-const GIT_OBJECT_ID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
-const SHA256 = /^sha256:[a-f0-9]{64}$/;
-/** Validate the immutable identity shape; the owning executor verifies the Git objects and patch. */
-function assertCodeSurfaceIdentity(surface) {
-	if (!surface || typeof surface !== "object") throw new TypeError("CodeSurface must be an object");
-	const candidate = surface;
-	if (candidate.kind !== "code") throw new TypeError("CodeSurface.kind must be \"code\"");
-	if (typeof candidate.worktreeRef !== "string" || candidate.worktreeRef.trim().length === 0) throw new TypeError("CodeSurface.worktreeRef must be a non-empty locator");
-	if (typeof candidate.baseRef !== "string" || candidate.baseRef.trim().length === 0) throw new TypeError("CodeSurface.baseRef must be a non-empty ref label");
-	for (const [field, value] of [
-		["baseCommit", candidate.baseCommit],
-		["baseTree", candidate.baseTree],
-		["candidateCommit", candidate.candidateCommit],
-		["candidateTree", candidate.candidateTree]
-	]) if (typeof value !== "string" || !GIT_OBJECT_ID.test(value)) throw new TypeError(`CodeSurface.${field} must be a full Git object id`);
-	const patch = candidate.patch;
-	if (!patch || typeof patch !== "object" || patch.format !== "git-diff-binary") throw new TypeError("CodeSurface.patch.format must be \"git-diff-binary\"");
-	if (typeof patch.sha256 !== "string" || !SHA256.test(patch.sha256)) throw new TypeError("CodeSurface.patch.sha256 must be a sha256 digest");
-	if (!Number.isSafeInteger(patch.byteLength) || patch.byteLength < 0) throw new TypeError("CodeSurface.patch.byteLength must be a non-negative safe integer");
-}
-/** Assert that a value is a valid non-empty component surface. */
-function assertComponentSurface(surface) {
-	if (!surface || typeof surface !== "object") throw new TypeError("ComponentSurface must be an object");
-	const candidate = surface;
-	if (candidate.kind !== "components") throw new TypeError("ComponentSurface.kind must be \"components\"");
-	if (!candidate.components || typeof candidate.components !== "object" || Array.isArray(candidate.components)) throw new TypeError("ComponentSurface.components must be an object");
-	const entries = Object.entries(candidate.components);
-	if (entries.length === 0) throw new TypeError("ComponentSurface.components must not be empty");
-	for (const [name, content] of entries) {
-		if (!name.trim() || name.trim() !== name) throw new TypeError("ComponentSurface component names must be trimmed and non-empty");
-		if (typeof content !== "string") throw new TypeError(`ComponentSurface component '${name}' must be a string`);
-	}
-}
-/**
-* Deterministic identity material for a component surface.
-*
-* `canonicalString` orders keys by UTF-16 code unit (RFC 8785), which is a
-* property of the value alone. The previous material ordered them with
-* `localeCompare`, which reads the host's collation — so the same surface
-* could produce two different identities on two machines, and the stored
-* identity would stop matching a recomputation of the identical surface.
-*/
-function componentSurfaceIdentityMaterial(surface) {
-	assertComponentSurface(surface);
-	return canonicalString({
-		schema: "tangle.component-surface",
-		components: surface.components
-	});
-}
-/**
-* The retired material builder, kept PRIVATE and reachable only from
-* {@link surfaceHashMatches}.
-*
-* A surface identity recorded before this release was minted from these bytes.
-* The verify path tries the current material first and falls back to this one,
-* so a stored identity still matches its own surface; nothing mints from it.
-*
-* Every component surface's identity moves, not only one whose names sort
-* differently under the host's collation: RFC 8785 also orders the two
-* top-level keys, so `components` precedes `schema` where this builder emitted
-* them in literal order. The retention window therefore covers every stored
-* component-surface identity, which is why this builder is kept rather than
-* scoped to the mixed-case case.
-*/
-function retiredComponentSurfaceIdentityMaterial(surface) {
-	assertComponentSurface(surface);
-	return JSON.stringify({
-		schema: "tangle.component-surface",
-		components: Object.fromEntries(Object.entries(surface.components).sort(([left], [right]) => left.localeCompare(right)))
-	});
-}
-/** Canonical, location-independent identity of a finalized code candidate.
-*  Commit metadata is excluded: two commits with the same base, final tree,
-*  and patch bytes are the same executable candidate. */
-function codeSurfaceIdentityMaterial(surface) {
-	assertCodeSurfaceIdentity(surface);
-	return JSON.stringify({
-		schema: "tangle.code-surface",
-		baseCommit: surface.baseCommit,
-		baseTree: surface.baseTree,
-		candidateTree: surface.candidateTree,
-		patch: {
-			format: surface.patch.format,
-			sha256: surface.patch.sha256,
-			byteLength: surface.patch.byteLength
-		}
-	});
-}
-/** Full SHA-256 content identity for a prompt or finalized code surface. */
-function surfaceContentHash(surface) {
-	const material = typeof surface === "string" ? surface : surface.kind === "components" ? componentSurfaceIdentityMaterial(surface) : codeSurfaceIdentityMaterial(surface);
-	return `sha256:${createHash("sha256").update(material).digest("hex")}`;
-}
-/** Short loop key derived from the same content identity as provenance. */
-function surfaceHash(surface) {
-	return surfaceContentHash(surface).slice(7, 23);
-}
-/**
-* Whether `storedHash` is the loop key of `surface`, under the current identity
-* material or the retired one.
-*
-* A stored key is 16 hex characters with no room for a scheme tag, so the
-* scheme cannot be read off the value the way an `agent-profile-cell` id names
-* its own. The verify path therefore tries both, which gives the same property:
-* a key minted by an earlier release still matches its own surface, and a
-* surface that was actually edited matches neither.
-*
-* Only a component surface can differ between the two; a prompt or code surface
-* produces identical material under both, so the second comparison is a no-op
-* for them.
-*/
-function surfaceHashMatches(surface, storedHash) {
-	if (surfaceHash(surface) === storedHash) return true;
-	if (typeof surface === "string" || surface.kind !== "components") return false;
-	return createHash("sha256").update(retiredComponentSurfaceIdentityMaterial(surface)).digest("hex").slice(0, 16) === storedHash;
-}
-/** Canonical customer-visible description of the exact before/after surfaces. */
-function renderSurfaceDiff(winnerSurface, baselineSurface) {
-	if (typeof winnerSurface === "string" && typeof baselineSurface === "string") return [
-		"--- baseline",
-		"+++ winner",
-		...baselineSurface.split("\n").map((line) => `- ${line}`),
-		...winnerSurface.split("\n").map((line) => `+ ${line}`)
-	].join("\n");
-	const describe = (surface) => {
-		if (typeof surface === "string") return "(prompt surface)";
-		if (surface.kind === "components") {
-			assertComponentSurface(surface);
-			return Object.entries(surface.components).sort(([left], [right]) => left.localeCompare(right)).map(([name, content]) => `[${name}]\n${content}`).join("\n\n");
-		}
-		assertCodeSurfaceIdentity(surface);
-		return [
-			`baseCommit=${surface.baseCommit}`,
-			`baseTree=${surface.baseTree}`,
-			`candidateCommit=${surface.candidateCommit}`,
-			`candidateTree=${surface.candidateTree}`,
-			`patch=${surface.patch.sha256}`,
-			`patchBytes=${surface.patch.byteLength}`,
-			...surface.summary ? [surface.summary] : []
-		].join("\n");
-	};
-	return `--- baseline\n${describe(baselineSurface)}\n+++ winner\n${describe(winnerSurface)}`;
-}
-/** Bind a campaign cache entry to the exact surface and caller-owned execution revision. */
-function surfaceDispatchRef(surface, executionRef = "anonymous") {
-	if (!executionRef.trim() || executionRef.trim() !== executionRef) throw new Error("surfaceDispatchRef: executionRef must be trimmed and non-empty");
-	return `surface:${executionRef}:${surfaceContentHash(surface)}`;
-}
-//#endregion
 //#region src/canary.ts
 /**
 * Run all configured canaries against a chronological run list.
@@ -2792,403 +2399,767 @@ function paretoFrontierWithCrowding(candidates, objectives) {
 	return crowdingDistance(frontier, objectives).sort((a, b) => b.distance - a.distance);
 }
 //#endregion
-//#region src/json-recovery.ts
+//#region src/campaign/search-ledger.ts
 /**
-* Truncation-tolerant JSON recovery — shared by every parser that reads JSON
-* out of a model response (reflective-mutation proposals, judge scores, the
-* completion-correctness checker).
+* Durable append-only audit log for improvement searches.
 *
-* LLMs routinely hit a max_tokens cap mid-emission, leaving a JSON prefix
-* with an unclosed string / object / array and often a dangling key or
-* trailing comma. Throwing on that prefix — and letting the throw fold into
-* a fabricated zero score downstream — is the bug class this module exists
-* to prevent (see `JudgeParseError`'s contract: a synthetic zero is
-* indistinguishable from a real low score). Recovering the complete prefix
-* turns a would-be fabricated zero into a real measurement.
-*/
-/**
-* Walk the input as JSON-aware (string vs not, escape-aware) and close
-* unclosed `{` / `[` in LIFO order at the tail. If the input was already
-* balanced returns it unchanged. If a string was open at end-of-input we
-* also close it with `"` first, since a truncated string-mid-value is the
-* most common LLM cap-hit failure mode and JSON.parse cannot proceed
-* without one.
+* Existing campaign artifacts keep their own rich records: `RunRecord` owns a
+* measured run and `CostLedger` owns per-call accounting. This ledger does not
+* copy those structures. It binds their immutable ids and receipts into one replayable event stream so a
+* search can answer, after a crash, exactly which candidates and task attempts
+* existed, which surfaces actually fired, what they cost, and why they were
+* selected or rejected.
+*
+* The file format is canonical JSONL with a SHA-256 hash chain. Every append is
+* serialized across processes, fsynced before acknowledgement, and idempotent
+* by `eventId`. A malformed, non-canonical, truncated, reordered, or conflicting
+* log fails loudly; the implementation never skips a bad row.
 *
-* Returns null when the structure is unrecoverable (e.g. depth would go
-* negative — that's an *over*-closed prefix, not a truncation).
+* The journal machinery itself (hash chain, locking, fsync, idempotent append)
+* is the generic `ledger-core` journal; this module supplies the campaign
+* codec: event schemas, canonical event ordering, and the search state machine.
 */
-function autoCloseTruncatedJson(raw) {
-	const stack = [];
-	let inString = false;
-	let escaped = false;
-	for (const c of raw) {
-		if (escaped) {
-			escaped = false;
-			continue;
+const SEARCH_LEDGER_SCHEMA = "tangle.search-ledger.v1";
+const NON_EMPTY = z.string().min(1).refine((value) => value.trim() === value, "must not contain surrounding whitespace");
+const HASH = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const LINEAGE_NODE_ID = z.string().regex(/^[a-f0-9]{16}$/);
+const IMMUTABLE_REVISION = z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|sha256:[a-f0-9]{64}|sha512:[A-Za-z0-9+/=]+)$/);
+const ISO_TIMESTAMP = z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/).refine((value) => Number.isFinite(Date.parse(value)), "invalid timestamp");
+const NON_NEGATIVE_INT = z.number().int().nonnegative().safe();
+const FINITE_NUMBER = z.number().finite();
+const ArtifactRefSchema = z.object({
+	role: NON_EMPTY,
+	uri: NON_EMPTY,
+	sha256: HASH,
+	byteLength: NON_NEGATIVE_INT
+}).strict();
+const SourceRefSchema = z.object({
+	uri: NON_EMPTY,
+	revision: IMMUTABLE_REVISION
+}).strict();
+const FailureReasonSchema = z.object({
+	code: NON_EMPTY,
+	message: NON_EMPTY
+}).strict();
+const EventBaseShape = {
+	eventId: NON_EMPTY,
+	occurredAt: ISO_TIMESTAMP,
+	artifacts: z.array(ArtifactRefSchema).min(1)
+};
+const OperationKindSchema = z.enum([
+	"candidate-generation",
+	"analysis",
+	"selection",
+	"judge",
+	"other"
+]);
+const CandidateSlotSchema = z.object({
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY
+}).strict();
+const PlannedOperationSchema = z.object({
+	operationId: NON_EMPTY,
+	kind: OperationKindSchema
+}).strict();
+const SearchPlanExtendedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-plan-extended"),
+	extension: z.object({
+		candidateSlots: z.array(CandidateSlotSchema),
+		operations: z.array(PlannedOperationSchema)
+	}).strict().superRefine((extension, ctx) => {
+		if (extension.candidateSlots.length === 0 && extension.operations.length === 0) ctx.addIssue({
+			code: "custom",
+			message: "a plan extension must add slots or operations"
+		});
+	})
+}).strict();
+const SearchPlannedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-planned"),
+	plan: z.object({
+		candidateSlots: z.array(CandidateSlotSchema).min(1),
+		tasks: z.array(z.object({
+			taskId: NON_EMPTY,
+			source: SourceRefSchema,
+			benchmark: SourceRefSchema,
+			maxAttempts: z.number().int().positive().safe()
+		}).strict()).min(1),
+		operations: z.array(PlannedOperationSchema).min(1)
+	}).strict()
+}).strict();
+const CandidateRegisteredSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-registered"),
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY,
+	candidateId: NON_EMPTY,
+	lineage: z.object({
+		lineageNodeId: LINEAGE_NODE_ID,
+		parentCandidateIds: z.array(NON_EMPTY),
+		generation: NON_NEGATIVE_INT,
+		proposer: NON_EMPTY,
+		proposerSource: SourceRefSchema
+	}).strict(),
+	surfaces: z.array(z.object({
+		surfaceId: NON_EMPTY,
+		kind: z.enum([
+			"prompt",
+			"tool-contract",
+			"runtime-config",
+			"memory",
+			"knowledge",
+			"agent-profile",
+			"code",
+			"deployment"
+		]),
+		artifact: ArtifactRefSchema
+	}).strict()).min(1)
+}).strict();
+const CandidateSlotClosedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-slot-closed"),
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY,
+	reason: FailureReasonSchema
+}).strict();
+const KnownTokensSchema = z.object({
+	status: z.literal("known"),
+	inputTokens: NON_NEGATIVE_INT,
+	outputTokens: NON_NEGATIVE_INT,
+	cachedTokens: NON_NEGATIVE_INT
+}).strict();
+const UnknownSchema = z.object({
+	status: z.literal("unknown"),
+	reason: NON_EMPTY
+}).strict();
+const KnownCostSchema = z.object({
+	status: z.literal("known"),
+	usd: z.number().finite().nonnegative(),
+	source: z.enum([
+		"provider",
+		"pricing-table",
+		"free"
+	])
+}).strict().superRefine((cost, ctx) => {
+	if (cost.source === "free" && cost.usd !== 0) ctx.addIssue({
+		code: "custom",
+		message: "free cost source must have usd 0"
+	});
+});
+const UnknownCostSchema = z.object({
+	status: z.literal("unknown"),
+	knownLowerBoundUsd: z.number().finite().nonnegative(),
+	reason: NON_EMPTY
+}).strict();
+const AccountingSchema = z.object({
+	tokens: z.discriminatedUnion("status", [KnownTokensSchema, UnknownSchema]),
+	cost: z.discriminatedUnion("status", [KnownCostSchema, UnknownCostSchema])
+}).strict();
+const MetricsSchema = z.record(NON_EMPTY, FINITE_NUMBER).superRefine((metrics, ctx) => {
+	for (const key of Object.keys(metrics)) if (key === "__proto__" || key === "constructor" || key === "prototype") ctx.addIssue({
+		code: "custom",
+		message: `unsafe metric key ${key}`
+	});
+});
+const OutcomeSchema = z.discriminatedUnion("status", [
+	z.object({
+		status: z.literal("passed"),
+		score: FINITE_NUMBER,
+		metrics: MetricsSchema
+	}).strict(),
+	z.object({
+		status: z.literal("failed"),
+		score: FINITE_NUMBER,
+		metrics: MetricsSchema,
+		failure: FailureReasonSchema
+	}).strict(),
+	z.object({
+		status: z.literal("errored"),
+		metrics: MetricsSchema,
+		error: FailureReasonSchema.extend({ retryable: z.boolean() }).strict()
+	}).strict()
+]);
+const EffectSchema = z.discriminatedUnion("status", [z.object({
+	status: z.literal("measured"),
+	metric: NON_EMPTY,
+	baselineValue: FINITE_NUMBER,
+	candidateValue: FINITE_NUMBER,
+	delta: FINITE_NUMBER
+}).strict().superRefine((effect, ctx) => {
+	const expected = effect.candidateValue - effect.baselineValue;
+	const tolerance = Number.EPSILON * Math.max(1, Math.abs(expected), Math.abs(effect.delta)) * 8;
+	if (Math.abs(effect.delta - expected) > tolerance) ctx.addIssue({
+		code: "custom",
+		message: "delta must equal candidateValue - baselineValue"
+	});
+}), z.object({
+	status: z.literal("not-measured"),
+	reason: NON_EMPTY
+}).strict()]);
+const SurfaceEvidenceSchema = z.object({
+	surfaceId: NON_EMPTY,
+	fired: z.boolean(),
+	firingCount: NON_NEGATIVE_INT,
+	effect: EffectSchema,
+	evidence: z.array(ArtifactRefSchema).min(1)
+}).strict().superRefine((evidence, ctx) => {
+	if (evidence.fired && evidence.firingCount === 0) ctx.addIssue({
+		code: "custom",
+		message: "a fired surface must have firingCount >= 1"
+	});
+	if (!evidence.fired && evidence.firingCount !== 0) ctx.addIssue({
+		code: "custom",
+		message: "a surface that did not fire must have firingCount 0"
+	});
+	if (!evidence.fired && evidence.effect.status === "measured" && evidence.effect.delta !== 0) ctx.addIssue({
+		code: "custom",
+		message: "a surface that did not fire cannot claim non-zero effect"
+	});
+});
+const TaskAttemptedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("task-attempted"),
+	candidateId: NON_EMPTY,
+	runId: NON_EMPTY,
+	attemptIndex: NON_NEGATIVE_INT,
+	task: z.object({
+		taskId: NON_EMPTY,
