@tangle-network/agent-eval 0.175.0 → 0.176.0

package/dist/campaign-evidence-D8DBLqLI.js

@@ -0,0 +1,2083 @@
+import { t as AgentEvalError } from "./errors-Dngq5h35.js";
+import { a as hashCanonical, i as compareCodeUnits, r as canonicalString } from "./canonical-DPyQ_rpt.js";
+import { g as pairedRiskDifferenceScore, h as pairedRiskDifferenceExact, p as pairedBinaryScale } from "./paired-arms-D4aeIHUy.js";
+import { a as pairedSignTest, i as pairedDeltaTieFraction, r as pairedBootstrap } from "./paired-tests-C8iCsioC.js";
+import { n as contentHash } from "./verdict-cache-B3eCVQtY.js";
+import { n as campaignCellExecutionEvidence, o as projectCampaignCellQuality } from "./run-record-CR63CpHK.js";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+//#region src/campaign/coverage.ts
+/** Reject campaign designs whose denominator cannot be identified exactly. */
+function assertCampaignDesign(scenarios, reps) {
+	if (!Number.isSafeInteger(reps) || reps < 1) throw new Error("campaign design requires reps to be a positive safe integer");
+	const scenarioIds = /* @__PURE__ */ new Set();
+	for (const scenario of scenarios) {
+		if (typeof scenario.id !== "string" || scenario.id.trim().length === 0) throw new Error("campaign design requires every scenario to have a non-empty id");
+		if (scenarioIds.has(scenario.id)) throw new Error(`campaign design contains duplicate scenario id '${scenario.id}'`);
+		if (typeof scenario.kind !== "string" || scenario.kind.trim().length === 0) throw new Error("campaign design requires every scenario to have a non-empty kind");
+		if (scenario.seedGroup !== void 0 && (typeof scenario.seedGroup !== "string" || scenario.seedGroup.trim().length === 0)) throw new Error("campaign design requires seedGroup to be a non-empty string when set");
+		scenarioIds.add(scenario.id);
+	}
+}
+/** Redacted but independently verifiable identity of one complete scenario. */
+function campaignScenarioIdentity(scenario) {
+	assertCampaignDesign([scenario], 1);
+	return {
+		id: scenario.id,
+		kind: scenario.kind,
+		scenarioDigest: `sha256:${contentHash(scenario)}`
+	};
+}
+/** Canonical split identity reconstructed from redacted scenario identities. */
+function campaignSplitDigestFromIdentities(scenarios, reps) {
+	assertCampaignDesign(scenarios, reps);
+	for (const scenario of scenarios) if (!/^sha256:[a-f0-9]{64}$/.test(scenario.scenarioDigest)) throw new Error(`campaign scenario '${scenario.id}' has an invalid digest`);
+	return `sha256:${contentHash({
+		schema: "tangle.campaign-split",
+		scenarios: scenarios.map(({ id, kind, scenarioDigest }) => ({
+			id,
+			kind,
+			scenarioDigest
+		})),
+		reps
+	})}`;
+}
+/** Canonical identity of the exact scenario payloads and replicate count. */
+function campaignSplitDigest(scenarios, reps) {
+	assertCampaignDesign(scenarios, reps);
+	return campaignSplitDigestFromIdentities(scenarios.map(campaignScenarioIdentity), reps);
+}
+/** Refuse a campaign whose retained task identities contradict its split digest. */
+function assertCampaignSplitIdentity(scenarios, reps, splitDigest) {
+	if (campaignSplitDigestFromIdentities(scenarios, reps) !== splitDigest) throw new Error("campaign split digest does not match its retained scenario identities");
+}
+/** Exact designed-denominator receipt for one campaign. */
+function campaignCoverage(cells, scenarios, reps, requireJudgeScore) {
+	assertCampaignDesign(scenarios, reps);
+	const expectedCellIds = designedCellIds(scenarios, reps);
+	const cellsById = /* @__PURE__ */ new Map();
+	for (const cell of cells) {
+		const matches = cellsById.get(cell.cellId) ?? [];
+		matches.push(cell);
+		cellsById.set(cell.cellId, matches);
+	}
+	const scorableCellIds = [];
+	const unscorableCells = [];
+	for (const cellId of expectedCellIds) {
+		const matches = cellsById.get(cellId) ?? [];
+		if (matches.length === 0) {
+			unscorableCells.push({
+				cellId,
+				reason: "missing campaign cell"
+			});
+			continue;
+		}
+		if (matches.length > 1) {
+			unscorableCells.push({
+				cellId,
+				reason: `duplicate campaign cell (${matches.length})`
+			});
+			continue;
+		}
+		const cell = matches[0];
+		const scoreEntries = Object.entries(cell.judgeScores);
+		const successfulScores = scoreEntries.map(([, score]) => score).filter((score) => score.failed !== true && Number.isFinite(score.composite));
+		const nonFiniteScores = scoreEntries.filter(([, score]) => score.failed !== true && (!Number.isFinite(score.composite) || Object.values(score.dimensions).some((value) => !Number.isFinite(value))));
+		const reasons = [];
+		if (cell.error) reasons.push(cell.error);
+		if (cell.artifact === null || cell.artifact === void 0) reasons.push("missing artifact");
+		if (!cell.error && requireJudgeScore && successfulScores.length === 0) reasons.push("no successful finite judge score");
+		if (scoreEntries.some(([, score]) => score.failed === true)) reasons.push("judge score marked failed");
+		const failedPanelJudges = [...new Set(scoreEntries.flatMap(([, score]) => score.failedJudges ?? []))].sort();
+		if (failedPanelJudges.length > 0) reasons.push(`judge panel incomplete: ${failedPanelJudges.join(", ")}`);
+		if (nonFiniteScores.length > 0) reasons.push(`non-finite judge score: ${nonFiniteScores.map(([name]) => name).sort().join(", ")}`);
+		if (reasons.length > 0) unscorableCells.push({
+			cellId,
+			reason: reasons.join("; ")
+		});
+		else scorableCellIds.push(cellId);
+	}
+	const expected = new Set(expectedCellIds);
+	for (const cell of cells) {
+		if (cell.cellId !== `${cell.scenarioId}:${cell.rep}`) {
+			unscorableCells.push({
+				cellId: cell.cellId,
+				reason: "campaign cell id does not match scenario id and rep"
+			});
+			continue;
+		}
+		if (!expected.has(cell.cellId)) unscorableCells.push({
+			cellId: cell.cellId,
+			reason: "unexpected campaign cell"
+		});
+	}
+	return {
+		complete: unscorableCells.length === 0 && scorableCellIds.length === expectedCellIds.length,
+		expectedCellIds,
+		scorableCellIds,
+		unscorableCells
+	};
+}
+function formatCoverageFailures(coverage) {
+	const shown = coverage.unscorableCells.slice(0, 3).map((cell) => `${cell.cellId}: ${cell.reason}`).join("; ");
+	const remainder = coverage.unscorableCells.length - Math.min(3, coverage.unscorableCells.length);
+	return remainder > 0 ? `${shown}; +${remainder} more` : shown || "unknown coverage failure";
+}
+function designedCellIds(scenarios, reps) {
+	const ids = [];
+	for (const scenario of scenarios) for (let rep = 0; rep < reps; rep++) ids.push(`${scenario.id}:${rep}`);
+	return ids;
+}
+/** Require the complete designed denominator before a final comparison. */
+function assertCompleteCampaign(campaign, scenarios, reps, requireJudgeScore, label) {
+	const coverage = campaignCoverage(campaign.cells, scenarios, reps, requireJudgeScore);
+	if (!coverage.complete) throw new Error(`${label} is incomplete (${coverage.scorableCellIds.length}/${coverage.expectedCellIds.length} designed cells scorable) — ${formatCoverageFailures(coverage)}. Refusing to compare unequal results.`);
+}
+//#endregion
+//#region src/integrity/backend-integrity.ts
+/**
+* Error thrown when an integrity assertion fails. Caller can pattern-match
+* by `code === 'AGENT_EVAL_BACKEND_STUB'` to differentiate from other
+* errors.
+*/
+var BackendIntegrityError = class extends AgentEvalError {
+	report;
+	constructor(message, report) {
+		super("backend_integrity", message);
+		this.report = report;
+	}
+};
+/**
+* Inspect a batch of RunRecords and return an integrity report. Pure
+* function — no I/O, no logging. The caller decides what to do with the
+* verdict (print warning, throw, gate CI, etc.).
+*/
+function summarizeBackendIntegrity(records) {
+	return summarizeBackendUsage(records.map((record) => ({
+		inputTokens: record.tokenUsage.input,
+		outputTokens: record.tokenUsage.output,
+		costUsd: record.costUsd
+	})));
+}
+/** Inspect settled agent calls from the canonical cost ledger. */
+function summarizeAgentReceiptIntegrity(receipts) {
+	return summarizeBackendUsage(receipts.filter((receipt) => receipt.channel === "agent").map((receipt) => ({
+		inputTokens: receipt.inputTokens,
+		outputTokens: receipt.outputTokens,
+		costUsd: receipt.costUsd
+	})));
+}
+function summarizeBackendUsage(records) {
+	const totalRecords = records.length;
+	let stubRecords = 0;
+	let realRecords = 0;
+	let uncostedRecords = 0;
+	let totalInputTokens = 0;
+	let totalOutputTokens = 0;
+	let totalCostUsd = 0;
+	for (const rec of records) {
+		totalInputTokens += rec.inputTokens;
+		totalOutputTokens += rec.outputTokens;
+		totalCostUsd += rec.costUsd ?? 0;
+		if (rec.inputTokens === 0 && rec.outputTokens === 0) stubRecords++;
+		else realRecords++;
+		if (rec.outputTokens > 0 && (rec.costUsd === null || rec.costUsd === 0)) uncostedRecords++;
+	}
+	const verdict = totalRecords === 0 ? "stub" : stubRecords === totalRecords ? "stub" : stubRecords === 0 ? "real" : "mixed";
+	const diagnosis = buildDiagnosis({
+		totalRecords,
+		stubRecords,
+		realRecords,
+		uncostedRecords,
+		totalInputTokens,
+		totalOutputTokens,
+		totalCostUsd,
+		verdict
+	});
+	return {
+		totalRecords,
+		stubRecords,
+		realRecords,
+		uncostedRecords,
+		totalInputTokens,
+		totalOutputTokens,
+		totalCostUsd,
+		verdict,
+		diagnosis
+	};
+}
+function buildDiagnosis(r) {
+	if (r.totalRecords === 0) return "no records — eval produced zero runs; backend likely failed before first turn";
+	if (r.verdict === "stub") return [
+		`all ${r.totalRecords} records have zero token usage — the LLM backend was never called.`,
+		"common causes: --backend sandbox without a sandbox bridge running; stub model returning hard-coded strings;",
+		"auth misconfigured so requests were silently dropped before the LLM. Re-run with --backend tcloud and TANGLE_API_KEY set,",
+		"or boot the cli-bridge / sandbox before invoking the eval."