+		source: SourceRefSchema
+	}).strict(),
+	identity: z.object({
+		model: z.object({
+			provider: NON_EMPTY,
+			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
+		}).strict(),
+		agent: SourceRefSchema,
+		benchmark: SourceRefSchema
+	}).strict(),
+	outcome: OutcomeSchema,
+	accounting: AccountingSchema,
+	surfaceEvidence: z.array(SurfaceEvidenceSchema).min(1)
+}).strict();
+const SearchOperationRecordedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-operation-recorded"),
+	operationId: NON_EMPTY,
+	operationKind: OperationKindSchema,
+	execution: z.discriminatedUnion("kind", [z.object({
+		kind: z.literal("model"),
+		model: z.object({
+			provider: NON_EMPTY,
+			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
+		}).strict(),
+		source: SourceRefSchema
+	}).strict(), z.object({
+		kind: z.literal("deterministic"),
+		source: SourceRefSchema
+	}).strict()]),
+	outcome: z.discriminatedUnion("status", [
+		z.object({ status: z.literal("completed") }).strict(),
+		z.object({
+			status: z.literal("partial"),
+			failure: FailureReasonSchema
+		}).strict(),
+		z.object({
+			status: z.literal("failed"),
+			failure: FailureReasonSchema
+		}).strict()
+	]),
+	accounting: AccountingSchema
+}).strict();
+const CandidateDecidedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-decided"),
+	candidateId: NON_EMPTY,
+	decision: z.discriminatedUnion("status", [z.object({ status: z.literal("selected") }).strict(), z.object({
+		status: z.literal("rejected"),
+		reason: FailureReasonSchema
+	}).strict()])
+}).strict();
+const SearchCompletedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-completed"),
+	result: z.discriminatedUnion("status", [z.object({
+		status: z.literal("selected"),
+		candidateId: NON_EMPTY
+	}).strict(), z.object({
+		status: z.literal("all-rejected"),
+		reason: FailureReasonSchema
+	}).strict()])
+}).strict();
+const EventSchema = z.discriminatedUnion("kind", [
+	SearchPlannedSchema,
+	SearchPlanExtendedSchema,
+	CandidateRegisteredSchema,
+	CandidateSlotClosedSchema,
+	TaskAttemptedSchema,
+	SearchOperationRecordedSchema,
+	CandidateDecidedSchema,
+	SearchCompletedSchema
+]);
+const EntrySchema = z.object({
+	schema: z.literal(SEARCH_LEDGER_SCHEMA),
+	campaignId: NON_EMPTY,
+	sequence: NON_NEGATIVE_INT,
+	previousHash: z.union([HASH, z.null()]),
+	event: EventSchema,
+	entryHash: HASH
+}).strict();
+/** Validate and return a canonical copy. Arrays whose order is not semantic are
+* sorted so retries from different processes produce byte-identical events. */
+function validateSearchLedgerEvent(input) {
+	const parsed = EventSchema.safeParse(input);
+	if (!parsed.success) throw new SearchLedgerError(`invalid search ledger event: ${formatZodError(parsed.error)}`);
+	return normalizeEvent(parsed.data);
+}
+/** Open a durable filesystem search ledger. Construction performs no I/O; the
+* first `append` or `replay` validates the complete existing file. */
+function openSearchLedger(options) {
+	if (options.path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
+	return new FileSearchLedger(options.path, options.campaignId, options.trustedHead);
+}
+/** Replay immutable search-ledger JSONL through the same codec as FileSearchLedger. */
+function replaySearchLedgerText(text, campaignId, source) {
+	return replayLedgerText(text, source, searchLedgerCodec(campaignId)).projection;
+}
+function searchLedgerCodec(campaignId) {
+	return {
+		...SEARCH_LEDGER_FILE_CONTEXT,
+		header: {
+			schema: SEARCH_LEDGER_SCHEMA,
+			campaignId
+		},
+		conflictError: (message) => new SearchLedgerConflictError(message),
+		parseEntry: parseSearchLedgerEntry,
+		checkEntryHeader: (entry, index) => {
+			if (entry.campaignId !== campaignId) throw new SearchLedgerIntegrityError(`entry ${index} belongs to campaign ${entry.campaignId}, expected ${campaignId}`);
+		},
+		createProjector: () => createSearchLedgerProjector(campaignId)
+	};
+}
+/** Append-only file-backed search ledger with idempotent writes and replay. */
+var FileSearchLedger = class {
+	path;
+	campaignId;
+	trustedHeadPath;
+	trustedHeadMode;
+	journal;
+	constructor(path, campaignId, trustedHead = "pin") {
+		if (path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
+		if (campaignId.length === 0) throw new SearchLedgerError("campaignId is empty");
+		if (campaignId.trim() !== campaignId) throw new SearchLedgerError("campaignId must not contain surrounding whitespace");
+		this.campaignId = campaignId;
+		this.trustedHeadMode = trustedHead;
+		this.journal = new FileLedgerJournal(path, searchLedgerCodec(campaignId), { requireTrustedHead: trustedHead === "require" });
+		this.path = this.journal.path;
+		this.trustedHeadPath = this.journal.trustedHeadPath;
+	}
+	async replay() {
+		return (await this.journal.replay()).projection;
+	}
+	async append(input) {
+		const event = validateSearchLedgerEvent(input);
+		const { entry, appended, projection } = await this.journal.append(event, { pinHead: this.trustedHeadMode !== "off" });
+		return {
+			entry,
+			appended,
+			replay: projection
+		};
+	}
+	async trustedHead() {
+		return this.journal.trustedHead();
+	}
+	async pinTrustedHead() {
+		return this.journal.pinTrustedHead();
+	}
+	async clearTrustedHead() {
+		return this.journal.clearTrustedHead();
+	}
+};
+function parseSearchLedgerEntry(raw, context) {
+	const parsed = EntrySchema.safeParse(raw);
+	if (!parsed.success) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has a malformed entry at line ${context.line}: ${formatZodError(parsed.error)}`);
+	const entry = parsed.data;
+	if (canonicalString(validateSearchLedgerEvent(entry.event)) !== canonicalString(entry.event)) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has non-canonical event ordering at line ${context.line}`);
+	return entry;
+}
+/** Replay the campaign search state machine over chain-verified entries. The
+* generic journal owns sequence, hash, and eventId-uniqueness checks; this
+* projector owns every campaign invariant and builds the replay projection. */
+function createSearchLedgerProjector(campaignId) {
+	const candidates = /* @__PURE__ */ new Map();
+	const plannedSlots = /* @__PURE__ */ new Map();
+	const plannedOperations = /* @__PURE__ */ new Map();
+	const planExtensions = [];
+	const candidateBySlot = /* @__PURE__ */ new Map();
+	const closedSlots = /* @__PURE__ */ new Map();
+	const lineageNodes = /* @__PURE__ */ new Map();
+	const runIds = /* @__PURE__ */ new Set();
+	const attemptKeys = /* @__PURE__ */ new Set();
+	const candidateEvents = [];
+	const closedSlotEvents = [];
+	const attempts = [];
+	const operationEvents = [];
+	const operationsById = /* @__PURE__ */ new Map();
+	const decisions = [];
+	let planEvent = null;
+	let completion = null;
+	let previousOccurredAt = Number.NEGATIVE_INFINITY;
+	const apply = (entry, index) => {
+		const event = entry.event;
+		if (completion) throw new SearchLedgerIntegrityError(`event ${event.eventId} appears after terminal event ${completion.eventId}`);
+		const occurredAt = Date.parse(event.occurredAt);
+		if (occurredAt < previousOccurredAt) throw new SearchLedgerIntegrityError(`event ${event.eventId} occurred before the preceding durable event`);
+		previousOccurredAt = occurredAt;
+		assertUnique(event.artifacts.map(artifactKey), "artifact receipt", event.eventId);
+		if (event.kind === "search-planned") {
+			if (index !== 0 || planEvent) throw new SearchLedgerIntegrityError("search plan must be the first and only plan event");
+			assertUnique(event.plan.candidateSlots.map((slot) => slot.slotId), "candidate slot", event.eventId);
+			assertUnique(event.plan.tasks.map((task) => task.taskId), "planned taskId", event.eventId);
+			assertUnique(event.plan.operations.map((operation) => operation.operationId), "planned operationId", event.eventId);
+			for (const operation of event.plan.operations) plannedOperations.set(operation.operationId, operation);
+			for (const slot of event.plan.candidateSlots) {
+				assertSlotGenerationOperation(slot, plannedOperations);
+				plannedSlots.set(slot.slotId, slot);
+			}
+			planEvent = event;
+			return;
 		}
-		if (inString) {
-			if (c === "\\") {
-				escaped = true;
-				continue;
+		if (!planEvent) throw new SearchLedgerIntegrityError(`event ${event.eventId} appears before the required search plan`);
+		if (event.kind === "search-plan-extended") {
+			assertUnique(event.extension.candidateSlots.map((slot) => slot.slotId), "candidate slot", event.eventId);
+			assertUnique(event.extension.operations.map((operation) => operation.operationId), "planned operationId", event.eventId);
+			for (const operation of event.extension.operations) {
+				if (plannedOperations.has(operation.operationId)) throw new SearchLedgerIntegrityError(`plan extension ${event.eventId} re-plans operation ${operation.operationId}`);
+				plannedOperations.set(operation.operationId, operation);
 			}
-			if (c === "\"") {
-				inString = false;
-				continue;
+			for (const slot of event.extension.candidateSlots) {
+				if (plannedSlots.has(slot.slotId)) throw new SearchLedgerIntegrityError(`plan extension ${event.eventId} re-plans candidate slot ${slot.slotId}`);
+				assertSlotGenerationOperation(slot, plannedOperations);
+				plannedSlots.set(slot.slotId, slot);
 			}
-			continue;
-		}
-		if (c === "\"") {
-			inString = true;
-			continue;
+			planExtensions.push(event);
+			return;
 		}
-		if (c === "{" || c === "[") stack.push(c);
-		else if (c === "}") {
-			if (stack.pop() !== "{") return null;
-		} else if (c === "]") {
-			if (stack.pop() !== "[") return null;
+		if (event.kind === "candidate-registered") {
+			if (candidates.has(event.candidateId)) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} was registered twice`);
+			const plannedSlot = plannedSlots.get(event.slotId);
+			if (!plannedSlot) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} binds unknown slot ${event.slotId}`);
+			if (candidateBySlot.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was bound twice`);
+			if (closedSlots.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was already closed`);
+			if (event.generationOperationId !== plannedSlot.generationOperationId) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} generation operation ${event.generationOperationId} does not match slot ${event.slotId} plan ${plannedSlot.generationOperationId}`);
+			const generationOperation = operationsById.get(event.generationOperationId);
+			if (!generationOperation) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} precedes generation operation ${event.generationOperationId}`);
+			if (generationOperation.outcome.status === "failed") throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} cannot bind failed generation operation ${event.generationOperationId}`);
+			const previousCandidate = lineageNodes.get(event.lineage.lineageNodeId);
+			if (previousCandidate) throw new SearchLedgerIntegrityError(`lineage node ${event.lineage.lineageNodeId} is already bound to ${previousCandidate}`);
+			assertUnique(event.lineage.parentCandidateIds, "parentCandidateId", event.eventId);
+			const parents = event.lineage.parentCandidateIds.map((id) => {
+				const parent = candidates.get(id);
+				if (!parent) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} references unknown parent ${id}`);
+				return parent;
+			});
+			const expectedGeneration = parents.length === 0 ? 0 : Math.max(...parents.map((parent) => parent.registered.lineage.generation)) + 1;
+			if (event.lineage.generation !== expectedGeneration) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} generation ${event.lineage.generation} does not follow its parents (expected ${expectedGeneration})`);
+			assertUnique(event.surfaces.map((surface) => surface.surfaceId), "surfaceId", event.eventId);
+			candidates.set(event.candidateId, {
+				registered: event,
+				attempts: [],
+				decision: null
+			});
+			candidateBySlot.set(event.slotId, event.candidateId);
+			lineageNodes.set(event.lineage.lineageNodeId, event.candidateId);
+			candidateEvents.push(event);
+			return;
 		}
-	}
-	if (stack.length === 0 && !inString) return raw;
-	let suffix = "";
-	if (escaped) suffix += "\\";
-	if (inString) suffix += "\"";
-	while (stack.length > 0) {
-		const opener = stack.pop();
-		suffix += opener === "{" ? "}" : "]";
-	}
-	return raw + suffix;
-}
-const UNPARSEABLE = Symbol("unparseable");
-function tryParse(candidate) {
-	try {
-		return JSON.parse(candidate);
-	} catch {
-		return UNPARSEABLE;
-	}
-}
-/** Index of the last `,` that sits outside any string literal, or -1. Cutting
-*  there discards a dangling key / half-emitted value at the tail while
-*  keeping every complete member before it. */
-function lastCommaOutsideString(s) {
-	let inString = false;
-	let escaped = false;
-	let last = -1;
-	for (let i = 0; i < s.length; i++) {
-		const c = s[i];
-		if (escaped) {
-			escaped = false;
-			continue;
+		if (event.kind === "task-attempted") {
+			const candidate = candidates.get(event.candidateId);
+			if (!candidate) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} references unknown candidate ${event.candidateId}`);
+			if (candidate.decision) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} appears after candidate ${event.candidateId} was decided`);
+			const plannedTask = planEvent.plan.tasks.find((task) => task.taskId === event.task.taskId);
+			if (!plannedTask) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} references unplanned task ${event.task.taskId}`);
+			if (canonicalString(plannedTask.source) !== canonicalString(event.task.source) || canonicalString(plannedTask.benchmark) !== canonicalString(event.identity.benchmark)) throw new SearchLedgerIntegrityError(`task ${event.task.taskId} does not match its planned source identity`);
+			if (event.attemptIndex >= plannedTask.maxAttempts) throw new SearchLedgerIntegrityError(`task ${event.task.taskId} attempt ${event.attemptIndex} exceeds planned maxAttempts ${plannedTask.maxAttempts}`);
+			if (runIds.has(event.runId)) throw new SearchLedgerIntegrityError(`runId ${event.runId} was recorded twice`);
+			runIds.add(event.runId);
+			const attemptKey = canonicalString([
+				event.candidateId,
+				event.task.taskId,
+				event.attemptIndex
+			]);
+			if (attemptKeys.has(attemptKey)) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} attempt ${event.attemptIndex} was recorded twice`);
+			const expectedAttemptIndex = candidate.attempts.filter((attempt) => attempt.task.taskId === event.task.taskId).length;
+			if (event.attemptIndex !== expectedAttemptIndex) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} attempt index ${event.attemptIndex} is not contiguous (expected ${expectedAttemptIndex})`);
+			const previousAttempt = candidate.attempts.find((attempt) => attempt.task.taskId === event.task.taskId);
+			if (previousAttempt?.outcome.status !== void 0 && previousAttempt.outcome.status !== "errored") throw new SearchLedgerIntegrityError(`task ${event.task.taskId} was retried after a measured outcome`);
+			if (previousAttempt && canonicalString({
+				task: previousAttempt.task,
+				identity: previousAttempt.identity
+			}) !== canonicalString({
+				task: event.task,
+				identity: event.identity
+			})) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} changed immutable execution identity between attempts`);
+			attemptKeys.add(attemptKey);
+			const declared = candidate.registered.surfaces.map((surface) => surface.surfaceId).sort();
+			const observed = event.surfaceEvidence.map((surface) => surface.surfaceId).sort();
+			assertUnique(observed, "surface evidence", event.eventId);
+			for (const evidence of event.surfaceEvidence) assertUnique(evidence.evidence.map(artifactKey), "surface evidence receipt", event.eventId);
+			if (canonicalString(declared) !== canonicalString(observed)) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} surface evidence does not exactly cover candidate ${event.candidateId}`);
+			candidate.attempts.push(event);
+			attempts.push(event);
+			return;
 		}
-		if (inString) {
-			if (c === "\\") escaped = true;
-			else if (c === "\"") inString = false;
-			continue;
+		if (event.kind === "search-operation-recorded") {
+			const plannedOperation = plannedOperations.get(event.operationId);
+			if (!plannedOperation) throw new SearchLedgerIntegrityError(`operation ${event.operationId} was not declared in the search plan`);
+			if (plannedOperation.kind !== event.operationKind) throw new SearchLedgerIntegrityError(`operation ${event.operationId} kind ${event.operationKind} does not match planned ${plannedOperation.kind}`);
+			if (operationsById.has(event.operationId)) throw new SearchLedgerIntegrityError(`operation ${event.operationId} was recorded twice`);
+			operationsById.set(event.operationId, event);
+			operationEvents.push(event);
+			return;
 		}
-		if (c === "\"") inString = true;
-		else if (c === ",") last = i;
-	}
-	return last;
-}
-/**
-* Best-effort parse of a possibly-truncated JSON payload embedded in model
-* output (prose and markdown fences tolerated). Tries each opener position
-* (earliest `{`/`[` first, then the other when the first yields nothing —
-* prose like `[note] {"score":3}` must not poison the slice), and from each
-* start, in order:
-*
-*   1. plain `JSON.parse` of the opener → last-closer slice,
-*   2. auto-closing unclosed structures at the tail
-*      (`autoCloseTruncatedJson`),
-*   3. trimming the tail back to the previous complete member boundary (the
-*      last comma outside a string) and auto-closing again, repeatedly.
-*
-* Recovers e.g. `{"correct": false, "` → `{ correct: false }` — the exact
-* cap-hit shape that has zeroed real eval rows. Returns the parsed value
-* (always an object or array, given the slice starts at an opener), or
-* `null` when nothing parseable can be recovered. Never throws.
-*/
-function recoverTruncatedJson(text) {
-	const starts = [text.indexOf("{"), text.indexOf("[")].filter((i) => i >= 0).sort((a, b) => a - b);
-	for (const start of starts) {
-		const recovered = recoverFrom(text.slice(start));
-		if (recovered !== UNPARSEABLE) return recovered;
-	}
-	return null;
-}
-function recoverFrom(slice) {
-	let candidate = slice;
-	const lastClose = Math.max(candidate.lastIndexOf("}"), candidate.lastIndexOf("]"));
-	if (lastClose > 0) {
-		const balanced = tryParse(candidate.slice(0, lastClose + 1));
-		if (balanced !== UNPARSEABLE) return balanced;
-	}
-	for (let i = 0; i < 64; i++) {
-		const closed = autoCloseTruncatedJson(candidate);
-		if (closed !== null) {
-			const parsed = tryParse(closed);
-			if (parsed !== UNPARSEABLE) return parsed;
+		if (event.kind === "candidate-slot-closed") {
+			const plannedSlot = plannedSlots.get(event.slotId);
+			if (!plannedSlot) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} references unknown slot ${event.slotId}`);
+			if (event.generationOperationId !== plannedSlot.generationOperationId) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} generation operation ${event.generationOperationId} does not match slot ${event.slotId} plan ${plannedSlot.generationOperationId}`);
+			if (candidateBySlot.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was already bound to a candidate`);
+			if (closedSlots.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was closed twice`);
+			const operation = operationsById.get(event.generationOperationId);
+			if (!operation) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} precedes operation ${event.generationOperationId}`);
+			if (operation.outcome.status === "completed") throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} cannot close from completed operation ${event.generationOperationId}`);
+			closedSlots.set(event.slotId, event);
+			closedSlotEvents.push(event);
+			return;
 		}
-		const cut = lastCommaOutsideString(candidate);
-		if (cut <= 0) return UNPARSEABLE;
-		candidate = candidate.slice(0, cut);
-	}
-	return UNPARSEABLE;
-}
-//#endregion
-//#region src/reflective-mutation.ts
-/**
-* Reflective mutation — primitives for trace-conditioned prompt rewriting.
-*
-* Used by `prompt-evolution.ts` (and any consumer running iterative
-* improvement). Given a parent prompt + concrete trace evidence (top trials,
-* bottom trials, missed expectations), produce an LLM-ready prompt that
-* proposes targeted mutations — not blind rephrasings.
-*
-* Why this lives outside `prompt-evolution.ts`: any consumer that wants to
-* run reflective rewriting WITHOUT the population/Pareto machinery can
-* import these primitives directly.
-*
-* Quality bar (vs. naive "mutate this prompt"):
-*   - Show parent ↔ children diff, not just one variant
-*   - Quote specific missed goldens with their match phrases
-*   - Surface the model's actual emitted output side-by-side with what was expected
-*   - Quote concrete mutation primitives so the model has a vocabulary
-*/
-/** Bound on rendered/carried `emitted` evidence. ONE constant shared by the
-*  producer (campaignBreakdown's per-scenario excerpt) and this renderer — if
-*  the two drifted, the tighter side would silently re-clip carried evidence. */
-const EMITTED_EVIDENCE_MAX_CHARS = 2e3;
-const DEFAULT_MUTATION_PRIMITIVES = [
-	"Strengthen an imperative (\"should\" → \"must\")",
-	"Add a concrete example pulled from a missed-golden phrase",
-	"Remove a redundant rule that did not improve recall",
-	"Add a counterfactual (\"if X is missing, the score is capped at Y\")",
-	"Reorder sections so the highest-impact rule is first",
-	"Replace abstract language with a domain-specific noun the trial misses"
-];
-/**
-* Build the LLM-ready reflection prompt. Output is plain text — pass it as
-* the user message. The system message should be small and stable (e.g.
-* "Output ONLY a JSON object matching the schema below.").
-*/
-function buildReflectionPrompt(ctx) {
-	const primitives = ctx.mutationPrimitives ?? DEFAULT_MUTATION_PRIMITIVES;
-	const sections = [];
-	sections.push(`# Mutation target: ${ctx.target}`);
-	sections.push("");
-	sections.push(`You are tuning the prompt component named \`${ctx.target}\`. The current variant is shown below; you have ${ctx.topTrials.length} top trials and ${ctx.bottomTrials.length} bottom trials as evidence. Propose ${ctx.childCount} mutation${ctx.childCount === 1 ? "" : "s"} that fix specific weaknesses visible in the bottom trials. Avoid blank rephrasings.`);
-	sections.push("");
-	sections.push("## Current variant");
-	sections.push("```json");
-	sections.push(JSON.stringify(ctx.parentPayload, null, 2));
-	sections.push("```");
-	sections.push("");
-	if (ctx.bottomTrials.length > 0) {
-		sections.push("## Failures (bottom trials) — what went wrong");
-		sections.push("");
-		for (const trial of ctx.bottomTrials) {
-			sections.push(`### Trial \`${trial.id}\` — score ${trial.score.toFixed(2)}${trial.inputName ? ` (${trial.inputName})` : ""}`);
-			if (trial.failureNote) {
-				sections.push("");
-				sections.push(`**Why it scored low:** ${truncate(trial.failureNote, 1500)}`);
-			}
-			const missed = (trial.expectations ?? []).filter((e) => !e.matched);
-			if (missed.length > 0) {
-				sections.push("");
-				sections.push("**Missed expectations:**");
-				for (const m of missed) sections.push(`- \`${m.id}\`: should match phrase \`${quote(m.phrase)}\``);
+		if (event.kind === "candidate-decided") {
+			const candidate = candidates.get(event.candidateId);
+			if (!candidate) throw new SearchLedgerIntegrityError(`decision ${event.eventId} references unknown candidate ${event.candidateId}`);
+			if (candidate.decision) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} was decided twice`);
+			if (event.decision.status === "selected") {
+				if (!candidate.attempts.some((attempt) => attempt.outcome.status !== "errored")) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} cannot be selected without a measured task outcome`);
+				if (decisions.some((decision) => decision.decision.status === "selected")) throw new SearchLedgerIntegrityError("more than one candidate was selected");
 			}
-			if (trial.emitted) {
-				sections.push("");
-				sections.push("**What the agent emitted:**");
-				sections.push("```");
-				sections.push(truncate(trial.emitted, EMITTED_EVIDENCE_MAX_CHARS));
-				sections.push("```");
+			candidate.decision = event;
+			decisions.push(event);
+			return;
+		}
+		const missingCandidateSlots = [...plannedSlots.values()].filter((slot) => !candidateBySlot.has(slot.slotId) && !closedSlots.has(slot.slotId)).map((slot) => slot.slotId);
+		if (missingCandidateSlots.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing candidate slots: ${missingCandidateSlots.join(", ")}`);
+		const missingTaskOutcomes = plannedTaskOutcomeKeys(planEvent, candidates);
+		if (missingTaskOutcomes.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing task outcomes: ${missingTaskOutcomes.join(", ")}`);
+		const missingOperations = [...plannedOperations.values()].filter((operation) => !operationsById.has(operation.operationId)).map((operation) => operation.operationId);
+		if (missingOperations.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing search operations: ${missingOperations.join(", ")}`);
+		for (const operation of plannedOperations.values()) {
+			if (operation.kind !== "candidate-generation") continue;
+			const generationOutcome = operationsById.get(operation.operationId).outcome.status;
+			const slots = [...plannedSlots.values()].filter((slot) => slot.generationOperationId === operation.operationId);
+			if (slots.length === 0) continue;
+			const registeredCount = slots.filter((slot) => candidateBySlot.has(slot.slotId)).length;
+			const closedCount = slots.filter((slot) => closedSlots.has(slot.slotId)).length;
+			if (generationOutcome === "completed" && closedCount > 0) throw new SearchLedgerIntegrityError(`completed generation operation ${operation.operationId} contains ${closedCount} closed slot(s)`);
+			if (generationOutcome === "failed" && registeredCount > 0) throw new SearchLedgerIntegrityError(`failed generation operation ${operation.operationId} contains ${registeredCount} registered candidate(s)`);
+			if (generationOutcome === "partial" && (registeredCount === 0 || closedCount === 0)) throw new SearchLedgerIntegrityError(`partial generation operation ${operation.operationId} must contain both a registered candidate and a closed slot`);
+		}
+		const pending = [...candidates.values()].filter((candidate) => candidate.decision === null);
+		if (pending.length > 0) throw new SearchLedgerIntegrityError(`search completed with ${pending.length} candidate decision(s) missing`);
+		const selected = decisions.filter((decision) => decision.decision.status === "selected");
+		if (event.result.status === "selected") {
+			if (selected.length !== 1 || selected[0].candidateId !== event.result.candidateId) throw new SearchLedgerIntegrityError(`search completion winner ${event.result.candidateId} does not match candidate decisions`);
+		} else if (selected.length !== 0) throw new SearchLedgerIntegrityError("all-rejected completion contains a selected candidate");
+		completion = event;
+	};
+	const finish = (entries) => {
+		const selectedDecisions = decisions.filter((decision) => decision.decision.status === "selected");
+		const rejectedDecisions = decisions.filter((decision) => decision.decision.status === "rejected");
+		const outcomeCounts = {
+			passed: 0,
+			failed: 0,
+			errored: 0
+		};
+		const operationOutcomeCounts = {
+			completed: 0,
+			partial: 0,
+			failed: 0
+		};
+		let inputTokens = 0;
+		let outputTokens = 0;
+		let cachedTokens = 0;
+		let costUsd = 0;
+		const unknownTokenEventIds = [];
+		const unknownCostEventIds = [];
+		for (const attempt of attempts) outcomeCounts[attempt.outcome.status] += 1;
+		for (const operation of operationEvents) operationOutcomeCounts[operation.outcome.status] += 1;
+		for (const costedEvent of [...attempts, ...operationEvents]) {
+			if (costedEvent.accounting.tokens.status === "known") {
+				inputTokens += costedEvent.accounting.tokens.inputTokens;
+				outputTokens += costedEvent.accounting.tokens.outputTokens;
+				cachedTokens += costedEvent.accounting.tokens.cachedTokens;
+			} else unknownTokenEventIds.push(costedEvent.eventId);
+			if (costedEvent.accounting.cost.status === "known") costUsd += costedEvent.accounting.cost.usd;
+			else {
+				costUsd += costedEvent.accounting.cost.knownLowerBoundUsd;
+				unknownCostEventIds.push(costedEvent.eventId);
 			}
-			sections.push("");
 		}
-	}
-	if (ctx.topTrials.length > 0) {
-		sections.push("## Successes (top trials) — what to preserve");
-		sections.push("");
-		for (const trial of ctx.topTrials) sections.push(`- \`${trial.id}\`: score ${trial.score.toFixed(2)}${trial.inputName ? ` (${trial.inputName})` : ""}`);
-		sections.push("");
-	}
-	sections.push("## Allowed mutation primitives");
-	sections.push("");
-	for (const p of primitives) sections.push(`- ${p}`);
-	sections.push("");
-	sections.push("## Output schema");
-	sections.push("");
-	sections.push("Respond with a JSON object — no prose, no markdown fences:");
-	sections.push("```json");
-	sections.push(JSON.stringify({ proposals: [{
-		label: "<short label, ≤ 40 chars>",
-		rationale: "<which failure this targets and which primitive you used>",
-		payload: "<full payload of the new variant — same shape as the current variant>"
-	}] }, null, 2));
-	sections.push("```");
-	return sections.join("\n");
-}
-function truncate(s, max) {
-	if (s.length <= max) return s;
-	return `${s.slice(0, max)}… [truncated]`;
-}
-function quote(s) {
-	return s.replace(/`/g, "\\`");
+		const accounting = unknownTokenEventIds.length === 0 && unknownCostEventIds.length === 0 ? {
+			status: "known",
+			inputTokens,
+			outputTokens,
+			cachedTokens,
+			costUsd
+		} : {
+			status: "partial",
+			knownInputTokens: inputTokens,
+			knownOutputTokens: outputTokens,
+			knownCachedTokens: cachedTokens,
+			knownCostUsd: costUsd,
+			unknownTokenEventIds,
+			unknownCostEventIds
+		};
+		const selectedCandidateId = completion?.result.status === "selected" ? completion.result.candidateId : null;
+		const status = completion?.result.status === "selected" ? "selected" : completion?.result.status === "all-rejected" ? "all-rejected" : "in-progress";
+		const missingCandidateSlots = [...plannedSlots.values()].filter((slot) => !candidateBySlot.has(slot.slotId) && !closedSlots.has(slot.slotId)).map((slot) => slot.slotId);
+		const missingTaskOutcomes = planEvent ? plannedTaskOutcomeKeys(planEvent, candidates) : [];
+		const missingOperations = [...plannedOperations.values()].filter((operation) => !operationsById.has(operation.operationId)).map((operation) => operation.operationId);
+		return {
+			entries: [...entries],
+			plan: planEvent,
+			planExtensions,
+			candidates: candidateEvents,
+			closedCandidateSlots: closedSlotEvents,
+			attempts,
+			operations: operationEvents,
+			decisions,
+			completion,
+			audit: {
+				campaignId,
+				eventCount: entries.length,
+				candidateCount: candidates.size,
+				closedCandidateSlotCount: closedSlots.size,
+				attemptCount: attempts.length,
+				operationCount: operationEvents.length,
+				outcomes: outcomeCounts,
+				operationOutcomes: operationOutcomeCounts,
+				decisions: {
+					selected: selectedDecisions.length,
+					rejected: rejectedDecisions.length,
+					pending: candidates.size - decisions.length
+				},
+				expected: {
+					candidateSlots: plannedSlots.size,
+					taskOutcomes: candidates.size * (planEvent?.plan.tasks.length ?? 0),
+					operations: plannedOperations.size,
+					missingCandidateSlots,
+					missingTaskOutcomes,
+					missingOperations
+				},
+				status,
+				selectedCandidateId,
+				accounting,
+				headHash: entries.at(-1)?.entryHash ?? null
+			}
+		};
+	};
+	return {
+		apply,
+		finish
+	};
 }
-/**
-* Parse the model's JSON response back into proposals. Tolerates markdown
-* fences and surrounding prose. Returns at most `maxProposals`.