+	].join(" ");
+	if (r.verdict === "mixed") {
+		const pct = (r.stubRecords / r.totalRecords * 100).toFixed(0);
+		return [
+			`${r.stubRecords}/${r.totalRecords} records (${pct}%) have zero token usage — the backend partially failed.`,
+			"common causes: rate-limit cascade (429s after the first N personas);",
+			"transient auth expiry mid-run; provider outage. Treat the affected records as missing data, not agent failures."
+		].join(" ");
+	}
+	if (r.uncostedRecords > 0) {
+		const pct = (r.uncostedRecords / r.totalRecords * 100).toFixed(0);
+		return [
+			`${r.totalRecords} records with real LLM activity (in=${r.totalInputTokens}, out=${r.totalOutputTokens} tokens).`,
+			`${r.uncostedRecords} (${pct}%) have output tokens but costUsd=0. Two distinct roots:`,
+			"(a) cost ledger mis-wired — no usage propagation from the runtime stream into RunRecord; or",
+			"(b) the model is unpriced at the source (sandbox/router returned $0 despite real tokens).",
+			"For (b), price the measured tokens against the substrate table (estimateCost) instead of leaving $0."
+		].join(" ");
+	}
+	return `${r.totalRecords} records with real LLM activity (in=${r.totalInputTokens}, out=${r.totalOutputTokens} tokens, $${r.totalCostUsd.toFixed(4)}).`;
+}
+/**
+* Throw BackendIntegrityError if the verdict is 'stub' — i.e. every record
+* shows zero LLM activity. Non-strict callers can pass `{ allowMixed: false }`
+* to also reject mixed verdicts (recommended for CI gates).
+*
+* Real backends pass through silently.
+*/
+function assertRealBackend(records, opts = {}) {
+	return assertBackendReport(summarizeBackendIntegrity(records), opts);
+}
+function assertBackendReport(report, opts) {
+	const allowMixed = opts.allowMixed ?? true;
+	if (report.verdict === "stub") throw new BackendIntegrityError(`backend-integrity: ran against a stub or unconfigured backend — ${report.diagnosis}`, report);
+	if (!allowMixed && report.verdict === "mixed") throw new BackendIntegrityError(`backend-integrity: partial backend failure rejected — ${report.diagnosis}`, report);
+	return report;
+}
+//#endregion
+//#region src/campaign/surface-identity.ts
+const GIT_OBJECT_ID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+/** Validate the immutable identity shape; the owning executor verifies the Git objects and patch. */
+function assertCodeSurfaceIdentity(surface) {
+	if (!surface || typeof surface !== "object") throw new TypeError("CodeSurface must be an object");
+	const candidate = surface;
+	if (candidate.kind !== "code") throw new TypeError("CodeSurface.kind must be \"code\"");
+	if (typeof candidate.worktreeRef !== "string" || candidate.worktreeRef.trim().length === 0) throw new TypeError("CodeSurface.worktreeRef must be a non-empty locator");
+	if (typeof candidate.baseRef !== "string" || candidate.baseRef.trim().length === 0) throw new TypeError("CodeSurface.baseRef must be a non-empty ref label");
+	for (const [field, value] of [
+		["baseCommit", candidate.baseCommit],
+		["baseTree", candidate.baseTree],
+		["candidateCommit", candidate.candidateCommit],
+		["candidateTree", candidate.candidateTree]
+	]) if (typeof value !== "string" || !GIT_OBJECT_ID.test(value)) throw new TypeError(`CodeSurface.${field} must be a full Git object id`);
+	const patch = candidate.patch;
+	if (!patch || typeof patch !== "object" || patch.format !== "git-diff-binary") throw new TypeError("CodeSurface.patch.format must be \"git-diff-binary\"");
+	if (typeof patch.sha256 !== "string" || !SHA256.test(patch.sha256)) throw new TypeError("CodeSurface.patch.sha256 must be a sha256 digest");
+	if (!Number.isSafeInteger(patch.byteLength) || patch.byteLength < 0) throw new TypeError("CodeSurface.patch.byteLength must be a non-negative safe integer");
+}
+/** Assert that a value is a valid non-empty component surface. */
+function assertComponentSurface(surface) {
+	if (!surface || typeof surface !== "object") throw new TypeError("ComponentSurface must be an object");
+	const candidate = surface;
+	if (candidate.kind !== "components") throw new TypeError("ComponentSurface.kind must be \"components\"");
+	if (!candidate.components || typeof candidate.components !== "object" || Array.isArray(candidate.components)) throw new TypeError("ComponentSurface.components must be an object");
+	const entries = Object.entries(candidate.components);
+	if (entries.length === 0) throw new TypeError("ComponentSurface.components must not be empty");
+	for (const [name, content] of entries) {
+		if (!name.trim() || name.trim() !== name) throw new TypeError("ComponentSurface component names must be trimmed and non-empty");
+		if (typeof content !== "string") throw new TypeError(`ComponentSurface component '${name}' must be a string`);
+	}
+}
+/**
+* Deterministic identity material for a component surface.
+*
+* `canonicalString` orders keys by UTF-16 code unit (RFC 8785), which is a
+* property of the value alone. The previous material ordered them with
+* `localeCompare`, which reads the host's collation — so the same surface
+* could produce two different identities on two machines, and the stored
+* identity would stop matching a recomputation of the identical surface.
+*/
+function componentSurfaceIdentityMaterial(surface) {
+	assertComponentSurface(surface);
+	return canonicalString({
+		schema: "tangle.component-surface",
+		components: surface.components
+	});
+}
+/**
+* The retired material builder, kept PRIVATE and reachable only from
+* {@link surfaceHashMatches}.
+*
+* A surface identity recorded before this release was minted from these bytes.
+* The verify path tries the current material first and falls back to this one,
+* so a stored identity still matches its own surface; nothing mints from it.
+*
+* Every component surface's identity moves, not only one whose names sort
+* differently under the host's collation: RFC 8785 also orders the two
+* top-level keys, so `components` precedes `schema` where this builder emitted
+* them in literal order. The retention window therefore covers every stored
+* component-surface identity, which is why this builder is kept rather than
+* scoped to the mixed-case case.
+*/
+function retiredComponentSurfaceIdentityMaterial(surface) {
+	assertComponentSurface(surface);
+	return JSON.stringify({
+		schema: "tangle.component-surface",
+		components: Object.fromEntries(Object.entries(surface.components).sort(([left], [right]) => left.localeCompare(right)))
+	});
+}
+/** Canonical, location-independent identity of a finalized code candidate.
+*  Commit metadata is excluded: two commits with the same base, final tree,
+*  and patch bytes are the same executable candidate. */
+function codeSurfaceIdentityMaterial(surface) {
+	assertCodeSurfaceIdentity(surface);
+	return JSON.stringify({
+		schema: "tangle.code-surface",
+		baseCommit: surface.baseCommit,
+		baseTree: surface.baseTree,
+		candidateTree: surface.candidateTree,
+		patch: {
+			format: surface.patch.format,
+			sha256: surface.patch.sha256,
+			byteLength: surface.patch.byteLength
+		}
+	});
+}
+/** Full SHA-256 content identity for a prompt or finalized code surface. */
+function surfaceContentHash(surface) {
+	const material = typeof surface === "string" ? surface : surface.kind === "components" ? componentSurfaceIdentityMaterial(surface) : codeSurfaceIdentityMaterial(surface);
+	return `sha256:${createHash("sha256").update(material).digest("hex")}`;
+}
+/** Short loop key derived from the same content identity as provenance. */
+function surfaceHash(surface) {
+	return surfaceContentHash(surface).slice(7, 23);
+}
+/**
+* Whether `storedHash` is the loop key of `surface`, under the current identity
+* material or the retired one.
+*
+* A stored key is 16 hex characters with no room for a scheme tag, so the
+* scheme cannot be read off the value the way an `agent-profile-cell` id names
+* its own. The verify path therefore tries both, which gives the same property:
+* a key minted by an earlier release still matches its own surface, and a
+* surface that was actually edited matches neither.
+*
+* Only a component surface can differ between the two; a prompt or code surface
+* produces identical material under both, so the second comparison is a no-op
+* for them.
+*/
+function surfaceHashMatches(surface, storedHash) {
+	if (surfaceHash(surface) === storedHash) return true;
+	if (typeof surface === "string" || surface.kind !== "components") return false;
+	return createHash("sha256").update(retiredComponentSurfaceIdentityMaterial(surface)).digest("hex").slice(0, 16) === storedHash;
+}
+/** Canonical customer-visible description of the exact before/after surfaces. */
+function renderSurfaceDiff(winnerSurface, baselineSurface) {
+	if (typeof winnerSurface === "string" && typeof baselineSurface === "string") return [
+		"--- baseline",
+		"+++ winner",
+		...baselineSurface.split("\n").map((line) => `- ${line}`),
+		...winnerSurface.split("\n").map((line) => `+ ${line}`)
+	].join("\n");
+	const describe = (surface) => {
+		if (typeof surface === "string") return "(prompt surface)";
+		if (surface.kind === "components") {
+			assertComponentSurface(surface);
+			return Object.entries(surface.components).sort(([left], [right]) => left.localeCompare(right)).map(([name, content]) => `[${name}]\n${content}`).join("\n\n");
+		}
+		assertCodeSurfaceIdentity(surface);
+		return [
+			`baseCommit=${surface.baseCommit}`,
+			`baseTree=${surface.baseTree}`,
+			`candidateCommit=${surface.candidateCommit}`,
+			`candidateTree=${surface.candidateTree}`,
+			`patch=${surface.patch.sha256}`,
+			`patchBytes=${surface.patch.byteLength}`,
+			...surface.summary ? [surface.summary] : []
+		].join("\n");
+	};
+	return `--- baseline\n${describe(baselineSurface)}\n+++ winner\n${describe(winnerSurface)}`;
+}
+/** Bind a campaign cache entry to the exact surface and caller-owned execution revision. */
+function surfaceDispatchRef(surface, executionRef = "anonymous") {
+	if (!executionRef.trim() || executionRef.trim() !== executionRef) throw new Error("surfaceDispatchRef: executionRef must be trimmed and non-empty");
+	return `surface:${executionRef}:${surfaceContentHash(surface)}`;
+}
+//#endregion
+//#region src/paired-delta-test.ts
+/** Smallest all-positive sample that can clear a one-sided exact sign test. */
+function minimumPairsForPairedDeltaTest(confidence = .95) {
+	if (!Number.isFinite(confidence) || confidence <= 0 || confidence >= 1) throw new Error(`minimumPairsForPairedDeltaTest: confidence must be in (0,1), got ${confidence}`);
+	const oneSidedAlpha = (1 - confidence) / 2;
+	return Math.ceil(Math.log2(1 / oneSidedAlpha));
+}
+/**
+* Tests whether a paired candidate-minus-baseline delta clears a threshold.
+*
+* At 20 or more pairs, the percentile bootstrap lower bound carries the
+* decision. Below that point the interval is descriptive only, so the function
+* switches to a pre-registered one-sided exact sign test. The exact path is
+* deliberately conservative: it requires both a point estimate above the
+* threshold and enough consistently positive paired differences.
+*
+* ## A zero-width interval is never significant
+*
+* When every paired delta is identical the resample distribution is a point
+* mass and the interval collapses: `[0, 0]` when all pairs tie, `[g, g]` on n
+* identical deltas of g. Neither says the effect is certain — both say the
+* sample carries no information about how far the estimate could be wrong, and
+* `low > threshold` then answers on the point estimate alone. It fails in both
+* directions: `[0, 0]` clears every NEGATIVE threshold, which is how a
+* tie-dominated pass/fail comparison laundered a regression into a
+* noninferiority pass, and `[g, g]` clears every threshold below g with no
+* spread behind it. Under a bounded asymmetric null whose true mean paired
+* delta is exactly 0 — 2 % of pairs dropping by 1.0, the rest gaining 0.0204 —
+* every sample that misses the drop is exactly that shape, and deciding on
+* `low > 0` promoted 65.65 % of samples at n = 20 against a nominal 5 %.
+*
+* So `indeterminate` is reported and `significant` is false whenever the
+* interval has zero width, on BOTH paths: at small n the exact sign test is a
+* test of the MEDIAN and a zero-spread sample is precisely where it stops
+* saying anything about the mean the caller is thresholding.
+*
+* `threshold` may be negative — that is a noninferiority margin, and it is the
+* regime the zero-width hole is worst in. For a two-point (pass/fail) outcome
+* the percentile bootstrap is not a valid interval at a nonzero margin at all;
+* use {@link decidePairedPromotion}, which routes those to Tango's score
+* interval, rather than thresholding this function's bootstrap directly.
+*/
+function pairedDeltaTest(before, after, options = {}) {
+	const threshold = options.threshold ?? 0;
+	if (!Number.isFinite(threshold)) throw new Error(`pairedDeltaTest: threshold must be finite, got ${threshold}`);
+	const exactMinimum = minimumPairsForPairedDeltaTest(options.confidence ?? .95);
+	const requestedMinimum = options.minPairs ?? exactMinimum;
+	if (!Number.isInteger(requestedMinimum) || requestedMinimum < 1) throw new Error(`pairedDeltaTest: minPairs must be a positive integer, got ${requestedMinimum}`);
+	const minimumPairs = Math.max(requestedMinimum, exactMinimum);
+	const bootstrap = pairedBootstrap(before, after, options);
+	const sufficient = bootstrap.n >= minimumPairs;
+	const indeterminate = bootstrap.n > 0 && (!Number.isFinite(bootstrap.low) || !Number.isFinite(bootstrap.high) || bootstrap.low === bootstrap.high);
+	if (bootstrap.gateEligible) return {
+		bootstrap,
+		method: "bootstrap-ci",
+		pValue: null,
+		minimumPairs,
+		sufficient,
+		indeterminate,
+		significant: sufficient && !indeterminate && bootstrap.low > threshold
+	};
+	const exact = pairedSignTest(before.map((value, index) => after[index] - value - threshold), "greater");
+	const estimate = options.statistic === "mean" ? bootstrap.mean : bootstrap.median;
+	return {
+		bootstrap,
+		method: "exact-sign",
+		pValue: exact.pValue,
+		minimumPairs,
+		sufficient,
+		indeterminate,
+		significant: sufficient && !indeterminate && estimate > threshold && exact.pValue <= (1 - bootstrap.confidence) / 2
+	};
+}
+//#endregion
+//#region src/paired-promotion-decision.ts
+/**
+* @module
+* ONE rule for "does this paired interval clear a promotion threshold".
+*
+* The rule below was derived on `HeldOutGate` (#479) after the same estimator
+* bug shipped twice. It then turned out that a SECOND gate — the composable
+* `heldOutGate`, plus everything else routed through `heldoutSignificance` —
+* still carried the original defect, because the rule had been written into one
+* gate's method body rather than into a shared function. Two copies of a
+* statistical rule is how a defect survives in one of them, so there is now
+* exactly one copy and both gates call it.
+*
+* Three things the rule does that a bare `pairedBootstrap(...).low > threshold`
+* does not:
+*
+* 1. **Two-point (pass/fail) outcomes decide on Tango's SCORE interval.** On a
+*    pass/fail eval the paired delta vector is dominated by ties, so the
+*    bootstrap of the mean is a resample of a lattice with three atoms and its
+*    percentile interval is not valid at a nonzero margin. The score interval
+*    (`pairedRiskDifferenceScore`) re-estimates the nuisance loss rate under
+*    each hypothesised margin instead of fixing it at the observed value, which
+*    is the only construction that stays a confidence interval as the margin
+*    moves off zero — the regime every noninferiority threshold lives in.
+*    Measured on the composable gate before this change, at a true risk
+*    difference sitting exactly on the production caller's -0.05 margin and a
+*    nominal 5 %: 14.60 % false promotion at n = 40 and 10.10 % at n = 76.
+* 2. **McNemar's exact test holds a VETO at every non-negative threshold.**
+*    Redundant with the interval by construction and kept anyway, so that
+*    swapping the estimator for one without that duality cannot silently
+*    reintroduce "promotes what the exact test refuses". Witness: n = 6, b = 5,
+*    c = 0 — no exact argument reaches alpha = 0.05 with 5 discordant pairs
+*    (two-sided floor 2/2^5 = 0.0625), whatever an interval says. A NEGATIVE
+*    threshold is a noninferiority question, which McNemar's test of "no
+*    difference" is not the right test for, so the veto does not apply there.
+* 3. **A ZERO-WIDTH interval is refused, wherever it sits.** At [0, 0] it
+*    cannot tell a gain from a regression and clears every negative threshold.
+*    Away from zero it fails the opposite way: n identical positive deltas give
+*    [g, g], which clears threshold 0 on no spread at all. Both are an absence
+*    of evidence. Measured on the composable gate before this change, under a
+*    bounded asymmetric null whose true mean paired delta is exactly 0: 88.50 %
+*    false promotion at n = 6 and 65.65 % at n = 20 against a nominal 5 %.
+*
+* Orthogonal to the small-sample switch inside {@link pairedDeltaTest}: that
+* picks the TEST from the sample size (bootstrap CI at n >= 20, pre-registered
+* exact sign test below it), this picks the ESTIMATOR from the outcome's shape.
+* Both are needed — an exact sign test applied to a tie-pinned median is still
+* blind, and a mean bootstrap CI at n = 6 is still not a valid test.
+*/
+/**
+* Which estimator {@link decidePairedPromotion} would use on this data, and the
+* shape facts behind it — for callers that must report the shape on a path
+* where no interval is computed at all (an early rejection, or zero pairs).
+* Cheap: no bootstrap, no interval.
+*/
+function pairedDecisionShape(before, after, statistic = "mean") {
+	const tieFraction = before.length === 0 ? null : pairedDeltaTieFraction(before, after);
+	if (statistic === "median") return {
+		statistic: "median_bootstrap",
+		binaryScale: null,
+		tieFraction
+	};
+	const binaryScale = pairedBinaryScale(before, after);
+	if (binaryScale !== null) return {
+		statistic: "paired_risk_difference",
+		binaryScale,
+		tieFraction
+	};
+	return {
+		statistic: "mean_bootstrap",
+		binaryScale: null,
+		tieFraction
+	};
+}
+/**
+* Decide whether a paired candidate-minus-baseline delta clears a promotion
+* threshold. `before` is the baseline arm, `after` the candidate arm, paired by
+* position. Throws on unequal lengths.
+*/
+function decidePairedPromotion(before, after, options = {}) {
+	if (before.length !== after.length) throw new Error(`decidePairedPromotion: unequal sample sizes (${before.length} vs ${after.length})`);
+	const threshold = options.threshold ?? 0;
+	if (!Number.isFinite(threshold)) throw new Error(`decidePairedPromotion: threshold must be finite, got ${threshold}`);
+	const confidence = options.confidence ?? .95;
+	const exactMinimum = minimumPairsForPairedDeltaTest(confidence);
+	const requestedMinimum = options.minPairs ?? exactMinimum;
+	if (!Number.isInteger(requestedMinimum) || requestedMinimum < 1) throw new Error(`decidePairedPromotion: minPairs must be a positive integer, got ${requestedMinimum}`);
+	const minimumPairs = Math.max(requestedMinimum, exactMinimum);
+	const n = before.length;
+	const sufficient = n >= minimumPairs;
+	const { binaryScale, tieFraction } = pairedDecisionShape(before, after, options.statistic);
+	let core;
+	if (binaryScale !== null) {
+		const unitControl = before.map((v) => v / binaryScale);
+		const unitTreatment = after.map((v) => v / binaryScale);
+		const exact = pairedRiskDifferenceExact(unitControl, unitTreatment, confidence);
+		const score = pairedRiskDifferenceScore(unitControl, unitTreatment, confidence);
+		const low = score.lower * binaryScale;
+		core = {
+			statistic: "paired_risk_difference",
+			method: "score-interval",
+			delta: score.riskDifference * binaryScale,
+			low,
+			high: score.upper * binaryScale,
+			bootstrap: null,
+			mcnemar: {
+				b: exact.b,
+				c: exact.c,
+				nDiscordant: exact.nDiscordant,
+				pValue: exact.pValue
+			},
+			pValue: null,
+			clearsThreshold: low > threshold,
+			label: "success-rate",
+			methodDetail: ""
+		};
+	} else {
+		const bootstrapStatistic = options.statistic === "median" ? "median" : "mean";
+		const test = pairedDeltaTest(before, after, {
+			confidence,
+			resamples: options.resamples,
+			statistic: bootstrapStatistic,
+			seed: options.seed,
+			threshold,
+			minPairs: options.minPairs
+		});
+		const ci = test.bootstrap;
+		core = {
+			statistic: bootstrapStatistic === "mean" ? "mean_bootstrap" : "median_bootstrap",
+			method: test.method,
+			delta: bootstrapStatistic === "mean" ? ci.mean : ci.median,
+			low: ci.low,
+			high: ci.high,
+			bootstrap: ci,
+			mcnemar: null,
+			pValue: test.pValue,
+			clearsThreshold: test.significant,
+			label: bootstrapStatistic,
+			methodDetail: test.method === "exact-sign" ? ` Below ${test.minimumPairs} pairs the interval is descriptive only; the decision is the exact one-sided sign test, p=${fmt(test.pValue ?? 1)}.` : ""
+		};
+	}
+	const indeterminate = !Number.isFinite(core.low) || !Number.isFinite(core.high) || core.low === core.high;
+	const indeterminateCause = !indeterminate ? "" : tieFraction === 1 ? "every paired delta is an exact tie" : core.mcnemar !== null && core.mcnemar.nDiscordant === 0 ? "every pair is concordant (0 discordant pairs)" : `the ${core.label} CI collapsed to a point at ${fmt(core.low)}`;
+	const exactTestVetoes = core.mcnemar !== null && threshold >= 0 && !(core.mcnemar.pValue < 1 - confidence);
+	return {
+		n,
+		threshold,
+		confidence,
+		binaryScale,
+		tieFraction,
+		minimumPairs,
+		sufficient,
+		indeterminate,
+		indeterminateCause,
+		exactTestVetoes,
+		promote: sufficient && !indeterminate && core.clearsThreshold && !exactTestVetoes,
+		...core
+	};
+}
+function fmt(x) {
+	return x.toFixed(4);
+}
+//#endregion
+//#region src/campaign/gates/statistical-heldout.ts
+/**
+* Statistical held-out promotion machinery — the trustworthy core the
+* point-estimate `heldout-delta` gate lacked.