-*/
-function parseReflectionResponse(raw, maxProposals) {
-	let text = raw.trim();
-	if (text.startsWith("```")) text = text.replace(/^```(?:json)?\n?/, "").replace(/\n?```$/, "");
-	let parsed = null;
-	const objectStart = text.indexOf("{");
-	const objectEnd = text.lastIndexOf("}");
-	const arrayStart = text.indexOf("[");
-	const arrayEnd = text.lastIndexOf("]");
-	const tryObjectFirst = objectStart >= 0 && (arrayStart < 0 || objectStart < arrayStart);
-	const candidates = [];
-	if (tryObjectFirst) {
-		if (objectStart >= 0 && objectEnd > objectStart) candidates.push(text.slice(objectStart, objectEnd + 1));
-		if (arrayStart >= 0 && arrayEnd > arrayStart) candidates.push(text.slice(arrayStart, arrayEnd + 1));
-	} else {
-		if (arrayStart >= 0 && arrayEnd > arrayStart) candidates.push(text.slice(arrayStart, arrayEnd + 1));
-		if (objectStart >= 0 && objectEnd > objectStart) candidates.push(text.slice(objectStart, objectEnd + 1));
-	}
-	for (const slice of candidates) try {
-		parsed = JSON.parse(slice);
-		break;
-	} catch {}
-	if (parsed == null) for (const slice of candidates) {
-		const closed = autoCloseTruncatedJson(slice);
-		if (closed != null && closed !== slice) try {
-			parsed = JSON.parse(closed);
-			break;
-		} catch {}
-	}
-	if (parsed == null) return [];
-	let proposalsRaw;
-	if (Array.isArray(parsed)) proposalsRaw = parsed;
-	else if (parsed && typeof parsed === "object") proposalsRaw = parsed.proposals;
-	if (!Array.isArray(proposalsRaw)) return [];
-	const out = [];
-	for (const p of proposalsRaw) {
-		if (!p || typeof p !== "object") continue;
-		const obj = p;
-		if (!("payload" in obj)) continue;
-		out.push({
-			label: typeof obj.label === "string" ? obj.label : "mutation",
-			rationale: typeof obj.rationale === "string" ? obj.rationale : "",
-			payload: obj.payload
-		});
-		if (maxProposals !== void 0 && out.length >= maxProposals) break;
-	}
-	return out;
+/** Every candidate slot must name a planned candidate-generation operation,
+* whether it arrives with the plan or with a later extension. */
+function assertSlotGenerationOperation(slot, plannedOperations) {
+	if (plannedOperations.get(slot.generationOperationId)?.kind !== "candidate-generation") throw new SearchLedgerIntegrityError(`candidate slot ${slot.slotId} references unplanned candidate-generation operation ${slot.generationOperationId}`);
 }
-//#endregion
-//#region src/campaign/score-utils.ts
-/**
-* Shared campaign-score reductions used by every optimizer preset
-* (`runOptimization`, external optimization methods, `compareOptimizationMethods`).
-* "composite of a campaign" and "per-scenario / per-dimension breakdown" so
-* the optimizers cannot drift on how a surface's score is computed.
-*/
-/** Mean composite across cells with complete task-quality evidence.
-*  Partial judge results remain on their cells but never enter this value.
-*  A campaign with no complete score has no numeric mean and fails loudly. */
-function campaignMeanComposite(campaign) {
-	const mean = campaignMeanCompositeOrNull(campaign);
-	if (mean === null) throw new Error("campaignMeanComposite: campaign has no complete cell-quality scores");
-	return mean;
-}
-/** Nullable campaign mean for wire and report fields that represent missing quality. */
-function campaignMeanCompositeOrNull(campaign) {
-	const scores = campaign.cells.flatMap((cell) => {
-		const score = projectCampaignCellQuality(cell).score;
-		return score === void 0 ? [] : [score];
-	});
-	return scores.length === 0 ? null : scores.reduce((sum, score) => sum + score, 0) / scores.length;
-}
-/** Reject rank keys that cannot produce deterministic lexicographic ordering. */
-function assertFiniteRankKey(key, label, expectedLength) {
-	if (!Array.isArray(key) || key.length === 0) throw new Error(`${label} must return a non-empty array`);
-	if (expectedLength !== void 0 && key.length !== expectedLength) throw new Error(`${label} returned ${key.length} elements; expected ${expectedLength}`);
-	for (let index = 0; index < key.length; index++) if (!Number.isFinite(key[index])) throw new Error(`${label}[${index}] must be finite`);
-}
-/** Compare fixed-length lexicographic rank keys where each element is higher-is-better.
-*  Returns a positive number when `a` ranks above `b`, negative when below, and
-*  zero when equal. */
-function compareRankKeys(a, b) {
-	assertFiniteRankKey(a, "rank key a");
-	assertFiniteRankKey(b, "rank key b", a.length);
-	for (let i = 0; i < a.length; i++) {
-		const av = a[i];
-		const bv = b[i];
-		if (av !== bv) return av - bv;
+function plannedTaskOutcomeKeys(planEvent, candidates) {
+	const missing = [];
+	const registeredCandidates = [...candidates.values()].sort((a, b) => compareStrings(a.registered.slotId, b.registered.slotId));
+	for (const candidate of registeredCandidates) {
+		const slotId = candidate.registered.slotId;
+		for (const task of planEvent.plan.tasks) if (!candidate.attempts.some((attempt) => attempt.task.taskId === task.taskId && attempt.outcome.status !== "errored")) missing.push(`${slotId}/${task.taskId}`);
 	}
-	return 0;
-}
-/** Per-candidate evidence a reflective/patch proposer grounds its next proposal
-*  on: mean score per judge dimension + per-scenario composite. */
-function campaignBreakdown(campaign) {
-	const dimSums = {};
-	const dimCounts = {};
-	const byScenario = /* @__PURE__ */ new Map();
-	const notesByScenario = /* @__PURE__ */ new Map();
-	const emittedByScenario = /* @__PURE__ */ new Map();
-	for (const cell of campaign.cells) {
-		const quality = projectCampaignCellQuality(cell);
-		if (quality.score === void 0) continue;
-		const judgeScores = Object.values(quality.successfulJudgeScores);
-		const cellComposite = quality.score;
-		const arr = byScenario.get(cell.scenarioId) ?? [];
-		arr.push(cellComposite);
-		byScenario.set(cell.scenarioId, arr);
-		if (typeof cell.artifact === "string" && cell.artifact.trim().length > 0) {
-			const prev = emittedByScenario.get(cell.scenarioId);
-			if (!prev || cellComposite < prev.composite) emittedByScenario.set(cell.scenarioId, {
-				composite: cellComposite,
-				text: cell.artifact.slice(0, EMITTED_EVIDENCE_MAX_CHARS)
-			});
-		}
-		for (const s of judgeScores) if (s.notes?.trim()) {
-			const set = notesByScenario.get(cell.scenarioId) ?? /* @__PURE__ */ new Set();
-			set.add(s.notes.trim());
-			notesByScenario.set(cell.scenarioId, set);
+	return missing;
+}
+function normalizeEvent(event) {
+	const artifacts = sortArtifacts(event.artifacts);
+	if (event.kind === "search-planned") return {
+		...event,
+		artifacts,
+		plan: {
+			candidateSlots: [...event.plan.candidateSlots].sort((a, b) => compareStrings(a.slotId, b.slotId)),
+			tasks: [...event.plan.tasks].sort((a, b) => compareStrings(a.taskId, b.taskId)),
+			operations: [...event.plan.operations].sort((a, b) => compareStrings(a.operationId, b.operationId))
 		}
-		for (const score of judgeScores) for (const [key, value] of Object.entries(score.dimensions)) {
-			if (!Number.isFinite(value)) continue;
-			dimSums[key] = (dimSums[key] ?? 0) + value;
-			dimCounts[key] = (dimCounts[key] ?? 0) + 1;
+	};
+	if (event.kind === "search-plan-extended") return {
+		...event,
+		artifacts,
+		extension: {
+			candidateSlots: [...event.extension.candidateSlots].sort((a, b) => compareStrings(a.slotId, b.slotId)),
+			operations: [...event.extension.operations].sort((a, b) => compareStrings(a.operationId, b.operationId))
 		}
-	}
-	const dimensions = {};
-	for (const key of Object.keys(dimSums)) {
-		const count = dimCounts[key] ?? 0;
-		dimensions[key] = count > 0 ? (dimSums[key] ?? 0) / count : 0;
-	}
+	};
+	if (event.kind === "candidate-registered") return {
+		...event,
+		artifacts,
+		lineage: {
+			...event.lineage,
+			parentCandidateIds: sortedStrings(event.lineage.parentCandidateIds)
+		},
+		surfaces: [...event.surfaces].map((surface) => ({
+			...surface,
+			artifact: { ...surface.artifact }
+		})).sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
+	};
+	if (event.kind === "task-attempted") return {
+		...event,
+		artifacts,
+		surfaceEvidence: [...event.surfaceEvidence].map((evidence) => ({
+			...evidence,
+			evidence: sortArtifacts(evidence.evidence)
+		})).sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
+	};
 	return {
-		dimensions,
-		scenarios: [...byScenario.entries()].map(([scenarioId, comps]) => {
-			const notesSet = notesByScenario.get(scenarioId);
-			const notes = notesSet && notesSet.size > 0 ? [...notesSet].join(" | ") : void 0;
-			const emitted = emittedByScenario.get(scenarioId)?.text;
-			return {
-				scenarioId,
-				composite: comps.reduce((a, b) => a + b, 0) / comps.length,
-				...notes ? { notes } : {},
-				...emitted ? { emitted } : {}
-			};
-		})
+		...event,
+		artifacts
 	};
 }
+function sortArtifacts(artifacts) {
+	return [...artifacts].map((artifact) => ({ ...artifact })).sort((a, b) => compareStrings(artifactKey(a), artifactKey(b)));
+}
+function artifactKey(artifact) {
+	return canonicalString(artifact);
+}
+function compareStrings(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+function sortedStrings(values) {
+	return [...values].sort();
+}
+function assertUnique(values, label, eventId) {
+	if (new Set(values).size !== values.length) throw new SearchLedgerIntegrityError(`event ${eventId} contains duplicate ${label} values`);
+}
+function formatZodError(error) {
+	return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`).join("; ");
+}
 //#endregion
 //#region src/campaign/search-history-receipt.ts
 const SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION = "1.0.0";
 const SEARCH_HISTORY_RECEIPT_DIGEST_ALGORITHM = "rfc8785-sha256";
+function assertSearchHistoryAdmissionOptions(options) {
+	if (options.searchHistoryPolicy !== void 0 && !["allow-missing", "require-complete"].includes(options.searchHistoryPolicy)) throw new Error(`unknown searchHistoryPolicy '${String(options.searchHistoryPolicy)}'`);
+	if (options.searchHistoryVerification !== void 0 && !["receipt", "ledger"].includes(options.searchHistoryVerification)) throw new Error(`unknown searchHistoryVerification '${String(options.searchHistoryVerification)}'`);
+}
+/** Verify resolved bytes with the canonical codec, never a caller-supplied replay projection. */
+function verifySearchHistoryArtifact(receipt, storage) {
+	verifySearchHistoryReceipt(receipt);
+	const path = receipt.ledger.uri.startsWith("file:") ? fileURLToPath(receipt.ledger.uri) : receipt.ledger.uri;
+	const text = storage.read(path);
+	if (text === void 0) throw new Error(`search history ledger is missing or unreadable at '${path}'`);
+	if (new TextEncoder().encode(text).byteLength !== receipt.ledger.byteLength) throw new Error("search history ledger byte length mismatch");
+	if (hashCanonical(text) !== receipt.ledger.sha256) throw new Error("search history ledger digest mismatch");
+	assertSearchHistoryMatchesReplay(receipt, replaySearchLedgerText(text, receipt.summary.campaignId, path));
+}
 var SearchHistoryRequiredError = class extends Error {
 	producerId;
 	reasons;
@@ -4696,666 +4667,23 @@ async function runImprovementLoop(opts) {
 	};
 }
 //#endregion
-//#region src/campaign/provenance.ts
+//#region src/campaign/gepa-candidate-population.ts
 /**
-* Loop provenance — the durable, queryable record of WHAT a self-improvement
-* loop did and WHY, plus the OTel spans that let an OTLP collector pivot from
-* an eval-run to the underlying candidate→cell→gate→promote chain.
-*
-* Two artifacts, one source of truth:
-*
-*   1. `LoopProvenanceRecord` — a structured JSON record capturing every
-*      candidate (surfaceHash + label + rationale + structured cause), its measured composite,
-*      the gate decision + reasons + delta, the held-out lift, the explicit
-*      baseline→candidate diff, and BACKEND PROVENANCE (the
-*      `assertRealBackend` verdict + worker call count + model). This is the
-*      ingestable audit artifact: the +lift recomputes from it, the "because
-*      Z" rationale survives in it, and a stub backend is detectable from it.
-*
-*   2. `loopProvenanceSpans()` — the same chain emitted as OTLP-ingestable
-*      `TraceSpanEvent`s, pivoted on the substrate's standard
-*      `tangle.runId` / `tangle.scenarioId` / `tangle.cellId` /
-*      `tangle.generation` attributes (the same pivots `/adapters/otel`
-*      reads). The hosted `/v1/ingest/traces` endpoint receives the FULL loop,
-*      not just the `cost.*` spans `runCampaign` already emits per cell.
+* Read GEPA's exact candidate graph from the artifact addressed by method provenance.
 *
-* The record is built from the loop result and its settled cost receipts — no
-* second usage collector can contradict what the measured cells recorded.
+* The reader checks the supplied digest, declared byte count, run identity,
+* candidate surfaces, parent graph, selection scores, and configured bounds.
+* This proves that the bytes match the supplied summary. The caller remains
+* responsible for obtaining that summary from trusted method provenance.