+*
+* The shipped false positive it prevents: a winner re-scored against the
+* baseline on the holdout read run-to-run model NOISE (e.g. 91 vs 95) as a
+* "+4 lift" and shipped, because the gate compared point estimates with no
+* confidence interval. Here we pair candidate vs baseline holdout observations
+* and bootstrap a CI on the paired delta — a candidate ships only when the CI
+* lower bound clears the effect-size threshold (the gain is real at the
+* confidence level, not noise), and is blocked when a critical dimension
+* (e.g. `hallucination_free` for a legal agent) significantly regresses even if
+* the net composite rose (anti-Goodhart).
+*
+* Two traps this module is built around (both produce a NEW false positive if
+* gotten wrong):
+*   1. PAIRING GRANULARITY — pairs by FULL `cellId` (`scenario:rep`), never by
+*      `scenarioId` (which averages reps away and destroys the within-pair
+*      variance reduction that makes a paired bootstrap tighter than unpaired).
+*      One paired observation per cell ⇒ reps multiply n.
+*   2. SCALE — a judge may emit composites/dimensions on [0,1] or 0-100. The
+*      threshold + tolerance are interpreted in the judge's NATIVE scale; the
+*      per-dimension tolerance auto-scales off the observed baseline magnitudes
+*      so `-0.10` on [0,1] doesn't silently become a no-op on a 0-100 dimension.
+*/
+/** Tie fraction at/above which a gate annotates its verdict with the tie share.
+*  Tie-domination of the median bites structurally at >= 0.5 (the median is then
+*  0 by construction); 0.4 is a softer warn threshold that flags a run APPROACHING
+*  that regime, so an operator sees it before the median goes fully blind. */
+const TIE_WARN_FRACTION = .4;
+/**
+* Pair candidate vs baseline holdout observations by FULL cellId. `select`
+* pulls the scalar from a cell's judge reports (composite, or a named
+* dimension); a cell contributes the mean of `select` across its judges. Cells
+* whose scenario is not in `scenarioIds`, or where `select` is undefined for
+* every judge on either side, are skipped on BOTH sides so the arrays stay
+* paired. Throws when the two maps disagree on which holdout cells exist — a
+* load-bearing invariant: the baseline + winner holdout campaigns run the same
+* scenarios with the same seed base, so their cellIds MUST align; a mismatch
+* means a silent pairing bug, not a soft fallback.
+*/
+function pairHoldout(candidate, baseline, scenarioIds, select) {
+	const cellValue = (byCell, cellId) => {
+		const scores = byCell.get(cellId);
+		if (!scores) return void 0;
+		const vals = [];
+		for (const s of Object.values(scores)) {
+			if (s.failed === true) throw new Error(`pairHoldout: cell '${cellId}' contains a failed judge score`);
+			const v = select(s);
+			if (typeof v === "number" && !Number.isFinite(v)) throw new Error(`pairHoldout: cell '${cellId}' contains a non-finite selected score`);
+			if (typeof v === "number") vals.push(v);
+		}
+		if (vals.length === 0) return void 0;
+		return vals.reduce((a, b) => a + b, 0) / vals.length;
+	};
+	const inScope = (cellId) => scenarioIds.has(cellId.split(":")[0] ?? "");
+	const candCells = [...candidate.keys()].filter(inScope).sort();
+	const baseCells = [...baseline.keys()].filter(inScope).sort();
+	if (candCells.length !== baseCells.length || candCells.some((c, i) => c !== baseCells[i])) throw new Error(`pairHoldout: candidate/baseline holdout cells do not align — candidate=[${candCells.join(",")}] baseline=[${baseCells.join(",")}]. Both holdout campaigns must run the same scenarios with the same seed base.`);
+	const before = [];
+	const after = [];
+	const cellIds = [];
+	for (const cellId of candCells) {
+		const b = cellValue(baseline, cellId);
+		const a = cellValue(candidate, cellId);
+		if (b === void 0 && a === void 0) continue;
+		if (b === void 0 || a === void 0) throw new Error(`pairHoldout: cell '${cellId}' has a selected score on only one arm`);
+		before.push(b);
+		after.push(a);
+		cellIds.push(cellId);
+	}
+	return {
+		before,
+		after,
+		cellIds
+	};
+}
+/**
+* Significance of the held-out composite lift: ship only when the lower bound
+* of the interval the outcome's shape ADMITS exceeds `deltaThreshold` (default
+* 0 ⇒ "confidently positive"). Interpret `deltaThreshold` in the judge's native
+* scale.
+*
+* The decision is delegated whole to {@link decidePairedPromotion}, the one
+* copy of the rule (`src/paired-promotion-decision.ts`), which `HeldOutGate`
+* also calls. That module's header carries the measurements; the short version
+* is three guards a bare `bootstrap.low > threshold` does not have:
+*
+*   - a two-point (pass/fail) outcome decides on Tango's SCORE interval, the
+*     only paired-binary construction that stays valid at a nonzero margin;
+*   - McNemar's exact test VETOES at any non-negative threshold;
+*   - a ZERO-WIDTH interval is refused rather than promoted, in either
+*     direction — [0,0] clears every negative threshold and [g,g] clears every
+*     threshold below g, and both are an absence of evidence, not a result.
+*
+* Measured on this function before those guards landed, at a nominal 5 %:
+* 14.60 % false promotion at n = 40 on a paired-binary noninferiority boundary,
+* and 88.50 % at n = 6 under a bounded asymmetric null whose true mean paired
+* delta is exactly 0.
+*
+* At small n, where the percentile bootstrap is descriptive only, a
+* pre-registered exact sign test still carries the bootstrap path.
+*/
+function heldoutSignificance(paired, opts = {}) {
+	const deltaThreshold = opts.deltaThreshold ?? 0;
+	const confidence = opts.confidence ?? .95;
+	const resamples = opts.resamples ?? 2e3;
+	const seed = opts.seed ?? 1337;
+	const statistic = opts.statistic ?? "mean";
+	const decision = decidePairedPromotion(paired.before, paired.after, {
+		confidence,
+		resamples,
+		statistic,
+		seed,
+		threshold: deltaThreshold,
+		minPairs: opts.minProductiveRuns
+	});
+	const bootstrap = decision.bootstrap ?? pairedBootstrap(paired.before, paired.after, {
+		confidence,
+		resamples,
+		statistic,
+		seed
+	});
+	const medianBootstrap = statistic === "median" ? bootstrap : pairedBootstrap(paired.before, paired.after, {
+		confidence,
+		resamples,
+		statistic: "median",
+		seed
+	});
+	const n = paired.before.length;
+	let ties = 0;
+	for (let i = 0; i < n; i += 1) {
+		const after = paired.after[i] ?? 0;
+		const before = paired.before[i] ?? 0;
+		if (Math.abs(after - before) < 1e-9) ties += 1;
+	}
+	const tieFraction = n === 0 ? 0 : ties / n;
+	return {
+		paired,
+		bootstrap,
+		medianBootstrap,
+		decision,
+		decisionStatistic: decision.statistic,
+		mcnemar: decision.mcnemar,
+		tieFraction,
+		n,
+		minimumRequired: decision.minimumPairs,
+		decisionMethod: decision.method,
+		pValue: decision.pValue,
+		significant: decision.promote,
+		fewRuns: !decision.sufficient
+	};
+}
+/** Detect the native scale of a set of scores: 0-100 when any magnitude clears
+*  1.5, else [0,1]. Used to auto-scale the regression tolerance so a default
+*  expressed for [0,1] is not silently a no-op on a 0-100 dimension. */
+function detectScale(values) {
+	return values.some((v) => Math.abs(v) > 1.5) ? 100 : 1;
+}
+/** Per-critical-dimension regression guard. For each dimension, pair the
+*  candidate vs baseline values by full cellId and bootstrap the paired delta;
+*  a dimension is "regressed" when the CI lower bound < −tolerance (conservative
+*  — blocks if the credible worst case exceeds tolerance, which is the right
+*  posture for safety dimensions like `hallucination_free`). When `tolerance`
+*  is omitted it auto-scales: 0.05 on [0,1], 5 on 0-100.
+*
+*  The interval comes from {@link decidePairedPromotion}, so a pass/fail
+*  dimension is judged on Tango's score interval rather than a percentile
+*  bootstrap of the mean — `tolerance` is a NONZERO margin, and the bootstrap
+*  is not a valid interval at one. That matters most here because this guard
+*  fails OPEN by construction: `tolerance` is positive, so an interval pinned at
+*  [0,0] never satisfies `low < −tolerance` and a real regression on a safety
+*  dimension would be reported as `regressed: false`. On the median it fails the
+*  same way for the same reason — when most pairs tie, which is automatic for a
+*  pass/fail dimension on {0,1} and on the 0-100 encoding `detectScale` exists
+*  to support, the median CI collapses to [0,0]. Pass `statistic: 'median'` to
+*  restore the pre-0.134 behaviour. */
+function dimensionRegressions(candidate, baseline, scenarioIds, criticalDimensions, opts = {}) {
+	const out = [];
+	for (const dim of criticalDimensions) {
+		const paired = pairHoldout(candidate, baseline, scenarioIds, (s) => s.dimensions[dim]);
+		if (paired.before.length === 0) continue;
+		const tolerance = opts.tolerance ?? .05 * detectScale([...paired.before, ...paired.after]);
+		const bootstrapStatistic = opts.statistic ?? "mean";
+		const shared = {
+			confidence: opts.confidence ?? .95,
+			resamples: opts.resamples ?? 2e3,
+			statistic: bootstrapStatistic,
+			seed: opts.seed ?? 1337
+		};
+		const guard = decidePairedPromotion(paired.before, paired.after, shared);
+		const regression = decidePairedPromotion(paired.after, paired.before, {
+			...shared,
+			threshold: tolerance
+		});
+		const bootstrap = guard.bootstrap ?? pairedBootstrap(paired.before, paired.after, shared);
+		out.push({
+			dimension: dim,
+			bootstrap,
+			bootstrapStatistic,
+			ci: {
+				low: guard.low,
+				high: guard.high
+			},
+			decisionStatistic: guard.statistic,
+			mcnemar: guard.mcnemar,
+			indeterminate: guard.indeterminate,
+			regressed: bootstrap.low < -tolerance || regression.promote,
+			tolerance,
+			n: paired.before.length
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/campaign/gates/power-preflight.ts
+/** Two-sided z for the common confidence levels; interpolation is overkill here. */
+function zFor(confidence) {
+	if (confidence >= .99) return 2.576;
+	if (confidence >= .95) return 1.96;
+	if (confidence >= .9) return 1.645;
+	return 1.282;
+}
+/** Estimate the minimum detectable lift a paired-holdout improvement run can
+*  ship at a given budget, from the baseline holdout composites — call it BEFORE
+*  spending a search to learn whether the effect you are hunting is even
+*  observable at this holdout size and worker variance. */
+function powerPreflight(opts) {
+	const composites = opts.baselineComposites.filter((v) => Number.isFinite(v));
+	if (composites.length < 3) throw new Error(`powerPreflight: need >= 3 finite baseline composites to estimate variance, got ${composites.length}`);
+	const deltaThreshold = opts.deltaThreshold ?? .05;
+	const confidence = opts.confidence ?? .95;
+	const n = opts.pairedN ?? composites.length;
+	if (n < 2) throw new Error(`powerPreflight: pairedN must be >= 2, got ${n}`);
+	const mean = composites.reduce((a, b) => a + b, 0) / composites.length;
+	const variance = composites.reduce((a, b) => a + (b - mean) * (b - mean), 0) / (composites.length - 1);
+	const sd = Math.sqrt(variance);
+	const z = zFor(confidence);
+	const mde = deltaThreshold + z * Math.SQRT2 * sd / Math.sqrt(n);
+	const scaleAssumed = composites.every((v) => v >= -.001 && v <= 1.5);
+	const headroom = Math.max(0, 1 - mean);
+	const underpowered = scaleAssumed && mde > headroom;
+	const sharedChannelCaveat = opts.sharedScorerChannel ? "Holdout and gate share one scoring channel: raising n/reps reduces only idiosyncratic noise — systematic judge bias remains and this MDE is a lower bound. Full debiasing needs an independent second scoring channel (different judge/benchmark family)." : void 0;
+	const recommendation = underpowered ? `UNDERPOWERED: minimum detectable lift ${mde.toFixed(3)} exceeds the ${headroom.toFixed(3)} headroom above the baseline (${mean.toFixed(3)}) — no achievable effect can ship at this budget. Raise paired n (scenarios x reps) to ~${Math.ceil((z * Math.SQRT2 * sd / Math.max(headroom - deltaThreshold, .01)) ** 2)} or reduce worker variance before searching.` : `Minimum detectable lift at n=${n}: ${mde.toFixed(3)} (baseline sd ${sd.toFixed(3)}). Effects smaller than this cannot clear the gate; budget the search for effects you believe exceed it.`;
+	return {
+		n,
+		sd,
+		mde,
+		baselineMean: mean,
+		headroom,
+		underpowered,
+		scaleAssumed,
+		deltaThreshold,
+		confidence,
+		...sharedChannelCaveat ? { sharedChannelCaveat } : {},
+		recommendation: sharedChannelCaveat ? `${recommendation} ${sharedChannelCaveat}` : recommendation
+	};
+}
+//#endregion
+//#region src/json-recovery.ts
+/**
+* Truncation-tolerant JSON recovery — shared by every parser that reads JSON
+* out of a model response (reflective-mutation proposals, judge scores, the
+* completion-correctness checker).
+*
+* LLMs routinely hit a max_tokens cap mid-emission, leaving a JSON prefix
+* with an unclosed string / object / array and often a dangling key or
+* trailing comma. Throwing on that prefix — and letting the throw fold into
+* a fabricated zero score downstream — is the bug class this module exists
+* to prevent (see `JudgeParseError`'s contract: a synthetic zero is
+* indistinguishable from a real low score). Recovering the complete prefix
+* turns a would-be fabricated zero into a real measurement.
+*/
+/**
+* Walk the input as JSON-aware (string vs not, escape-aware) and close
+* unclosed `{` / `[` in LIFO order at the tail. If the input was already
+* balanced returns it unchanged. If a string was open at end-of-input we
+* also close it with `"` first, since a truncated string-mid-value is the
+* most common LLM cap-hit failure mode and JSON.parse cannot proceed
+* without one.
+*
+* Returns null when the structure is unrecoverable (e.g. depth would go
+* negative — that's an *over*-closed prefix, not a truncation).
+*/
+function autoCloseTruncatedJson(raw) {
+	const stack = [];
+	let inString = false;
+	let escaped = false;
+	for (const c of raw) {
+		if (escaped) {
+			escaped = false;
+			continue;
+		}
+		if (inString) {
+			if (c === "\\") {
+				escaped = true;
+				continue;
+			}
+			if (c === "\"") {
+				inString = false;
+				continue;
+			}
+			continue;
+		}
+		if (c === "\"") {
+			inString = true;
+			continue;
+		}
+		if (c === "{" || c === "[") stack.push(c);
+		else if (c === "}") {
+			if (stack.pop() !== "{") return null;
+		} else if (c === "]") {
+			if (stack.pop() !== "[") return null;
+		}
+	}
+	if (stack.length === 0 && !inString) return raw;
+	let suffix = "";
+	if (escaped) suffix += "\\";
+	if (inString) suffix += "\"";
+	while (stack.length > 0) {
+		const opener = stack.pop();
+		suffix += opener === "{" ? "}" : "]";
+	}
+	return raw + suffix;
+}
+const UNPARSEABLE = Symbol("unparseable");
+function tryParse(candidate) {
+	try {
+		return JSON.parse(candidate);
+	} catch {
+		return UNPARSEABLE;
+	}
+}
+/** Index of the last `,` that sits outside any string literal, or -1. Cutting
+*  there discards a dangling key / half-emitted value at the tail while
+*  keeping every complete member before it. */
+function lastCommaOutsideString(s) {
+	let inString = false;
+	let escaped = false;
+	let last = -1;
+	for (let i = 0; i < s.length; i++) {
+		const c = s[i];
+		if (escaped) {
+			escaped = false;
+			continue;
+		}
+		if (inString) {
+			if (c === "\\") escaped = true;
+			else if (c === "\"") inString = false;
+			continue;
+		}
+		if (c === "\"") inString = true;
+		else if (c === ",") last = i;
+	}
+	return last;
+}
+/**
+* Best-effort parse of a possibly-truncated JSON payload embedded in model
+* output (prose and markdown fences tolerated). Tries each opener position
+* (earliest `{`/`[` first, then the other when the first yields nothing —
+* prose like `[note] {"score":3}` must not poison the slice), and from each
+* start, in order:
+*
+*   1. plain `JSON.parse` of the opener → last-closer slice,
+*   2. auto-closing unclosed structures at the tail
+*      (`autoCloseTruncatedJson`),
+*   3. trimming the tail back to the previous complete member boundary (the
+*      last comma outside a string) and auto-closing again, repeatedly.
+*
+* Recovers e.g. `{"correct": false, "` → `{ correct: false }` — the exact
+* cap-hit shape that has zeroed real eval rows. Returns the parsed value
+* (always an object or array, given the slice starts at an opener), or
+* `null` when nothing parseable can be recovered. Never throws.
+*/
+function recoverTruncatedJson(text) {
+	const starts = [text.indexOf("{"), text.indexOf("[")].filter((i) => i >= 0).sort((a, b) => a - b);
+	for (const start of starts) {
+		const recovered = recoverFrom(text.slice(start));
+		if (recovered !== UNPARSEABLE) return recovered;
+	}
+	return null;
+}
+function recoverFrom(slice) {
+	let candidate = slice;
+	const lastClose = Math.max(candidate.lastIndexOf("}"), candidate.lastIndexOf("]"));
+	if (lastClose > 0) {
+		const balanced = tryParse(candidate.slice(0, lastClose + 1));
+		if (balanced !== UNPARSEABLE) return balanced;
+	}
+	for (let i = 0; i < 64; i++) {
+		const closed = autoCloseTruncatedJson(candidate);
+		if (closed !== null) {
+			const parsed = tryParse(closed);
+			if (parsed !== UNPARSEABLE) return parsed;
+		}
+		const cut = lastCommaOutsideString(candidate);
+		if (cut <= 0) return UNPARSEABLE;
+		candidate = candidate.slice(0, cut);
+	}
+	return UNPARSEABLE;
+}
+//#endregion
+//#region src/reflective-mutation.ts
+/**
+* Reflective mutation — primitives for trace-conditioned prompt rewriting.
+*
+* Used by `prompt-evolution.ts` (and any consumer running iterative
+* improvement). Given a parent prompt + concrete trace evidence (top trials,
+* bottom trials, missed expectations), produce an LLM-ready prompt that
+* proposes targeted mutations — not blind rephrasings.
+*
+* Why this lives outside `prompt-evolution.ts`: any consumer that wants to
+* run reflective rewriting WITHOUT the population/Pareto machinery can
+* import these primitives directly.
+*
+* Quality bar (vs. naive "mutate this prompt"):
+*   - Show parent ↔ children diff, not just one variant
+*   - Quote specific missed goldens with their match phrases
+*   - Surface the model's actual emitted output side-by-side with what was expected
+*   - Quote concrete mutation primitives so the model has a vocabulary
+*/
+/** Bound on rendered/carried `emitted` evidence. ONE constant shared by the
+*  producer (campaignBreakdown's per-scenario excerpt) and this renderer — if
+*  the two drifted, the tighter side would silently re-clip carried evidence. */
+const EMITTED_EVIDENCE_MAX_CHARS = 2e3;
+const DEFAULT_MUTATION_PRIMITIVES = [
+	"Strengthen an imperative (\"should\" → \"must\")",
+	"Add a concrete example pulled from a missed-golden phrase",
+	"Remove a redundant rule that did not improve recall",
+	"Add a counterfactual (\"if X is missing, the score is capped at Y\")",
+	"Reorder sections so the highest-impact rule is first",
+	"Replace abstract language with a domain-specific noun the trial misses"
+];
+/**
+* Build the LLM-ready reflection prompt. Output is plain text — pass it as
+* the user message. The system message should be small and stable (e.g.
+* "Output ONLY a JSON object matching the schema below.").