 */
-/** One translation from a completed improvement loop into durable evidence. */
-function loopProvenanceArgsFromResult(input) {
-	const { result } = input;
-	return {
-		runId: input.runId,
-		runDir: input.runDir,
-		timestamp: input.timestamp,
-		baselineSurface: input.baselineSurface,
-		winnerSurface: result.winnerSurface,
-		...result.winnerLabel ? { winnerLabel: result.winnerLabel } : {},
-		...result.winnerRationale ? { winnerRationale: result.winnerRationale } : {},
-		baselineSearchCampaign: result.baselineCampaign,
-		generations: result.generations.map(({ record, surfaces }) => ({
-			generationIndex: record.generationIndex,
-			candidates: record.candidates,
-			promoted: record.promoted,
-			surfaces: surfaces.map(({ surfaceHash, surface, campaign }) => ({
-				surfaceHash,
-				surface,
-				campaign
-			}))
-		})),
-		gate: result.gateResult,
-		...result.holdout === "deferred" ? { holdout: "deferred" } : {},
-		baselineOnHoldout: result.baselineOnHoldout,
-		winnerOnHoldout: result.winnerOnHoldout,
-		...result.neutralizedSurface && result.neutralizedOnHoldout ? {
-			neutralizedSurface: result.neutralizedSurface,
-			neutralizedOnHoldout: result.neutralizedOnHoldout
-		} : {},
-		costReceipts: input.costReceipts,
-		totalCostUsd: input.totalCostUsd,
-		totalDurationMs: input.totalDurationMs
-	};
-}
-function meanHoldoutComposite(campaign) {
-	return campaignMeanComposite(campaign);
-}
-/** Build the durable provenance record from a completed loop result. */
-function buildLoopProvenanceRecord(args) {
-	if (!args.runId.trim() || !args.runDir.trim()) throw new Error("buildLoopProvenanceRecord: runId and runDir must be non-empty");
-	const timestampMs = Date.parse(args.timestamp);
-	if (!Number.isFinite(timestampMs) || new Date(timestampMs).toISOString() !== args.timestamp) throw new Error("buildLoopProvenanceRecord: timestamp must be a canonical ISO instant");
-	assertGateContributions(args.gate.contributingGates, "buildLoopProvenanceRecord");
-	const agentReceipts = args.costReceipts.filter((receipt) => receipt.channel === "agent");
-	const integrity = summarizeAgentReceiptIntegrity(agentReceipts);
-	const models = [...new Set(agentReceipts.map((receipt) => receipt.model))].sort();
-	const baselineSearchComposite = campaignMeanComposite(args.baselineSearchCampaign);
-	if (!Number.isFinite(baselineSearchComposite)) throw new Error("buildLoopProvenanceRecord: baselineSearchComposite must be finite");
-	const candidates = [];
-	let incumbentSurfaceHash = surfaceHash(args.baselineSurface);
-	let incumbentComposite = baselineSearchComposite;
-	let previousGeneration = -1;
-	for (const gen of args.generations) {
-		if (!Number.isSafeInteger(gen.generationIndex) || gen.generationIndex !== previousGeneration + 1) throw new Error("buildLoopProvenanceRecord: generation indices must be contiguous integers starting at zero");
-		previousGeneration = gen.generationIndex;
-		if (gen.candidates.length === 0) throw new Error("buildLoopProvenanceRecord: a recorded generation must contain a candidate");
-		if (new Set(gen.promoted).size !== gen.promoted.length || gen.promoted.length > 1) throw new Error("buildLoopProvenanceRecord: each generation may promote at most one candidate");
-		const promotedSet = new Set(gen.promoted);
-		const surfaceByHash = new Map(gen.surfaces.map((measured) => [measured.surfaceHash, measured]));
-		const candidateByHash = new Map(gen.candidates.map((candidate) => [candidate.surfaceHash, candidate]));
-		if (candidateByHash.size !== gen.candidates.length) throw new Error("buildLoopProvenanceRecord: duplicate candidate surface hash");
-		if (surfaceByHash.size !== gen.surfaces.length) throw new Error("buildLoopProvenanceRecord: duplicate candidate surface entry");
-		if (surfaceByHash.size !== candidateByHash.size) throw new Error("buildLoopProvenanceRecord: every measured candidate requires exactly one surface");
-		for (const promotedHash of promotedSet) if (!candidateByHash.has(promotedHash)) throw new Error("buildLoopProvenanceRecord: promoted hash has no measured candidate");
-		for (const c of gen.candidates) {
-			validateCandidateMeasurement(c, incumbentSurfaceHash, incumbentComposite, promotedSet.has(c.surfaceHash));
-			const measured = surfaceByHash.get(c.surfaceHash);
-			if (measured === void 0) throw new Error("buildLoopProvenanceRecord: measured candidate is missing its surface");
-			const { surface, campaign } = measured;
-			if (!surfaceHashMatches(surface, c.surfaceHash)) throw new Error("buildLoopProvenanceRecord: candidate surface hash does not match its surface bytes");
-			if (campaign.splitDigest !== args.baselineSearchCampaign.splitDigest) throw new Error("buildLoopProvenanceRecord: candidate campaign does not match the search split");
-			const entry = {
-				generation: gen.generationIndex,
-				surfaceHash: c.surfaceHash,
-				contentHash: surfaceContentHash(surface),
-				campaignDigest: campaignMeasurementDigest(campaign),
-				parentSurfaceHash: c.parentSurfaceHash,
-				parentComposite: c.parentComposite,
-				eligibleForPromotion: c.eligibleForPromotion,
-				coverage: {
-					expectedCells: c.coverage.expectedCells,
-					scorableCells: c.coverage.scorableCells,
-					unscorableCells: c.coverage.unscorableCells.map((cell) => ({ ...cell }))
-				},
-				composite: c.composite,
-				promoted: promotedSet.has(c.surfaceHash)
-			};
-			if (c.label) entry.label = c.label;
-			if (c.rationale) entry.rationale = c.rationale;
-			if (c.attribution) entry.attribution = c.attribution;
-			if (c.observedDeltaFromParent !== void 0) entry.observedDeltaFromParent = c.observedDeltaFromParent;
-			candidates.push(entry);
-		}
-		const promotedHash = gen.promoted[0];
-		if (promotedHash) {
-			const promoted = candidateByHash.get(promotedHash);
-			incumbentSurfaceHash = promoted.surfaceHash;
-			if (promoted.composite === null) throw new Error("buildLoopProvenanceRecord: promoted candidate is missing a composite");
-			incumbentComposite = promoted.composite;
-		}
-	}
-	if (surfaceHash(args.winnerSurface) !== incumbentSurfaceHash) throw new Error("buildLoopProvenanceRecord: winner surface does not match the final promoted incumbent");
-	const holdoutDeferred = args.holdout === "deferred";
-	if (args.baselineOnHoldout.splitDigest !== args.winnerOnHoldout.splitDigest) throw new Error("buildLoopProvenanceRecord: baseline and winner use different holdout splits");
-	if (args.neutralizedSurface === void 0 !== (args.neutralizedOnHoldout === void 0)) throw new Error("buildLoopProvenanceRecord: neutralized surface and campaign must be supplied together");
-	if (args.neutralizedOnHoldout && args.neutralizedOnHoldout.splitDigest !== args.baselineOnHoldout.splitDigest) throw new Error("buildLoopProvenanceRecord: neutralized campaign uses a different holdout split");
-	if (holdoutDeferred && args.neutralizedOnHoldout) throw new Error("buildLoopProvenanceRecord: a deferred holdout cannot include a neutralized measurement");
-	const holdoutMeasurement = holdoutDeferred ? { kind: "deferred" } : {
-		kind: "measured",
-		baseline: meanHoldoutComposite(args.baselineOnHoldout),
-		winner: meanHoldoutComposite(args.winnerOnHoldout),
-		...args.neutralizedOnHoldout ? { neutralized: meanHoldoutComposite(args.neutralizedOnHoldout) } : {}
-	};
-	const diff = surfaceContentHash(args.baselineSurface) === surfaceContentHash(args.winnerSurface) ? "" : renderSurfaceDiff(args.winnerSurface, args.baselineSurface);
-	const recordWithoutDigest = {
-		schema: "tangle.loop-provenance",
-		runId: args.runId,
-		runDir: args.runDir,
-		timestamp: args.timestamp,
-		baselineContentHash: surfaceContentHash(args.baselineSurface),
-		winnerContentHash: surfaceContentHash(args.winnerSurface),
-		diff,
-		candidates,
-		evidence: {
-			search: {
-				splitDigest: args.baselineSearchCampaign.splitDigest,
-				baselineCampaignDigest: campaignMeasurementDigest(args.baselineSearchCampaign)
-			},
-			holdout: {
-				splitDigest: args.baselineOnHoldout.splitDigest,
-				baselineCampaignDigest: campaignMeasurementDigest(args.baselineOnHoldout),
-				winnerCampaignDigest: campaignMeasurementDigest(args.winnerOnHoldout),
-				...args.neutralizedSurface && args.neutralizedOnHoldout && holdoutMeasurement.kind === "measured" && holdoutMeasurement.neutralized !== void 0 ? { neutralized: {
-					contentHash: surfaceContentHash(args.neutralizedSurface),
-					campaignDigest: campaignMeasurementDigest(args.neutralizedOnHoldout),
-					composite: holdoutMeasurement.neutralized,
-					lift: holdoutMeasurement.neutralized - holdoutMeasurement.baseline
-				} } : {}
-			},
-			costReceiptsDigest: canonicalDigest([...args.costReceipts].sort((left, right) => compareCodeUnits(left.callId, right.callId)))
-		},
-		baselineSearchComposite,
-		gate: {
-			decision: args.gate.decision,
-			reasons: args.gate.reasons,
-			...args.gate.delta === void 0 ? {} : { delta: args.gate.delta },
-			contributingGates: args.gate.contributingGates.map((g) => ({
-				name: g.name,
-				status: g.status,
-				detail: durableGateDetail(g.detail)
-			}))
-		},
-		...holdoutMeasurement.kind === "deferred" ? { holdout: "deferred" } : {
-			baselineHoldoutComposite: holdoutMeasurement.baseline,
-			winnerHoldoutComposite: holdoutMeasurement.winner,
-			heldOutLift: holdoutMeasurement.winner - holdoutMeasurement.baseline
-		},
-		backend: {
-			verdict: integrity.verdict,
-			workerCallCount: integrity.totalRecords,
-			models,
-			totalInputTokens: integrity.totalInputTokens,
-			totalOutputTokens: integrity.totalOutputTokens,
-			totalCostUsd: integrity.totalCostUsd
-		},
-		totalCostUsd: args.totalCostUsd,
-		totalDurationMs: args.totalDurationMs
-	};
-	if (args.optimizationMethod) recordWithoutDigest.optimizationMethod = durableOptimizationMethod(args.optimizationMethod);
-	if (args.winnerLabel) recordWithoutDigest.winnerLabel = args.winnerLabel;
-	if (args.winnerRationale) recordWithoutDigest.winnerRationale = args.winnerRationale;
-	return {
-		...recordWithoutDigest,
-		recordDigest: canonicalDigest(recordWithoutDigest)
-	};
-}
-function durableOptimizationMethod(value) {
-	if (!value || typeof value !== "object" || typeof value.name !== "string" || !value.name.trim() || value.name.trim() !== value.name) throw new Error("buildLoopProvenanceRecord: optimization method name is invalid");
-	if (!value.cost || !Number.isFinite(value.cost.totalCostUsd) || value.cost.totalCostUsd < 0 || typeof value.cost.accountingComplete !== "boolean" || !Array.isArray(value.cost.incompleteReasons) || value.cost.incompleteReasons.some((reason) => typeof reason !== "string" || !reason.trim()) || value.cost.accountingComplete !== (value.cost.incompleteReasons.length === 0)) throw new Error("buildLoopProvenanceRecord: optimization method cost is invalid");
-	if (value.durationMs !== void 0 && (!Number.isFinite(value.durationMs) || value.durationMs < 0)) throw new Error("buildLoopProvenanceRecord: optimization method duration is invalid");
-	try {
-		return JSON.parse(canonicalString(value));
-	} catch (cause) {
-		throw new Error("buildLoopProvenanceRecord: optimization method data must be canonical JSON", { cause });
-	}
-}
-/** Digest the exact campaign fields that can affect a measured comparison. */
-function campaignMeasurementDigest(campaign) {
-	assertCampaignSplitIdentity(campaign.scenarios, campaign.reps, campaign.splitDigest);
-	return canonicalDigest({
-		schema: "tangle.campaign-measurement",
-		manifestHash: campaign.manifestHash,
-		splitDigest: campaign.splitDigest,
-		seed: campaign.seed,
-		reps: campaign.reps,
-		runDir: campaign.runDir,
-		scenarios: campaign.scenarios,
-		cells: [...campaign.cells].sort((left, right) => compareCodeUnits(left.cellId, right.cellId)).map((cell) => ({
-			manifestHash: cell.manifestHash ?? null,
-			cellId: cell.cellId,
-			scenarioId: cell.scenarioId,
-			rep: cell.rep,
-			generation: cell.generation ?? null,
-			judgeScores: cell.judgeScores,
-			costUsd: cell.costUsd,
-			costProvenance: cell.costProvenance,
-			costCallIds: [...cell.costCallIds ?? []].sort(),
-			tokenUsage: cell.tokenUsage,
-			resolvedModels: [...cell.resolvedModels ?? []].sort(),
-			resolvedModel: cell.resolvedModel ?? null,
-			durationMs: cell.durationMs,
-			seed: cell.seed,
-			cached: cell.cached,
-			errorStage: cell.errorStage ?? null,
-			errorJudge: cell.errorJudge ?? null,
-			error: cell.error ?? null
-		}))
-	});
-}
-/** Recompute and validate the self-addressed durable record. */
-function verifyLoopProvenanceRecord(record) {
-	if (record.schema !== "tangle.loop-provenance") throw new Error("loop provenance has an unsupported schema");
-	const { recordDigest, ...recordWithoutDigest } = record;
-	if (recordDigest !== canonicalDigest(recordWithoutDigest)) throw new Error("loop provenance record digest does not match its contents");
-	assertGateContributions(record.gate?.contributingGates, "loop provenance");
-	return record;
-}
-/** SHA-256 over the RFC 8785 canonical JSON of `value`. Throws
-* `LedgerCanonicalizationError` for a value with no canonical form. */
-function canonicalDigest(value) {
-	return hashCanonical(value);
-}
-function durableGateDetail(detail) {
-	if (detail === void 0) return null;
-	try {
-		return JSON.parse(canonicalString(detail));
-	} catch (cause) {
-		throw new Error("buildLoopProvenanceRecord: gate detail must be canonical JSON", { cause });
-	}
-}
-function assertGateContributions(value, source) {
-	if (!Array.isArray(value)) throw new Error(`${source}: gate contributingGates must be an array`);
-	const statuses = /* @__PURE__ */ new Set([
-		"pass",
-		"fail",
-		"not_evaluated"
-	]);
-	for (const [index, contribution] of value.entries()) {
-		if (!contribution || typeof contribution !== "object") throw new Error(`${source}: gate contribution ${index} must be an object`);
-		const item = contribution;
-		if (typeof item.name !== "string" || item.name.length === 0) throw new Error(`${source}: gate contribution ${index} must have a non-empty name`);
-		if (!statuses.has(String(item.status))) throw new Error(`${source}: gate contribution '${item.name}' must have status pass, fail, or not_evaluated`);
-		if ("passed" in item) throw new Error(`${source}: gate contribution '${item.name}' uses obsolete passed; use status instead`);
-	}
-}
-function validateCandidateMeasurement(candidate, expectedParentHash, expectedParentComposite, promoted) {
-	if (!candidate.parentSurfaceHash || !/^[a-f0-9]{16}$/.test(candidate.parentSurfaceHash)) throw new Error("buildLoopProvenanceRecord: parentSurfaceHash must be 16 lowercase hex characters");
-	if (candidate.parentSurfaceHash !== expectedParentHash) throw new Error("buildLoopProvenanceRecord: candidate parent does not match the incumbent");
-	if (candidate.parentComposite === void 0 || !Number.isFinite(candidate.parentComposite) || Math.abs(candidate.parentComposite - expectedParentComposite) > 1e-12) throw new Error("buildLoopProvenanceRecord: candidate parentComposite does not match the incumbent");
-	if (candidate.observedDeltaFromParent !== void 0) {
-		if (!Number.isFinite(candidate.observedDeltaFromParent)) throw new Error("buildLoopProvenanceRecord: observedDeltaFromParent must be finite");
-		if (candidate.eligibleForPromotion !== true) throw new Error("buildLoopProvenanceRecord: observedDeltaFromParent requires a complete eligible candidate and parentSurfaceHash");
-	}
-	const coverage = candidate.coverage;
-	if (!Number.isSafeInteger(coverage.expectedCells) || coverage.expectedCells <= 0 || !Number.isSafeInteger(coverage.scorableCells) || coverage.scorableCells < 0 || coverage.scorableCells > coverage.expectedCells) throw new Error("buildLoopProvenanceRecord: invalid candidate coverage denominator");
-	const unscorableIds = /* @__PURE__ */ new Set();
-	for (const failure of coverage.unscorableCells) {
-		if (typeof failure.cellId !== "string" || failure.cellId.length === 0 || typeof failure.reason !== "string" || failure.reason.length === 0 || unscorableIds.has(failure.cellId)) throw new Error("buildLoopProvenanceRecord: invalid candidate coverage failures");
-		unscorableIds.add(failure.cellId);
-	}
-	if (coverage.expectedCells - coverage.scorableCells !== coverage.unscorableCells.length) throw new Error("buildLoopProvenanceRecord: candidate coverage counts do not match its failures");
-	const complete = coverage.scorableCells === coverage.expectedCells && coverage.unscorableCells.length === 0;
-	if (candidate.eligibleForPromotion !== complete) throw new Error("buildLoopProvenanceRecord: candidate eligibility contradicts its coverage receipt");
-	if (complete) {
-		if (candidate.composite === null || !Number.isFinite(candidate.composite)) throw new Error("buildLoopProvenanceRecord: complete candidate composite must be finite");
-		if (candidate.observedDeltaFromParent === void 0) throw new Error("buildLoopProvenanceRecord: complete candidate is missing observedDeltaFromParent");
-		const recomputed = candidate.composite - candidate.parentComposite;
-		if (Math.abs(candidate.observedDeltaFromParent - recomputed) > 1e-12) throw new Error("buildLoopProvenanceRecord: observed delta does not match measured scores");
-	} else {
-		if (candidate.composite !== null && !Number.isFinite(candidate.composite)) throw new Error("buildLoopProvenanceRecord: candidate composite must be finite or null");
-		if (candidate.observedDeltaFromParent !== void 0) throw new Error("buildLoopProvenanceRecord: incomplete candidate cannot carry observed delta");
-	}
-	if (promoted && (!complete || (candidate.observedDeltaFromParent ?? 0) <= 0)) throw new Error("buildLoopProvenanceRecord: promoted candidate must improve the incumbent");
-}
-function hashId(parts) {
-	return createHash("sha256").update(parts.join(":")).digest("hex");
-}
-/**
-* Build the loop's OTLP-ingestable spans from a provenance record. One root
-* span per loop (`tangle.runId`), one span per generation, one span per
-* candidate (carrying its surfaceHash + label), and one span for the gate
-* decision (carrying reasons + delta + lift). Candidate + gate spans pivot on
-* the same `tangle.runId` / `tangle.generation` attributes `/adapters/otel`
-* reads, so the hosted collector reconstructs the full tree.