+*/
+function buildReflectionPrompt(ctx) {
+	const primitives = ctx.mutationPrimitives ?? DEFAULT_MUTATION_PRIMITIVES;
+	const sections = [];
+	sections.push(`# Mutation target: ${ctx.target}`);
+	sections.push("");
+	sections.push(`You are tuning the prompt component named \`${ctx.target}\`. The current variant is shown below; you have ${ctx.topTrials.length} top trials and ${ctx.bottomTrials.length} bottom trials as evidence. Propose ${ctx.childCount} mutation${ctx.childCount === 1 ? "" : "s"} that fix specific weaknesses visible in the bottom trials. Avoid blank rephrasings.`);
+	sections.push("");
+	sections.push("## Current variant");
+	sections.push("```json");
+	sections.push(JSON.stringify(ctx.parentPayload, null, 2));
+	sections.push("```");
+	sections.push("");
+	if (ctx.bottomTrials.length > 0) {
+		sections.push("## Failures (bottom trials) — what went wrong");
+		sections.push("");
+		for (const trial of ctx.bottomTrials) {
+			sections.push(`### Trial \`${trial.id}\` — score ${trial.score.toFixed(2)}${trial.inputName ? ` (${trial.inputName})` : ""}`);
+			if (trial.failureNote) {
+				sections.push("");
+				sections.push(`**Why it scored low:** ${truncate(trial.failureNote, 1500)}`);
+			}
+			const missed = (trial.expectations ?? []).filter((e) => !e.matched);
+			if (missed.length > 0) {
+				sections.push("");
+				sections.push("**Missed expectations:**");
+				for (const m of missed) sections.push(`- \`${m.id}\`: should match phrase \`${quote(m.phrase)}\``);
+			}
+			if (trial.emitted) {
+				sections.push("");
+				sections.push("**What the agent emitted:**");
+				sections.push("```");
+				sections.push(truncate(trial.emitted, EMITTED_EVIDENCE_MAX_CHARS));
+				sections.push("```");
+			}
+			sections.push("");
+		}
+	}
+	if (ctx.topTrials.length > 0) {
+		sections.push("## Successes (top trials) — what to preserve");
+		sections.push("");
+		for (const trial of ctx.topTrials) sections.push(`- \`${trial.id}\`: score ${trial.score.toFixed(2)}${trial.inputName ? ` (${trial.inputName})` : ""}`);
+		sections.push("");
+	}
+	sections.push("## Allowed mutation primitives");
+	sections.push("");
+	for (const p of primitives) sections.push(`- ${p}`);
+	sections.push("");
+	sections.push("## Output schema");
+	sections.push("");
+	sections.push("Respond with a JSON object — no prose, no markdown fences:");
+	sections.push("```json");
+	sections.push(JSON.stringify({ proposals: [{
+		label: "<short label, ≤ 40 chars>",
+		rationale: "<which failure this targets and which primitive you used>",
+		payload: "<full payload of the new variant — same shape as the current variant>"
+	}] }, null, 2));
+	sections.push("```");
+	return sections.join("\n");
+}
+function truncate(s, max) {
+	if (s.length <= max) return s;
+	return `${s.slice(0, max)}… [truncated]`;
+}
+function quote(s) {
+	return s.replace(/`/g, "\\`");
+}
+/**
+* Parse the model's JSON response back into proposals. Tolerates markdown
+* fences and surrounding prose. Returns at most `maxProposals`.
+*/
+function parseReflectionResponse(raw, maxProposals) {
+	let text = raw.trim();
+	if (text.startsWith("```")) text = text.replace(/^```(?:json)?\n?/, "").replace(/\n?```$/, "");
+	let parsed = null;
+	const objectStart = text.indexOf("{");
+	const objectEnd = text.lastIndexOf("}");
+	const arrayStart = text.indexOf("[");
+	const arrayEnd = text.lastIndexOf("]");
+	const tryObjectFirst = objectStart >= 0 && (arrayStart < 0 || objectStart < arrayStart);
+	const candidates = [];
+	if (tryObjectFirst) {
+		if (objectStart >= 0 && objectEnd > objectStart) candidates.push(text.slice(objectStart, objectEnd + 1));
+		if (arrayStart >= 0 && arrayEnd > arrayStart) candidates.push(text.slice(arrayStart, arrayEnd + 1));
+	} else {
+		if (arrayStart >= 0 && arrayEnd > arrayStart) candidates.push(text.slice(arrayStart, arrayEnd + 1));
+		if (objectStart >= 0 && objectEnd > objectStart) candidates.push(text.slice(objectStart, objectEnd + 1));
+	}
+	for (const slice of candidates) try {
+		parsed = JSON.parse(slice);
+		break;
+	} catch {}
+	if (parsed == null) for (const slice of candidates) {
+		const closed = autoCloseTruncatedJson(slice);
+		if (closed != null && closed !== slice) try {
+			parsed = JSON.parse(closed);
+			break;
+		} catch {}
+	}
+	if (parsed == null) return [];
+	let proposalsRaw;
+	if (Array.isArray(parsed)) proposalsRaw = parsed;
+	else if (parsed && typeof parsed === "object") proposalsRaw = parsed.proposals;
+	if (!Array.isArray(proposalsRaw)) return [];
+	const out = [];
+	for (const p of proposalsRaw) {
+		if (!p || typeof p !== "object") continue;
+		const obj = p;
+		if (!("payload" in obj)) continue;
+		out.push({
+			label: typeof obj.label === "string" ? obj.label : "mutation",
+			rationale: typeof obj.rationale === "string" ? obj.rationale : "",
+			payload: obj.payload
+		});
+		if (maxProposals !== void 0 && out.length >= maxProposals) break;
+	}
+	return out;
+}
+//#endregion
+//#region src/campaign/score-utils.ts
+/**
+* Shared campaign-score reductions used by every optimizer preset
+* (`runOptimization`, external optimization methods, `compareOptimizationMethods`).
+* "composite of a campaign" and "per-scenario / per-dimension breakdown" so
+* the optimizers cannot drift on how a surface's score is computed.
+*/
+/** Mean composite across cells with complete task-quality evidence.
+*  Partial judge results remain on their cells but never enter this value.
+*  A campaign with no complete score has no numeric mean and fails loudly. */
+function campaignMeanComposite(campaign) {
+	const mean = campaignMeanCompositeOrNull(campaign);
+	if (mean === null) throw new Error("campaignMeanComposite: campaign has no complete cell-quality scores");
+	return mean;
+}
+/** Nullable campaign mean for wire and report fields that represent missing quality. */
+function campaignMeanCompositeOrNull(campaign) {
+	const scores = campaign.cells.flatMap((cell) => {
+		const score = projectCampaignCellQuality(cell).score;
+		return score === void 0 ? [] : [score];
+	});
+	return scores.length === 0 ? null : scores.reduce((sum, score) => sum + score, 0) / scores.length;
+}
+/** Reject rank keys that cannot produce deterministic lexicographic ordering. */
+function assertFiniteRankKey(key, label, expectedLength) {
+	if (!Array.isArray(key) || key.length === 0) throw new Error(`${label} must return a non-empty array`);
+	if (expectedLength !== void 0 && key.length !== expectedLength) throw new Error(`${label} returned ${key.length} elements; expected ${expectedLength}`);
+	for (let index = 0; index < key.length; index++) if (!Number.isFinite(key[index])) throw new Error(`${label}[${index}] must be finite`);
+}
+/** Compare fixed-length lexicographic rank keys where each element is higher-is-better.
+*  Returns a positive number when `a` ranks above `b`, negative when below, and
+*  zero when equal. */
+function compareRankKeys(a, b) {
+	assertFiniteRankKey(a, "rank key a");
+	assertFiniteRankKey(b, "rank key b", a.length);
+	for (let i = 0; i < a.length; i++) {
+		const av = a[i];
+		const bv = b[i];
+		if (av !== bv) return av - bv;
+	}
+	return 0;
+}
+/** Per-candidate evidence a reflective/patch proposer grounds its next proposal
+*  on: mean score per judge dimension + per-scenario composite. */
+function campaignBreakdown(campaign) {
+	const dimSums = {};
+	const dimCounts = {};
+	const byScenario = /* @__PURE__ */ new Map();
+	const notesByScenario = /* @__PURE__ */ new Map();
+	const emittedByScenario = /* @__PURE__ */ new Map();
+	for (const cell of campaign.cells) {
+		const quality = projectCampaignCellQuality(cell);
+		if (quality.score === void 0) continue;
+		const judgeScores = Object.values(quality.successfulJudgeScores);
+		const cellComposite = quality.score;
+		const arr = byScenario.get(cell.scenarioId) ?? [];
+		arr.push(cellComposite);
+		byScenario.set(cell.scenarioId, arr);
+		if (typeof cell.artifact === "string" && cell.artifact.trim().length > 0) {
+			const prev = emittedByScenario.get(cell.scenarioId);
+			if (!prev || cellComposite < prev.composite) emittedByScenario.set(cell.scenarioId, {
+				composite: cellComposite,
+				text: cell.artifact.slice(0, EMITTED_EVIDENCE_MAX_CHARS)
+			});
+		}
+		for (const s of judgeScores) if (s.notes?.trim()) {
+			const set = notesByScenario.get(cell.scenarioId) ?? /* @__PURE__ */ new Set();
+			set.add(s.notes.trim());
+			notesByScenario.set(cell.scenarioId, set);
+		}
+		for (const score of judgeScores) for (const [key, value] of Object.entries(score.dimensions)) {
+			if (!Number.isFinite(value)) continue;
+			dimSums[key] = (dimSums[key] ?? 0) + value;
+			dimCounts[key] = (dimCounts[key] ?? 0) + 1;
+		}
+	}
+	const dimensions = {};
+	for (const key of Object.keys(dimSums)) {
+		const count = dimCounts[key] ?? 0;
+		dimensions[key] = count > 0 ? (dimSums[key] ?? 0) / count : 0;
+	}
+	return {
+		dimensions,
+		scenarios: [...byScenario.entries()].map(([scenarioId, comps]) => {
+			const notesSet = notesByScenario.get(scenarioId);
+			const notes = notesSet && notesSet.size > 0 ? [...notesSet].join(" | ") : void 0;
+			const emitted = emittedByScenario.get(scenarioId)?.text;
+			return {
+				scenarioId,
+				composite: comps.reduce((a, b) => a + b, 0) / comps.length,
+				...notes ? { notes } : {},
+				...emitted ? { emitted } : {}
+			};
+		})
+	};
+}
+//#endregion
+//#region src/campaign/provenance.ts
+/**
+* Loop provenance — the durable, queryable record of WHAT a self-improvement
+* loop did and WHY, plus the OTel spans that let an OTLP collector pivot from
+* an eval-run to the underlying candidate→cell→gate→promote chain.
+*
+* Two artifacts, one source of truth:
+*
+*   1. `LoopProvenanceRecord` — a structured JSON record capturing every
+*      candidate (surfaceHash + label + rationale + structured cause), its measured composite,
+*      the gate decision + reasons + delta, the held-out lift, the explicit
+*      baseline→candidate diff, and BACKEND PROVENANCE (the
+*      `assertRealBackend` verdict + worker call count + model). This is the
+*      ingestable audit artifact: the +lift recomputes from it, the "because
+*      Z" rationale survives in it, and a stub backend is detectable from it.
+*
+*   2. `loopProvenanceSpans()` — the same chain emitted as OTLP-ingestable
+*      `TraceSpanEvent`s, pivoted on the substrate's standard
+*      `tangle.runId` / `tangle.scenarioId` / `tangle.cellId` /
+*      `tangle.generation` attributes (the same pivots `/adapters/otel`
+*      reads). The hosted `/v1/ingest/traces` endpoint receives the FULL loop,
+*      not just the `cost.*` spans `runCampaign` already emits per cell.
+*
+* The record is built from the loop result and its settled cost receipts — no
+* second usage collector can contradict what the measured cells recorded.
+*/
+/** One translation from a completed improvement loop into durable evidence. */
+function loopProvenanceArgsFromResult(input) {
+	const { result } = input;
+	return {
+		runId: input.runId,
+		runDir: input.runDir,
+		timestamp: input.timestamp,
+		baselineSurface: input.baselineSurface,
+		winnerSurface: result.winnerSurface,
+		...result.winnerLabel ? { winnerLabel: result.winnerLabel } : {},
+		...result.winnerRationale ? { winnerRationale: result.winnerRationale } : {},
+		baselineSearchCampaign: result.baselineCampaign,
+		generations: result.generations.map(({ record, surfaces }) => ({
+			generationIndex: record.generationIndex,
+			candidates: record.candidates,
+			promoted: record.promoted,
+			surfaces: surfaces.map(({ surfaceHash, surface, campaign }) => ({
+				surfaceHash,
+				surface,
+				campaign
+			}))
+		})),
+		gate: result.gateResult,
+		...result.holdout === "deferred" ? { holdout: "deferred" } : {},
+		baselineOnHoldout: result.baselineOnHoldout,
+		winnerOnHoldout: result.winnerOnHoldout,
+		...result.neutralizedSurface && result.neutralizedOnHoldout ? {
+			neutralizedSurface: result.neutralizedSurface,
+			neutralizedOnHoldout: result.neutralizedOnHoldout
+		} : {},
+		costReceipts: input.costReceipts,
+		totalCostUsd: input.totalCostUsd,
+		totalDurationMs: input.totalDurationMs
+	};
+}
+function meanHoldoutComposite(campaign) {
+	return campaignMeanComposite(campaign);
+}
+/** Build the durable provenance record from a completed loop result. */
+function buildLoopProvenanceRecord(args) {
+	if (!args.runId.trim() || !args.runDir.trim()) throw new Error("buildLoopProvenanceRecord: runId and runDir must be non-empty");
+	const timestampMs = Date.parse(args.timestamp);
+	if (!Number.isFinite(timestampMs) || new Date(timestampMs).toISOString() !== args.timestamp) throw new Error("buildLoopProvenanceRecord: timestamp must be a canonical ISO instant");
+	assertGateContributions(args.gate.contributingGates, "buildLoopProvenanceRecord");
+	const agentReceipts = args.costReceipts.filter((receipt) => receipt.channel === "agent");
+	const integrity = summarizeAgentReceiptIntegrity(agentReceipts);
+	const models = [...new Set(agentReceipts.map((receipt) => receipt.model))].sort();
+	const baselineSearchComposite = campaignMeanComposite(args.baselineSearchCampaign);
+	if (!Number.isFinite(baselineSearchComposite)) throw new Error("buildLoopProvenanceRecord: baselineSearchComposite must be finite");
+	const candidates = [];
+	let incumbentSurfaceHash = surfaceHash(args.baselineSurface);
+	let incumbentComposite = baselineSearchComposite;
+	let previousGeneration = -1;
+	for (const gen of args.generations) {
+		if (!Number.isSafeInteger(gen.generationIndex) || gen.generationIndex !== previousGeneration + 1) throw new Error("buildLoopProvenanceRecord: generation indices must be contiguous integers starting at zero");
+		previousGeneration = gen.generationIndex;
+		if (gen.candidates.length === 0) throw new Error("buildLoopProvenanceRecord: a recorded generation must contain a candidate");
+		if (new Set(gen.promoted).size !== gen.promoted.length || gen.promoted.length > 1) throw new Error("buildLoopProvenanceRecord: each generation may promote at most one candidate");
+		const promotedSet = new Set(gen.promoted);
+		const surfaceByHash = new Map(gen.surfaces.map((measured) => [measured.surfaceHash, measured]));
+		const candidateByHash = new Map(gen.candidates.map((candidate) => [candidate.surfaceHash, candidate]));
+		if (candidateByHash.size !== gen.candidates.length) throw new Error("buildLoopProvenanceRecord: duplicate candidate surface hash");
+		if (surfaceByHash.size !== gen.surfaces.length) throw new Error("buildLoopProvenanceRecord: duplicate candidate surface entry");
+		if (surfaceByHash.size !== candidateByHash.size) throw new Error("buildLoopProvenanceRecord: every measured candidate requires exactly one surface");
+		for (const promotedHash of promotedSet) if (!candidateByHash.has(promotedHash)) throw new Error("buildLoopProvenanceRecord: promoted hash has no measured candidate");
+		for (const c of gen.candidates) {
+			validateCandidateMeasurement(c, incumbentSurfaceHash, incumbentComposite, promotedSet.has(c.surfaceHash));
+			const measured = surfaceByHash.get(c.surfaceHash);
+			if (measured === void 0) throw new Error("buildLoopProvenanceRecord: measured candidate is missing its surface");
+			const { surface, campaign } = measured;
+			if (!surfaceHashMatches(surface, c.surfaceHash)) throw new Error("buildLoopProvenanceRecord: candidate surface hash does not match its surface bytes");
+			if (campaign.splitDigest !== args.baselineSearchCampaign.splitDigest) throw new Error("buildLoopProvenanceRecord: candidate campaign does not match the search split");
+			const entry = {
+				generation: gen.generationIndex,
+				surfaceHash: c.surfaceHash,
+				contentHash: surfaceContentHash(surface),
+				campaignDigest: campaignMeasurementDigest(campaign),
+				parentSurfaceHash: c.parentSurfaceHash,
+				parentComposite: c.parentComposite,
+				eligibleForPromotion: c.eligibleForPromotion,
+				coverage: {
+					expectedCells: c.coverage.expectedCells,
+					scorableCells: c.coverage.scorableCells,
+					unscorableCells: c.coverage.unscorableCells.map((cell) => ({ ...cell }))
+				},
+				composite: c.composite,
+				promoted: promotedSet.has(c.surfaceHash)
+			};
+			if (c.label) entry.label = c.label;
+			if (c.rationale) entry.rationale = c.rationale;
+			if (c.attribution) entry.attribution = c.attribution;
+			if (c.observedDeltaFromParent !== void 0) entry.observedDeltaFromParent = c.observedDeltaFromParent;
+			candidates.push(entry);
+		}
+		const promotedHash = gen.promoted[0];
+		if (promotedHash) {
+			const promoted = candidateByHash.get(promotedHash);
+			incumbentSurfaceHash = promoted.surfaceHash;
+			if (promoted.composite === null) throw new Error("buildLoopProvenanceRecord: promoted candidate is missing a composite");
+			incumbentComposite = promoted.composite;
+		}
+	}
+	if (surfaceHash(args.winnerSurface) !== incumbentSurfaceHash) throw new Error("buildLoopProvenanceRecord: winner surface does not match the final promoted incumbent");
+	const holdoutDeferred = args.holdout === "deferred";
+	if (args.baselineOnHoldout.splitDigest !== args.winnerOnHoldout.splitDigest) throw new Error("buildLoopProvenanceRecord: baseline and winner use different holdout splits");
+	if (args.neutralizedSurface === void 0 !== (args.neutralizedOnHoldout === void 0)) throw new Error("buildLoopProvenanceRecord: neutralized surface and campaign must be supplied together");
+	if (args.neutralizedOnHoldout && args.neutralizedOnHoldout.splitDigest !== args.baselineOnHoldout.splitDigest) throw new Error("buildLoopProvenanceRecord: neutralized campaign uses a different holdout split");
+	if (holdoutDeferred && args.neutralizedOnHoldout) throw new Error("buildLoopProvenanceRecord: a deferred holdout cannot include a neutralized measurement");
+	const holdoutMeasurement = holdoutDeferred ? { kind: "deferred" } : {
+		kind: "measured",
+		baseline: meanHoldoutComposite(args.baselineOnHoldout),
+		winner: meanHoldoutComposite(args.winnerOnHoldout),
+		...args.neutralizedOnHoldout ? { neutralized: meanHoldoutComposite(args.neutralizedOnHoldout) } : {}
+	};
+	const diff = surfaceContentHash(args.baselineSurface) === surfaceContentHash(args.winnerSurface) ? "" : renderSurfaceDiff(args.winnerSurface, args.baselineSurface);
+	const recordWithoutDigest = {
+		schema: "tangle.loop-provenance",
+		runId: args.runId,
+		runDir: args.runDir,
+		timestamp: args.timestamp,
+		baselineContentHash: surfaceContentHash(args.baselineSurface),
+		winnerContentHash: surfaceContentHash(args.winnerSurface),
+		diff,
+		candidates,
+		evidence: {
+			search: {
+				splitDigest: args.baselineSearchCampaign.splitDigest,
+				baselineCampaignDigest: campaignMeasurementDigest(args.baselineSearchCampaign)
+			},
+			holdout: {
+				splitDigest: args.baselineOnHoldout.splitDigest,
+				baselineCampaignDigest: campaignMeasurementDigest(args.baselineOnHoldout),
+				winnerCampaignDigest: campaignMeasurementDigest(args.winnerOnHoldout),
+				...args.neutralizedSurface && args.neutralizedOnHoldout && holdoutMeasurement.kind === "measured" && holdoutMeasurement.neutralized !== void 0 ? { neutralized: {
+					contentHash: surfaceContentHash(args.neutralizedSurface),
+					campaignDigest: campaignMeasurementDigest(args.neutralizedOnHoldout),
+					composite: holdoutMeasurement.neutralized,
+					lift: holdoutMeasurement.neutralized - holdoutMeasurement.baseline
+				} } : {}
+			},
+			costReceiptsDigest: canonicalDigest([...args.costReceipts].sort((left, right) => compareCodeUnits(left.callId, right.callId)))
+		},
+		baselineSearchComposite,
+		gate: {
+			decision: args.gate.decision,
+			reasons: args.gate.reasons,
+			...args.gate.delta === void 0 ? {} : { delta: args.gate.delta },
+			contributingGates: args.gate.contributingGates.map((g) => ({
+				name: g.name,
+				status: g.status,
+				detail: durableGateDetail(g.detail)
+			}))
+		},
+		...holdoutMeasurement.kind === "deferred" ? { holdout: "deferred" } : {
+			baselineHoldoutComposite: holdoutMeasurement.baseline,
+			winnerHoldoutComposite: holdoutMeasurement.winner,
+			heldOutLift: holdoutMeasurement.winner - holdoutMeasurement.baseline
+		},
+		backend: {
+			verdict: integrity.verdict,