-*
-* Times are synthesized monotonically off a single base so the span tree is
-* orderable; the substrate does not retain per-candidate wall-clock starts.
-*/
-function loopProvenanceSpans(record, opts = {}) {
-	const traceId = hashId(["trace", record.runId]).slice(0, 32);
-	const baseTimeMs = opts.baseTimeMs ?? (Date.parse(record.timestamp) || Date.now());
-	const durationMs = Math.max(1, record.totalDurationMs);
-	if (!Number.isSafeInteger(baseTimeMs) || baseTimeMs < 0) throw new RangeError("loop provenance baseTimeMs must be a non-negative safe integer");
-	if (!Number.isSafeInteger(durationMs)) throw new RangeError("loop provenance duration must be a safe integer number of milliseconds");
-	const baseTime = BigInt(baseTimeMs);
-	const baseNano = (baseTime * 1000000n).toString();
-	const endNano = ((baseTime + BigInt(durationMs)) * 1000000n).toString();
-	const spans = [];
-	const rootSpanId = hashId(["root", record.runId]).slice(0, 16);
-	const rootAttributes = {
-		"tangle.runId": record.runId,
-		"tangle.runDir": record.runDir,
-		"tangle.baselineContentHash": record.baselineContentHash,
-		"tangle.winnerContentHash": record.winnerContentHash,
-		"tangle.baselineSearchComposite": record.baselineSearchComposite,
-		"tangle.gateDecision": record.gate.decision,
-		"tangle.backendVerdict": record.backend.verdict,
-		"tangle.workerCallCount": record.backend.workerCallCount,
-		"tangle.totalCostUsd": record.totalCostUsd
-	};
-	if (record.heldOutLift !== void 0) rootAttributes["tangle.heldOutLift"] = record.heldOutLift;
-	if (record.holdout) rootAttributes["tangle.holdout"] = record.holdout;
-	spans.push({
-		traceId,
-		spanId: rootSpanId,
-		name: "improvement-loop",
-		startTimeUnixNano: baseNano,
-		endTimeUnixNano: endNano,
-		attributes: rootAttributes,
-		status: { code: "OK" },
-		"tangle.runId": record.runId
-	});
-	const byGen = /* @__PURE__ */ new Map();
-	for (const c of record.candidates) {
-		const arr = byGen.get(c.generation) ?? [];
-		arr.push(c);
-		byGen.set(c.generation, arr);
-	}
-	for (const [generation, cands] of [...byGen.entries()].sort((a, b) => a[0] - b[0])) {
-		const genSpanId = hashId([
-			"gen",
-			record.runId,
-			String(generation)
-		]).slice(0, 16);
-		const measuredComposites = cands.flatMap((candidate) => candidate.composite === null ? [] : [candidate.composite]);
-		spans.push({
-			traceId,
-			spanId: genSpanId,
-			parentSpanId: rootSpanId,
-			name: `generation-${generation}`,
-			startTimeUnixNano: baseNano,
-			endTimeUnixNano: endNano,
-			attributes: {
-				"tangle.runId": record.runId,
-				"tangle.generation": generation,
-				"tangle.populationSize": cands.length,
-				...measuredComposites.length > 0 ? { "tangle.bestComposite": Math.max(...measuredComposites) } : {}
-			},
-			"tangle.runId": record.runId,
-			"tangle.generation": generation
-		});
-		for (let i = 0; i < cands.length; i++) {
-			const c = cands[i];
-			const candSpanId = hashId([
-				"cand",
-				record.runId,
-				String(generation),
-				c.surfaceHash
-			]).slice(0, 16);
-			const attributes = {
-				"tangle.runId": record.runId,
-				"tangle.generation": generation,
-				"tangle.surfaceHash": c.surfaceHash,
-				"tangle.contentHash": c.contentHash,
-				"tangle.parentSurfaceHash": c.parentSurfaceHash,
-				"tangle.parentComposite": c.parentComposite,
-				"tangle.eligibleForPromotion": c.eligibleForPromotion,
-				"tangle.expectedCells": c.coverage.expectedCells,
-				"tangle.scorableCells": c.coverage.scorableCells,
-				"tangle.unscorableCells": c.coverage.unscorableCells.length,
-				"tangle.promoted": c.promoted
-			};
-			if (c.composite !== null) attributes["tangle.composite"] = c.composite;
-			if (c.observedDeltaFromParent !== void 0) attributes["tangle.observedDeltaFromParent"] = c.observedDeltaFromParent;
-			if (c.label) attributes["tangle.candidateLabel"] = c.label;
-			if (c.rationale) attributes["tangle.candidateRationale"] = c.rationale;
-			spans.push({
-				traceId,
-				spanId: candSpanId,
-				parentSpanId: genSpanId,
-				name: `candidate-${c.surfaceHash}`,
-				startTimeUnixNano: baseNano,
-				endTimeUnixNano: endNano,
-				attributes,
-				"tangle.runId": record.runId,
-				"tangle.generation": generation
-			});
-		}
-	}
-	const gateSpanId = hashId(["gate", record.runId]).slice(0, 16);
-	const gateAttributes = {
-		"tangle.runId": record.runId,
-		"tangle.gateDecision": record.gate.decision,
-		"tangle.gateReasons": JSON.stringify(record.gate.reasons)
-	};
-	const gateDelta = record.gate.delta ?? record.heldOutLift;
-	if (gateDelta !== void 0) gateAttributes["tangle.gateDelta"] = gateDelta;
-	if (record.heldOutLift !== void 0) gateAttributes["tangle.heldOutLift"] = record.heldOutLift;
-	if (record.baselineHoldoutComposite !== void 0) gateAttributes["tangle.baselineHoldoutComposite"] = record.baselineHoldoutComposite;
-	if (record.winnerHoldoutComposite !== void 0) gateAttributes["tangle.winnerHoldoutComposite"] = record.winnerHoldoutComposite;
-	if (record.holdout) gateAttributes["tangle.holdout"] = record.holdout;
-	spans.push({
-		traceId,
-		spanId: gateSpanId,
-		parentSpanId: rootSpanId,
-		name: "gate-decision",
-		startTimeUnixNano: endNano,
-		endTimeUnixNano: endNano,
-		attributes: gateAttributes,
-		status: { code: "OK" },
-		"tangle.runId": record.runId
-	});
-	return spans;
-}
-/** Canonical durable paths under the run dir. */
-function provenanceRecordPath(runDir) {
-	return join(runDir, "loop-provenance.json");
-}
-/**
-* Canonical path for the durable OTLP spans JSONL file under a loop run directory.
-*/
-function provenanceSpansPath(runDir) {
-	return join(runDir, "loop-provenance-spans.jsonl");
-}
-/** Snapshot a held-out campaign into the hosted `EvalRunGenerationSnapshot`
-*  shape — per-cell composite + per-judge dimensions, aggregate mean, cost,
-*  duration. The dashboard renders these as the baseline → winner comparison. */
-function snapshotFromHoldout(index, surfaceHash, surface, campaign) {
-	return {
-		index,
-		surfaceHash,
-		surface,
-		cells: campaign.cells.map((cell) => {
-			const execution = campaignCellExecutionEvidence(cell);
-			const quality = projectCampaignCellQuality(cell);
-			const score = {
-				scenarioId: cell.scenarioId,
-				rep: cell.rep,
-				compositeMean: quality.score ?? null,
-				dimensions: quality.judgeScores?.perJudge ?? {},
-				terminalOutcome: execution.terminalOutcome,
-				executionErrorCount: execution.executionErrorCount ?? null
-			};
-			if (cell.error) score.errorMessage = cell.error;
-			return score;
-		}),
-		compositeMean: campaignMeanCompositeOrNull(campaign),
-		costUsd: campaign.aggregates.cost.totalCostUsd,
-		durationMs: campaign.durationMs
-	};
-}
-/** Build the hosted `EvalRunEvent` from the loop args + record — baseline +
-*  winner snapshots, gate decision, held-out lift, cost, duration. Shipped to
-*  `/v1/ingest/eval-runs` so the run appears in the dashboard's run list (the
-*  trace spans, shipped separately, back the per-candidate drill-down). */
-function buildEvalRunEvent(args, record) {
-	return {
-		runId: args.runId,
-		runDir: args.runDir,
-		timestamp: args.timestamp,
-		status: "finished",
-		labels: {},
-		baseline: snapshotFromHoldout(0, record.baselineContentHash, args.baselineSurface, args.baselineOnHoldout),
-		generations: [snapshotFromHoldout(1, record.winnerContentHash, args.winnerSurface, args.winnerOnHoldout)],
-		gateDecision: args.gate.decision,
-		...record.heldOutLift !== void 0 ? { holdoutLift: record.heldOutLift } : {},
-		totalCostUsd: args.totalCostUsd,
-		totalDurationMs: args.totalDurationMs
-	};
-}
-/**
-* Build the provenance record + OTel spans and persist them durably under the
-* run dir (and ship spans to a hosted collector when one is wired). Returns
-* both artifacts so the caller can assert on / re-derive from them.
-*
-* Fail-loud: the durable write throws on storage failure (a swallowed write is
-* exactly the "emitted but lost" failure this closes). The hosted span ship is
-* the one best-effort leg — its failure is logged, not thrown, so an offline
-* collector never fails the loop (the durable artifact is the source of truth).
-*/
-async function emitLoopProvenance(args) {
-	const record = buildLoopProvenanceRecord(args);
-	const spans = loopProvenanceSpans(record);
-	args.storage.ensureDir(args.runDir);
-	const recordPath = provenanceRecordPath(args.runDir);
-	const spansPath = provenanceSpansPath(args.runDir);
-	args.storage.write(recordPath, JSON.stringify(record, null, 2));
-	args.storage.write(spansPath, spans.map((s) => JSON.stringify(s)).join("\n"));
-	if (args.hostedClient) {
-		try {
-			await args.hostedClient.ingestEvalRun(buildEvalRunEvent(args, record));
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			console.warn(`[agent-eval] hosted eval-run ingest failed (continuing): ${msg}`);
-		}
-		try {
-			await args.hostedClient.ingestTraces(spans);
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			console.warn(`[agent-eval] provenance span ingest failed (continuing): ${msg}`);
-		}
-	}
-	return {
-		record,
-		spans,
-		recordPath,
-		spansPath
-	};
-}
-//#endregion
-//#region src/campaign/optimization-cost.ts
-/** Attribute method calls while retaining the shared account's admission and read behavior. */
-function createMethodCostScope(account, methodName) {
-	const tags = { optimizationAttempt: crypto.randomUUID() };
-	return {
-		ledger: Object.freeze({
-			costCeilingUsd: account.costCeilingUsd,
-			runPaidCall: (input) => account.runPaidCall({
-				...input,
-				tags: {
-					...input.tags,
-					...tags
-				}
-			}),
-			summary: account.summary.bind(account),
-			list: account.list.bind(account),
-			reconcile: account.reconcile.bind(account),
-			markCompleted: account.markCompleted.bind(account),
-			costPerCompletedTask: account.costPerCompletedTask.bind(account),
-			...account.listPending ? { listPending: account.listPending.bind(account) } : {},
-			...account.waitForIdle ? { waitForIdle: account.waitForIdle.bind(account) } : {}
-		}),
-		reconcile(reported) {
-			const summary = account.summary({ tags });
-			if (summary.pendingCalls > 0) throw new Error(`optimization method '${methodName}' returned with ${summary.pendingCalls} pending paid call(s)`);
-			const recorded = costFromLedgerSummary(summary);
-			const totalCostUsd = Math.max(reported.totalCostUsd, recorded.totalCostUsd);
-			const roundingToleranceUsd = Number.EPSILON * Math.max(1, totalCostUsd) * (summary.totalCalls + 1);
-			const combined = combineComparisonCosts([{
-				label: "reported",
-				cost: reported
-			}, {
-				label: "recorded",
-				cost: recorded
-			}]);
-			const incompleteReasons = [
-				...reported.incompleteReasons,
-				...recorded.incompleteReasons.map((reason) => `recorded: ${reason}`),
-				...recorded.totalCostUsd - reported.totalCostUsd > roundingToleranceUsd ? [`reported ${reported.totalCostUsd} USD below recorded ${recorded.totalCostUsd} USD`] : []
-			];
-			return {
-				totalCostUsd,
-				costProvenance: combined.costProvenance.kind === "uncaptured" ? combined.costProvenance : {
-					kind: combined.costProvenance.kind,
-					usd: totalCostUsd
-				},
-				accountingComplete: incompleteReasons.length === 0,
-				incompleteReasons
-			};
-		}
-	};
-}
-/** Keep the cost fields a custom optimization method must report. */
-function costFromLedgerSummary(summary) {
-	const cost = {
-		totalCostUsd: summary.totalCostUsd,
-		costProvenance: structuredClone(summary.costProvenance),
-		accountingComplete: summary.accountingComplete,
-		incompleteReasons: [...summary.incompleteReasons]
-	};
-	assertComparisonCost(cost, "cost ledger");
-	return cost;
-}
-/** Combine method costs without turning one unknown bill into a known total. */
-function combineComparisonCosts(entries) {
-	const totalCostUsd = entries.reduce((total, entry) => total + entry.cost.totalCostUsd, 0);
-	const cost = {
-		totalCostUsd,
-		costProvenance: entries.some((entry) => entry.cost.costProvenance.kind === "uncaptured") ? {
-			kind: "uncaptured",
-			usd: null
-		} : entries.every((entry) => entry.cost.costProvenance.kind === "observed") ? {
-			kind: "observed",
-			usd: totalCostUsd
-		} : {
-			kind: "estimated",
-			usd: totalCostUsd
-		},
-		accountingComplete: entries.every((entry) => entry.cost.accountingComplete),
-		incompleteReasons: entries.flatMap((entry) => entry.cost.incompleteReasons.map((reason) => `${entry.label}: ${reason}`))
-	};
-	assertComparisonCost(cost, "combined cost");
-	return cost;
-}
-function assertComparisonCost(cost, label) {
-	if (!cost || typeof cost !== "object") throw new Error(`compareOptimizationMethods: ${label} returned no cost`);
-	if (!Number.isFinite(cost.totalCostUsd) || cost.totalCostUsd < 0) throw new Error(`compareOptimizationMethods: ${label} returned an invalid totalCostUsd`);
-	const provenance = cost.costProvenance;
-	if (!provenance || typeof provenance !== "object" || provenance.kind !== "observed" && provenance.kind !== "estimated" && provenance.kind !== "uncaptured" || (provenance.kind === "uncaptured" ? provenance.usd !== null : !Number.isFinite(provenance.usd) || provenance.usd < 0)) throw new Error(`compareOptimizationMethods: ${label} returned invalid costProvenance`);
-	if (provenance.kind !== "uncaptured" && provenance.usd !== cost.totalCostUsd) throw new Error(`compareOptimizationMethods: ${label} returned costProvenance inconsistent with totalCostUsd`);
-	if (typeof cost.accountingComplete !== "boolean") throw new Error(`compareOptimizationMethods: ${label} returned invalid accountingComplete`);
-	if (!Array.isArray(cost.incompleteReasons) || cost.incompleteReasons.some((reason) => typeof reason !== "string" || reason.trim().length === 0)) throw new Error(`compareOptimizationMethods: ${label} returned invalid incompleteReasons`);
-	if (cost.accountingComplete !== (cost.incompleteReasons.length === 0)) throw new Error(`compareOptimizationMethods: ${label} returned inconsistent cost completeness and reasons`);
-	if (cost.accountingComplete && provenance.kind === "uncaptured") throw new Error(`compareOptimizationMethods: ${label} cannot mark uncaptured cost as complete`);
-}
-//#endregion
-//#region src/campaign/gepa-candidate-population.ts
-/**
-* Read GEPA's exact candidate graph from the artifact addressed by method provenance.
-*
-* The reader checks the supplied digest, declared byte count, run identity,
-* candidate surfaces, parent graph, selection scores, and configured bounds.
-* This proves that the bytes match the supplied summary. The caller remains
-* responsible for obtaining that summary from trusted method provenance.
-*/
-function readGepaCandidatePopulationArtifact(input) {
-	assertGepaCandidatePopulationSummary(input.summary);
-	const scenarioIds = scenarioIdSet(input.summary.scenarioIds);
-	const storage = input.storage ?? fsCampaignStorage();
-	const contents = storage.read(input.summary.path);
-	if (contents === void 0) {
-		const state = storage.exists(input.summary.path) ? "unreadable" : "missing";
-		throw new Error(`GEPA candidate population artifact is ${state} at '${input.summary.path}'`);
+function readGepaCandidatePopulationArtifact(input) {
+	assertGepaCandidatePopulationSummary(input.summary);
+	const scenarioIds = scenarioIdSet(input.summary.scenarioIds);
+	const storage = input.storage ?? fsCampaignStorage();
+	const contents = storage.read(input.summary.path);
+	if (contents === void 0) {
+		const state = storage.exists(input.summary.path) ? "unreadable" : "missing";
+		throw new Error(`GEPA candidate population artifact is ${state} at '${input.summary.path}'`);
 	}
 	const bytes = new TextEncoder().encode(contents).byteLength;
 	if (bytes !== input.summary.bytes) throw new Error(`GEPA candidate population byte count mismatch at '${input.summary.path}': expected ${input.summary.bytes}, got ${bytes}`);
@@ -5524,6 +4852,213 @@ function assertPositiveSafeInteger(value, label) {
 	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`GEPA candidate population ${label} must be a positive safe integer`);
 }
 //#endregion
+//#region src/campaign/optimization-cost.ts
+/** Attribute method calls while retaining the shared account's admission and read behavior. */
+function createMethodCostScope(account, methodName) {
+	const tags = { optimizationAttempt: crypto.randomUUID() };
+	return {
+		ledger: Object.freeze({
+			costCeilingUsd: account.costCeilingUsd,
+			runPaidCall: (input) => account.runPaidCall({
+				...input,
+				tags: {
+					...input.tags,
+					...tags
+				}
+			}),
+			summary: account.summary.bind(account),
+			list: account.list.bind(account),
+			reconcile: account.reconcile.bind(account),
+			markCompleted: account.markCompleted.bind(account),
+			costPerCompletedTask: account.costPerCompletedTask.bind(account),
+			...account.listPending ? { listPending: account.listPending.bind(account) } : {},
+			...account.waitForIdle ? { waitForIdle: account.waitForIdle.bind(account) } : {}
+		}),
+		reconcile(reported) {
+			const summary = account.summary({ tags });
+			if (summary.pendingCalls > 0) throw new Error(`optimization method '${methodName}' returned with ${summary.pendingCalls} pending paid call(s)`);
+			const recorded = costFromLedgerSummary(summary);
+			const totalCostUsd = Math.max(reported.totalCostUsd, recorded.totalCostUsd);
+			const roundingToleranceUsd = Number.EPSILON * Math.max(1, totalCostUsd) * (summary.totalCalls + 1);
+			const combined = combineComparisonCosts([{
+				label: "reported",
+				cost: reported
+			}, {
+				label: "recorded",
+				cost: recorded
+			}]);
+			const incompleteReasons = [
+				...reported.incompleteReasons,
+				...recorded.incompleteReasons.map((reason) => `recorded: ${reason}`),
+				...recorded.totalCostUsd - reported.totalCostUsd > roundingToleranceUsd ? [`reported ${reported.totalCostUsd} USD below recorded ${recorded.totalCostUsd} USD`] : []
+			];
+			return {
+				totalCostUsd,
+				costProvenance: combined.costProvenance.kind === "uncaptured" ? combined.costProvenance : {
+					kind: combined.costProvenance.kind,
+					usd: totalCostUsd
+				},
+				accountingComplete: incompleteReasons.length === 0,
+				incompleteReasons
+			};
+		}
+	};
+}
+/** Keep the cost fields a custom optimization method must report. */
+function costFromLedgerSummary(summary) {
+	const cost = {
+		totalCostUsd: summary.totalCostUsd,
+		costProvenance: structuredClone(summary.costProvenance),
+		accountingComplete: summary.accountingComplete,
+		incompleteReasons: [...summary.incompleteReasons]
+	};
+	assertComparisonCost(cost, "cost ledger");
+	return cost;
+}
+/** Combine method costs without turning one unknown bill into a known total. */
+function combineComparisonCosts(entries) {
+	const totalCostUsd = entries.reduce((total, entry) => total + entry.cost.totalCostUsd, 0);
+	const cost = {
+		totalCostUsd,
+		costProvenance: entries.some((entry) => entry.cost.costProvenance.kind === "uncaptured") ? {
+			kind: "uncaptured",
+			usd: null
+		} : entries.every((entry) => entry.cost.costProvenance.kind === "observed") ? {
+			kind: "observed",
+			usd: totalCostUsd
+		} : {
+			kind: "estimated",
+			usd: totalCostUsd
+		},
+		accountingComplete: entries.every((entry) => entry.cost.accountingComplete),
+		incompleteReasons: entries.flatMap((entry) => entry.cost.incompleteReasons.map((reason) => `${entry.label}: ${reason}`))
+	};
+	assertComparisonCost(cost, "combined cost");
+	return cost;
+}
+function assertComparisonCost(cost, label) {
+	if (!cost || typeof cost !== "object") throw new Error(`compareOptimizationMethods: ${label} returned no cost`);
+	if (!Number.isFinite(cost.totalCostUsd) || cost.totalCostUsd < 0) throw new Error(`compareOptimizationMethods: ${label} returned an invalid totalCostUsd`);
+	const provenance = cost.costProvenance;
+	if (!provenance || typeof provenance !== "object" || provenance.kind !== "observed" && provenance.kind !== "estimated" && provenance.kind !== "uncaptured" || (provenance.kind === "uncaptured" ? provenance.usd !== null : !Number.isFinite(provenance.usd) || provenance.usd < 0)) throw new Error(`compareOptimizationMethods: ${label} returned invalid costProvenance`);
+	if (provenance.kind !== "uncaptured" && provenance.usd !== cost.totalCostUsd) throw new Error(`compareOptimizationMethods: ${label} returned costProvenance inconsistent with totalCostUsd`);
+	if (typeof cost.accountingComplete !== "boolean") throw new Error(`compareOptimizationMethods: ${label} returned invalid accountingComplete`);
+	if (!Array.isArray(cost.incompleteReasons) || cost.incompleteReasons.some((reason) => typeof reason !== "string" || reason.trim().length === 0)) throw new Error(`compareOptimizationMethods: ${label} returned invalid incompleteReasons`);
+	if (cost.accountingComplete !== (cost.incompleteReasons.length === 0)) throw new Error(`compareOptimizationMethods: ${label} returned inconsistent cost completeness and reasons`);
+	if (cost.accountingComplete && provenance.kind === "uncaptured") throw new Error(`compareOptimizationMethods: ${label} cannot mark uncaptured cost as complete`);
+}
+//#endregion
+//#region src/campaign/optimization-method.ts
+/** Both complete-method workflows use the same detached inputs, accounting, and evidence admission. */
+async function executeOptimizationMethod(options) {
+	assertSearchHistoryAdmissionOptions(options);
+	const { method, input } = options;
+	const costScope = createMethodCostScope(input.costLedger, method.name);
+	const cloneScenarios = (scenarios) => Object.freeze(scenarios.map((scenario) => structuredClone(scenario)));
+	const selected = structuredClone(await method.optimize(Object.freeze({
+		...input,
+		baselineSurface: structuredClone(input.baselineSurface),
+		trainScenarios: cloneScenarios(input.trainScenarios),
+		selectionScenarios: cloneScenarios(input.selectionScenarios),
+		judges: Object.freeze(input.judges.map((judge) => {
+			const dimensions = judge.dimensions.map((dimension) => Object.freeze({ ...dimension }));
+			Object.freeze(dimensions);
+			return Object.freeze({
+				...judge,
+				dimensions
+			});
+		})),
+		runOptions: Object.freeze({ ...input.runOptions }),
+		costLedger: costScope.ledger
+	})));
+	assertOptimizationResult(method.name, selected);
+	const history = searchHistoryCoverageRow(method.name, selected.searchHistory);
+	if (options.searchHistoryPolicy === "require-complete") assertCompleteSearchHistory(method.name, selected.searchHistory);
+	if (options.searchHistoryVerification === "ledger") {
+		if (!selected.searchHistory) assertCompleteSearchHistory(method.name, selected.searchHistory);
+		verifySearchHistoryArtifact(selected.searchHistory, options.storage);
+	}
+	return {
+		selected,
+		cost: costScope.reconcile(selected.cost),
+		history: options.searchHistoryVerification === "ledger" ? Object.freeze({
+			...history,
+			ledgerVerified: true
+		}) : history
+	};
+}
+function assertOptimizationResult(name, result) {
+	if (!result || typeof result !== "object") throw new Error(`compareOptimizationMethods: method '${name}' returned no result`);
+	try {
+		surfaceContentHash(result.winnerSurface);
+	} catch (cause) {
+		throw new Error(`compareOptimizationMethods: method '${name}' returned an invalid winnerSurface`, { cause });
+	}
+	assertComparisonCost(result.cost, `method '${name}'`);
+	if (result.durationMs !== void 0 && (!Number.isFinite(result.durationMs) || result.durationMs < 0)) throw new Error(`compareOptimizationMethods: method '${name}' returned an invalid durationMs`);
+	if (result.provenance !== void 0) assertOptimizationProvenance(name, result.provenance);
+}
+function assertOptimizationProvenance(methodName, value) {
+	const fail = (field) => {
+		throw new Error(`compareOptimizationMethods: method '${methodName}' returned invalid provenance.${field}`);
+	};
+	if (!value || typeof value !== "object") fail("value");
+	if (value.source?.kind !== "package" || !["observed", "declared"].includes(value.source.evidence) || typeof value.source.package !== "string" || !value.source.package.trim() || typeof value.source.version !== "string" || !value.source.version.trim()) fail("source");
+	for (const [field, entry] of [["sourceUrl", value.source.sourceUrl], ["revision", value.source.revision]]) if (entry !== void 0 && (typeof entry !== "string" || !entry.trim())) fail(`source.${field}`);
+	if (typeof value.runId !== "string" || !value.runId.trim()) fail("runId");
+	if (value.optimizerModel !== void 0 && (typeof value.optimizerModel !== "string" || !value.optimizerModel.trim() || value.optimizerModel.trim() !== value.optimizerModel)) fail("optimizerModel");
+	if (value.optimizerCallRef !== void 0 && (typeof value.optimizerCallRef !== "string" || !value.optimizerCallRef.trim() || value.optimizerCallRef.trim() !== value.optimizerCallRef)) fail("optimizerCallRef");
+	if (typeof value.resumed !== "boolean") fail("resumed");
+	if (value.seedApplied !== void 0 && typeof value.seedApplied !== "boolean") fail("seedApplied");
+	if (!Number.isSafeInteger(value.evaluationCount) || value.evaluationCount < 0) fail("evaluationCount");
+	if (typeof value.artifactDir !== "string" || !value.artifactDir.trim()) fail("artifactDir");
+	if (value.tokenUsage !== void 0) {
+		for (const field of [
+			"inputTokens",
+			"outputTokens",
+			"totalTokens",
+			"calls"
+		]) if (!Number.isSafeInteger(value.tokenUsage[field]) || value.tokenUsage[field] < 0) fail(`tokenUsage.${field}`);
+		for (const field of [
+			"cachedInputTokens",
+			"cacheWriteInputTokens",
+			"reasoningTokens"
+		]) {
+			const entry = value.tokenUsage[field];
+			if (entry !== void 0 && (!Number.isSafeInteger(entry) || entry < 0)) fail(`tokenUsage.${field}`);
+		}
+		if ((value.tokenUsage.cachedInputTokens ?? 0) + (value.tokenUsage.cacheWriteInputTokens ?? 0) > value.tokenUsage.inputTokens) fail("tokenUsage.inputTokens");
+		if (value.tokenUsage.reasoningTokens !== void 0 && value.tokenUsage.reasoningTokens > value.tokenUsage.outputTokens) fail("tokenUsage.reasoningTokens");
+		if (value.tokenUsage.totalTokens !== value.tokenUsage.inputTokens + value.tokenUsage.outputTokens) fail("tokenUsage.totalTokens");
+	}
+	if (value.observations !== void 0) {
+		if (value.observations.scope !== "callback-submitted-candidates" || typeof value.observations.path !== "string" || !value.observations.path.trim() || typeof value.observations.sha256 !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.observations.sha256)) fail("observations");
+		for (const field of [
+			"submittedCandidates",
+			"evaluations",
+			"refusals"
+		]) if (!Number.isSafeInteger(value.observations[field]) || value.observations[field] < 0) fail(`observations.${field}`);
+	}
+	if (value.gepaCandidatePopulation !== void 0) {
+		try {
+			assertGepaCandidatePopulationSummary(value.gepaCandidatePopulation);
+		} catch {
+			fail("gepaCandidatePopulation");
+		}
+		if (value.gepaCandidatePopulation.runId !== value.runId) fail("gepaCandidatePopulation.runId");
+	}
+	if (value.modelExecutions !== void 0) {
+		if (value.modelExecutions.scope !== "runtime-model-calls" || typeof value.modelExecutions.path !== "string" || !value.modelExecutions.path.trim() || typeof value.modelExecutions.sha256 !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.modelExecutions.sha256)) fail("modelExecutions");
+		for (const field of [
+			"calls",
+			"succeeded",
+			"failed"
+		]) if (!Number.isSafeInteger(value.modelExecutions[field]) || value.modelExecutions[field] < 0) fail(`modelExecutions.${field}`);
+		if (value.modelExecutions.calls !== value.modelExecutions.succeeded + value.modelExecutions.failed) fail("modelExecutions.calls");
+	}
+	if (value.optimizerModel === void 0 !== (value.optimizerCallRef === void 0) || value.optimizerModel === void 0 !== (value.modelExecutions === void 0)) fail("optimizerModel execution provenance");
+}
+//#endregion
 //#region src/campaign/presets/compare-optimization-methods.ts
 /**
 * Compare optimization methods on shared train, selection, and test data.
@@ -5538,7 +5073,7 @@ async function compareOptimizationMethods(opts) {
 	assertOptimizationMethods(opts.methods);
 	assertComparisonPartitions(opts);
 	const searchHistoryPolicy = opts.searchHistoryPolicy ?? "allow-missing";
-	if (searchHistoryPolicy !== "allow-missing" && searchHistoryPolicy !== "require-complete") throw new TypeError(`compareOptimizationMethods: unknown searchHistoryPolicy '${String(searchHistoryPolicy)}'`);
+	assertSearchHistoryAdmissionOptions(opts);
 	const seed = opts.seed ?? 42;
 	const confidence = opts.confidence ?? .95;
 	assertConfidence(confidence);
@@ -5548,6 +5083,8 @@ async function compareOptimizationMethods(opts) {
 	const minimumResamples = minimumBootstrapResamples(confidence, comparisonCount);
 	const resamples = opts.resamples ?? Math.max(2e3, minimumResamples);
 	assertComparisonControls(opts, seed, resamples, confidence);
+	const evidence = opts.evidence === void 0 ? void 0 : structuredClone(opts.evidence);
+	const evidenceBySurface = /* @__PURE__ */ new Map();
 	const storage = opts.storage ?? fsCampaignStorage();
 	const resolvedRunDir = resolveRunDir(opts.runDir, opts.repo);
 	const baselineSurface = structuredClone(opts.baselineSurface);
@@ -5569,6 +5106,11 @@ async function compareOptimizationMethods(opts) {
 			runDir: `${resolvedRunDir}/${tag}`
 		});
 		assertCompleteCampaign(campaign, opts.testScenarios, opts.reps ?? 1, true, `compareOptimizationMethods: ${tag} final comparison`);
+		if (evidence) evidenceBySurface.set(surfaceContentHash(measuredSurface), createCampaignEvidenceReceipt({
+			campaign,
+			surface: measuredSurface,
+			context: evidence
+		}));
 		const byScenario = {};
 		for (const { scenarioId, composite } of campaignBreakdown(campaign).scenarios) byScenario[scenarioId] = composite;
 		return byScenario;
@@ -5582,16 +5124,18 @@ async function compareOptimizationMethods(opts) {
 	const optimizationOwner = new AbortController();
 	const optimized = await mapConcurrent(opts.methods, optimizationConcurrency, async (method) => {
 		try {
-			const methodCost = createMethodCostScope(costLedger, method.name);
-			const out = await method.optimize(createOptimizationMethodInput(opts, method.name, resolvedRunDir, seed, baselineSurface, methodCost.ledger, optimizationOwner.signal));
-			assertOptimizationResult(method.name, out);
-			const searchHistoryCoverage = searchHistoryCoverageRow(method.name, out.searchHistory);
-			if (searchHistoryPolicy === "require-complete") assertCompleteSearchHistory(method.name, out.searchHistory);
-			const winnerSurface = structuredClone(out.winnerSurface);
+			const { selected: out, cost, history: searchHistoryCoverage } = await executeOptimizationMethod({
+				method,
+				input: createOptimizationMethodInput(opts, method.name, resolvedRunDir, seed, baselineSurface, costLedger, optimizationOwner.signal),
+				storage,
+				searchHistoryPolicy: opts.searchHistoryPolicy,
+				searchHistoryVerification: opts.searchHistoryVerification
+			});
+			const winnerSurface = out.winnerSurface;
 			return {
 				name: method.name,
 				winnerSurface,
-				cost: methodCost.reconcile(out.cost),
+				cost,
 				...out.durationMs === void 0 ? {} : { durationMs: out.durationMs },
 				...out.provenance === void 0 ? {} : { provenance: out.provenance },
 				searchHistoryCoverage
@@ -5647,6 +5191,15 @@ async function compareOptimizationMethods(opts) {
 			winnerSurface: structuredClone(w.winnerSurface),
 			rank: 0
 		};
+		if (evidence) {
+			const baseline = evidenceBySurface.get(surfaceContentHash(baselineSurface));
+			const winner = evidenceBySurface.get(surfaceContentHash(w.winnerSurface));
+			if (!baseline || !winner) throw new Error("final measurement evidence is missing");
+			score.evidence = {
+				baseline,
+				winner
+			};
+		}
 		if (w.durationMs !== void 0) score.durationMs = w.durationMs;
 		if (w.provenance !== void 0) score.provenance = structuredClone(w.provenance);
 		return score;
@@ -5739,77 +5292,6 @@ function assertOptimizationMethods(methods) {
 		pathOwners.set(pathKey, method.name);
 	}
 }
-function assertOptimizationResult(name, result) {
-	if (!result || typeof result !== "object") throw new Error(`compareOptimizationMethods: method '${name}' returned no result`);
-	try {
-		surfaceContentHash(result.winnerSurface);
-	} catch (cause) {
-		throw new Error(`compareOptimizationMethods: method '${name}' returned an invalid winnerSurface`, { cause });
-	}
-	assertComparisonCost(result.cost, `method '${name}'`);
-	if (result.durationMs !== void 0 && (!Number.isFinite(result.durationMs) || result.durationMs < 0)) throw new Error(`compareOptimizationMethods: method '${name}' returned an invalid durationMs`);
-	if (result.provenance !== void 0) assertOptimizationProvenance(name, result.provenance);
-}
-function assertOptimizationProvenance(methodName, value) {
-	const fail = (field) => {
-		throw new Error(`compareOptimizationMethods: method '${methodName}' returned invalid provenance.${field}`);
-	};
-	if (!value || typeof value !== "object") fail("value");
-	if (value.source?.kind !== "package" || !["observed", "declared"].includes(value.source.evidence) || typeof value.source.package !== "string" || !value.source.package.trim() || typeof value.source.version !== "string" || !value.source.version.trim()) fail("source");
-	for (const [field, entry] of [["sourceUrl", value.source.sourceUrl], ["revision", value.source.revision]]) if (entry !== void 0 && (typeof entry !== "string" || !entry.trim())) fail(`source.${field}`);
-	if (typeof value.runId !== "string" || !value.runId.trim()) fail("runId");
-	if (value.optimizerModel !== void 0 && (typeof value.optimizerModel !== "string" || !value.optimizerModel.trim() || value.optimizerModel.trim() !== value.optimizerModel)) fail("optimizerModel");
-	if (value.optimizerCallRef !== void 0 && (typeof value.optimizerCallRef !== "string" || !value.optimizerCallRef.trim() || value.optimizerCallRef.trim() !== value.optimizerCallRef)) fail("optimizerCallRef");
-	if (typeof value.resumed !== "boolean") fail("resumed");
-	if (value.seedApplied !== void 0 && typeof value.seedApplied !== "boolean") fail("seedApplied");
-	if (!Number.isSafeInteger(value.evaluationCount) || value.evaluationCount < 0) fail("evaluationCount");
-	if (typeof value.artifactDir !== "string" || !value.artifactDir.trim()) fail("artifactDir");
-	if (value.tokenUsage !== void 0) {
-		for (const field of [
-			"inputTokens",
-			"outputTokens",
-			"totalTokens",
-			"calls"
-		]) if (!Number.isSafeInteger(value.tokenUsage[field]) || value.tokenUsage[field] < 0) fail(`tokenUsage.${field}`);
-		for (const field of [
-			"cachedInputTokens",
-			"cacheWriteInputTokens",
-			"reasoningTokens"
-		]) {
-			const entry = value.tokenUsage[field];
-			if (entry !== void 0 && (!Number.isSafeInteger(entry) || entry < 0)) fail(`tokenUsage.${field}`);
-		}
-		if ((value.tokenUsage.cachedInputTokens ?? 0) + (value.tokenUsage.cacheWriteInputTokens ?? 0) > value.tokenUsage.inputTokens) fail("tokenUsage.inputTokens");
-		if (value.tokenUsage.reasoningTokens !== void 0 && value.tokenUsage.reasoningTokens > value.tokenUsage.outputTokens) fail("tokenUsage.reasoningTokens");
-		if (value.tokenUsage.totalTokens !== value.tokenUsage.inputTokens + value.tokenUsage.outputTokens) fail("tokenUsage.totalTokens");
-	}
-	if (value.observations !== void 0) {
-		if (value.observations.scope !== "callback-submitted-candidates" || typeof value.observations.path !== "string" || !value.observations.path.trim() || typeof value.observations.sha256 !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.observations.sha256)) fail("observations");
-		for (const field of [
-			"submittedCandidates",
-			"evaluations",
-			"refusals"
-		]) if (!Number.isSafeInteger(value.observations[field]) || value.observations[field] < 0) fail(`observations.${field}`);
-	}
-	if (value.gepaCandidatePopulation !== void 0) {
-		try {
-			assertGepaCandidatePopulationSummary(value.gepaCandidatePopulation);
-		} catch {
-			fail("gepaCandidatePopulation");
-		}
-		if (value.gepaCandidatePopulation.runId !== value.runId) fail("gepaCandidatePopulation.runId");
-	}
-	if (value.modelExecutions !== void 0) {
-		if (value.modelExecutions.scope !== "runtime-model-calls" || typeof value.modelExecutions.path !== "string" || !value.modelExecutions.path.trim() || typeof value.modelExecutions.sha256 !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.modelExecutions.sha256)) fail("modelExecutions");
-		for (const field of [
-			"calls",
-			"succeeded",
-			"failed"
-		]) if (!Number.isSafeInteger(value.modelExecutions[field]) || value.modelExecutions[field] < 0) fail(`modelExecutions.${field}`);
-		if (value.modelExecutions.calls !== value.modelExecutions.succeeded + value.modelExecutions.failed) fail("modelExecutions.calls");
-	}
-	if (value.optimizerModel === void 0 !== (value.optimizerCallRef === void 0) || value.optimizerModel === void 0 !== (value.modelExecutions === void 0)) fail("optimizerModel execution provenance");
-}
 function assertComparisonControls(opts, seed, resamples, confidence) {
 	if (opts.optimizationRunOptions && "costCeiling" in opts.optimizationRunOptions) throw new Error("compareOptimizationMethods: optimizationRunOptions.costCeiling is not supported; costCeiling covers optimization and final scoring");
 	if (!opts.judges || opts.judges.length === 0) throw new Error("compareOptimizationMethods: at least one judge is required");
@@ -5899,18 +5381,13 @@ function minimumBootstrapResamples(confidence, comparisonCount) {
 }
 function createOptimizationMethodInput(opts, methodName, resolvedRunDir, seed, baselineSurface, costLedger, optimizationSignal) {
 	const methodRunDir = `${resolvedRunDir}/optimization/${slug(methodName)}`;
-	const cloneScenarios = (scenarios) => Object.freeze(scenarios.map((scenario) => structuredClone(scenario)));
-	const judges = opts.judges.map((judge) => Object.freeze({
-		...judge,
-		dimensions: Object.freeze(judge.dimensions.map((dimension) => Object.freeze({ ...dimension })))
-	}));
 	const signal = combineAbortSignals(opts.signal, opts.optimizationRunOptions?.signal, optimizationSignal);
 	return Object.freeze({
 		baselineSurface: structuredClone(baselineSurface),
-		trainScenarios: cloneScenarios(opts.trainScenarios),
-		selectionScenarios: cloneScenarios(opts.selectionScenarios),
+		trainScenarios: opts.trainScenarios,
+		selectionScenarios: opts.selectionScenarios,
 		dispatchWithSurface: opts.dispatchWithSurface,
-		judges: Object.freeze(judges),
+		judges: opts.judges,
 		runDir: methodRunDir,
 		seed,
 		runOptions: Object.freeze({
@@ -6440,6 +5917,6 @@ function firstString(value) {
 	return typeof value === "string" && value.trim() ? value : void 0;
 }
 //#endregion
-export { runCanaries as $, recordCandidatePopulationSearch as A, buildReflectionPrompt as B, provenanceSpansPath as C, computeManifestHash as Ct, isProposedCandidate as D, runOptimization as E, searchHistoryCoverageRow as F, paretoFrontierWithCrowding as G, recoverTruncatedJson as H, verifySearchHistoryReceipt as I, defaultProductionGate as J, runFinalComparison as K, campaignBreakdown as L, assertCompleteSearchHistory as M, assertSearchHistoryMatchesReplay as N, labelTrustRank as O, createSearchHistoryReceipt as P, scoreRedTeamOutput as Q, campaignMeanComposite as R, provenanceRecordPath as S, cellCachePath as St, runImprovementLoop as T, dominates as U, parseReflectionResponse as V, paretoFrontier as W, redTeamDataset as X, DEFAULT_RED_TEAM_CORPUS as Y, redTeamReport as Z, campaignMeasurementDigest as _, campaignScenarioIdentity as _t, transientDispatchFailure as a, surfaceDispatchRef as at, loopProvenanceArgsFromResult as b, readCachedCell as bt, assertOptimizationResult as c, runCampaign as ct, assertGepaCandidatePopulationSummary as d, tangleTracesRoot as dt, assertCodeSurfaceIdentity as et, readGepaCandidatePopulationArtifact as f, BackendIntegrityError as ft, buildLoopProvenanceRecord as g, assertCampaignSplitIdentity as gt, createMethodCostScope as h, assertCampaignDesign as ht, quotaExhaustedUntil as i, surfaceContentHash as it, SearchHistoryRequiredError as j, SearchRecorder as k, compareOptimizationMethods as l, planCampaignRun as lt, costFromLedgerSummary as m, summarizeBackendIntegrity as mt, JudgeParseError as n, componentSurfaceIdentityMaterial as nt, aggregateRunScore as o, surfaceHash as ot, combineComparisonCosts as p, assertRealBackend as pt, openAutoPr as q, isTransientTransportFailure as r, renderSurfaceDiff as rt, clamp01 as s, runEval as st, llmJudge as t, codeSurfaceIdentityMaterial as tt, optimizationTokenUsageFromSummary as u, resolveRunDir as ut, canonicalDigest as v, campaignSplitDigest as vt, verifyLoopProvenanceRecord as w, loopProvenanceSpans as x, buildCellSchedule as xt, emitLoopProvenance as y, campaignSplitDigestFromIdentities as yt, compareRankKeys as z };
+export { openSearchLedger as A, redTeamDataset as B, assertSearchHistoryAdmissionOptions as C, verifySearchHistoryArtifact as D, searchHistoryCoverageRow as E, paretoFrontierWithCrowding as F, runCampaign as G, scoreRedTeamOutput as H, runFinalComparison as I, tangleTracesRoot as J, planCampaignRun as K, openAutoPr as L, validateSearchLedgerEvent as M, dominates as N, verifySearchHistoryReceipt as O, paretoFrontier as P, computeManifestHash as Q, defaultProductionGate as R, assertCompleteSearchHistory as S, createSearchHistoryReceipt as T, runCanaries as U, redTeamReport as V, runEval as W, buildCellSchedule as X, readCachedCell as Y, cellCachePath as Z, isProposedCandidate as _, transientDispatchFailure as a, recordCandidatePopulationSearch as b, compareOptimizationMethods as c, combineComparisonCosts as d, costFromLedgerSummary as f, runOptimization as g, runImprovementLoop as h, quotaExhaustedUntil as i, replaySearchLedgerText as j, FileSearchLedger as k, optimizationTokenUsageFromSummary as l, readGepaCandidatePopulationArtifact as m, JudgeParseError as n, aggregateRunScore as o, assertGepaCandidatePopulationSummary as p, resolveRunDir as q, isTransientTransportFailure as r, clamp01 as s, llmJudge as t, executeOptimizationMethod as u, labelTrustRank as v, assertSearchHistoryMatchesReplay as w, SearchHistoryRequiredError as x, SearchRecorder as y, DEFAULT_RED_TEAM_CORPUS as z };
 
-//# sourceMappingURL=llm-judge-DmNaBrXB.js.map
+//# sourceMappingURL=llm-judge-DliimmRb.js.map