+			workerCallCount: integrity.totalRecords,
+			models,
+			totalInputTokens: integrity.totalInputTokens,
+			totalOutputTokens: integrity.totalOutputTokens,
+			totalCostUsd: integrity.totalCostUsd
+		},
+		totalCostUsd: args.totalCostUsd,
+		totalDurationMs: args.totalDurationMs
+	};
+	if (args.optimizationMethod) recordWithoutDigest.optimizationMethod = durableOptimizationMethod(args.optimizationMethod);
+	if (args.winnerLabel) recordWithoutDigest.winnerLabel = args.winnerLabel;
+	if (args.winnerRationale) recordWithoutDigest.winnerRationale = args.winnerRationale;
+	return {
+		...recordWithoutDigest,
+		recordDigest: canonicalDigest(recordWithoutDigest)
+	};
+}
+function durableOptimizationMethod(value) {
+	if (!value || typeof value !== "object" || typeof value.name !== "string" || !value.name.trim() || value.name.trim() !== value.name) throw new Error("buildLoopProvenanceRecord: optimization method name is invalid");
+	if (!value.cost || !Number.isFinite(value.cost.totalCostUsd) || value.cost.totalCostUsd < 0 || typeof value.cost.accountingComplete !== "boolean" || !Array.isArray(value.cost.incompleteReasons) || value.cost.incompleteReasons.some((reason) => typeof reason !== "string" || !reason.trim()) || value.cost.accountingComplete !== (value.cost.incompleteReasons.length === 0)) throw new Error("buildLoopProvenanceRecord: optimization method cost is invalid");
+	if (value.durationMs !== void 0 && (!Number.isFinite(value.durationMs) || value.durationMs < 0)) throw new Error("buildLoopProvenanceRecord: optimization method duration is invalid");
+	try {
+		return JSON.parse(canonicalString(value));
+	} catch (cause) {
+		throw new Error("buildLoopProvenanceRecord: optimization method data must be canonical JSON", { cause });
+	}
+}
+/** Digest the exact campaign fields that can affect a measured comparison. */
+function campaignMeasurementDigest(campaign) {
+	assertCampaignSplitIdentity(campaign.scenarios, campaign.reps, campaign.splitDigest);
+	return canonicalDigest({
+		schema: "tangle.campaign-measurement",
+		manifestHash: campaign.manifestHash,
+		splitDigest: campaign.splitDigest,
+		seed: campaign.seed,
+		reps: campaign.reps,
+		runDir: campaign.runDir,
+		scenarios: campaign.scenarios,
+		cells: [...campaign.cells].sort((left, right) => compareCodeUnits(left.cellId, right.cellId)).map((cell) => ({
+			manifestHash: cell.manifestHash ?? null,
+			cellId: cell.cellId,
+			scenarioId: cell.scenarioId,
+			rep: cell.rep,
+			generation: cell.generation ?? null,
+			judgeScores: cell.judgeScores,
+			costUsd: cell.costUsd,
+			costProvenance: cell.costProvenance,
+			costCallIds: [...cell.costCallIds ?? []].sort(),
+			tokenUsage: cell.tokenUsage,
+			resolvedModels: [...cell.resolvedModels ?? []].sort(),
+			resolvedModel: cell.resolvedModel ?? null,
+			durationMs: cell.durationMs,
+			seed: cell.seed,
+			cached: cell.cached,
+			errorStage: cell.errorStage ?? null,
+			errorJudge: cell.errorJudge ?? null,
+			error: cell.error ?? null
+		}))
+	});
+}
+/** Recompute and validate the self-addressed durable record. */
+function verifyLoopProvenanceRecord(record) {
+	if (record.schema !== "tangle.loop-provenance") throw new Error("loop provenance has an unsupported schema");
+	const { recordDigest, ...recordWithoutDigest } = record;
+	if (recordDigest !== canonicalDigest(recordWithoutDigest)) throw new Error("loop provenance record digest does not match its contents");
+	assertGateContributions(record.gate?.contributingGates, "loop provenance");
+	return record;
+}
+/** SHA-256 over the RFC 8785 canonical JSON of `value`. Throws
+* `LedgerCanonicalizationError` for a value with no canonical form. */
+function canonicalDigest(value) {
+	return hashCanonical(value);
+}
+function durableGateDetail(detail) {
+	if (detail === void 0) return null;
+	try {
+		return JSON.parse(canonicalString(detail));
+	} catch (cause) {
+		throw new Error("buildLoopProvenanceRecord: gate detail must be canonical JSON", { cause });
+	}
+}
+function assertGateContributions(value, source) {
+	if (!Array.isArray(value)) throw new Error(`${source}: gate contributingGates must be an array`);
+	const statuses = /* @__PURE__ */ new Set([
+		"pass",
+		"fail",
+		"not_evaluated"
+	]);
+	for (const [index, contribution] of value.entries()) {
+		if (!contribution || typeof contribution !== "object") throw new Error(`${source}: gate contribution ${index} must be an object`);
+		const item = contribution;
+		if (typeof item.name !== "string" || item.name.length === 0) throw new Error(`${source}: gate contribution ${index} must have a non-empty name`);
+		if (!statuses.has(String(item.status))) throw new Error(`${source}: gate contribution '${item.name}' must have status pass, fail, or not_evaluated`);
+		if ("passed" in item) throw new Error(`${source}: gate contribution '${item.name}' uses obsolete passed; use status instead`);
+	}
+}
+function validateCandidateMeasurement(candidate, expectedParentHash, expectedParentComposite, promoted) {
+	if (!candidate.parentSurfaceHash || !/^[a-f0-9]{16}$/.test(candidate.parentSurfaceHash)) throw new Error("buildLoopProvenanceRecord: parentSurfaceHash must be 16 lowercase hex characters");
+	if (candidate.parentSurfaceHash !== expectedParentHash) throw new Error("buildLoopProvenanceRecord: candidate parent does not match the incumbent");
+	if (candidate.parentComposite === void 0 || !Number.isFinite(candidate.parentComposite) || Math.abs(candidate.parentComposite - expectedParentComposite) > 1e-12) throw new Error("buildLoopProvenanceRecord: candidate parentComposite does not match the incumbent");
+	if (candidate.observedDeltaFromParent !== void 0) {
+		if (!Number.isFinite(candidate.observedDeltaFromParent)) throw new Error("buildLoopProvenanceRecord: observedDeltaFromParent must be finite");
+		if (candidate.eligibleForPromotion !== true) throw new Error("buildLoopProvenanceRecord: observedDeltaFromParent requires a complete eligible candidate and parentSurfaceHash");
+	}
+	const coverage = candidate.coverage;
+	if (!Number.isSafeInteger(coverage.expectedCells) || coverage.expectedCells <= 0 || !Number.isSafeInteger(coverage.scorableCells) || coverage.scorableCells < 0 || coverage.scorableCells > coverage.expectedCells) throw new Error("buildLoopProvenanceRecord: invalid candidate coverage denominator");
+	const unscorableIds = /* @__PURE__ */ new Set();
+	for (const failure of coverage.unscorableCells) {
+		if (typeof failure.cellId !== "string" || failure.cellId.length === 0 || typeof failure.reason !== "string" || failure.reason.length === 0 || unscorableIds.has(failure.cellId)) throw new Error("buildLoopProvenanceRecord: invalid candidate coverage failures");
+		unscorableIds.add(failure.cellId);
+	}
+	if (coverage.expectedCells - coverage.scorableCells !== coverage.unscorableCells.length) throw new Error("buildLoopProvenanceRecord: candidate coverage counts do not match its failures");
+	const complete = coverage.scorableCells === coverage.expectedCells && coverage.unscorableCells.length === 0;
+	if (candidate.eligibleForPromotion !== complete) throw new Error("buildLoopProvenanceRecord: candidate eligibility contradicts its coverage receipt");
+	if (complete) {
+		if (candidate.composite === null || !Number.isFinite(candidate.composite)) throw new Error("buildLoopProvenanceRecord: complete candidate composite must be finite");
+		if (candidate.observedDeltaFromParent === void 0) throw new Error("buildLoopProvenanceRecord: complete candidate is missing observedDeltaFromParent");
+		const recomputed = candidate.composite - candidate.parentComposite;
+		if (Math.abs(candidate.observedDeltaFromParent - recomputed) > 1e-12) throw new Error("buildLoopProvenanceRecord: observed delta does not match measured scores");
+	} else {
+		if (candidate.composite !== null && !Number.isFinite(candidate.composite)) throw new Error("buildLoopProvenanceRecord: candidate composite must be finite or null");
+		if (candidate.observedDeltaFromParent !== void 0) throw new Error("buildLoopProvenanceRecord: incomplete candidate cannot carry observed delta");
+	}
+	if (promoted && (!complete || (candidate.observedDeltaFromParent ?? 0) <= 0)) throw new Error("buildLoopProvenanceRecord: promoted candidate must improve the incumbent");
+}
+function hashId(parts) {
+	return createHash("sha256").update(parts.join(":")).digest("hex");
+}
+/**
+* Build the loop's OTLP-ingestable spans from a provenance record. One root
+* span per loop (`tangle.runId`), one span per generation, one span per
+* candidate (carrying its surfaceHash + label), and one span for the gate
+* decision (carrying reasons + delta + lift). Candidate + gate spans pivot on
+* the same `tangle.runId` / `tangle.generation` attributes `/adapters/otel`
+* reads, so the hosted collector reconstructs the full tree.
+*
+* Times are synthesized monotonically off a single base so the span tree is
+* orderable; the substrate does not retain per-candidate wall-clock starts.
+*/
+function loopProvenanceSpans(record, opts = {}) {
+	const traceId = hashId(["trace", record.runId]).slice(0, 32);
+	const baseTimeMs = opts.baseTimeMs ?? (Date.parse(record.timestamp) || Date.now());
+	const durationMs = Math.max(1, record.totalDurationMs);
+	if (!Number.isSafeInteger(baseTimeMs) || baseTimeMs < 0) throw new RangeError("loop provenance baseTimeMs must be a non-negative safe integer");
+	if (!Number.isSafeInteger(durationMs)) throw new RangeError("loop provenance duration must be a safe integer number of milliseconds");
+	const baseTime = BigInt(baseTimeMs);
+	const baseNano = (baseTime * 1000000n).toString();
+	const endNano = ((baseTime + BigInt(durationMs)) * 1000000n).toString();
+	const spans = [];
+	const rootSpanId = hashId(["root", record.runId]).slice(0, 16);
+	const rootAttributes = {
+		"tangle.runId": record.runId,
+		"tangle.runDir": record.runDir,
+		"tangle.baselineContentHash": record.baselineContentHash,
+		"tangle.winnerContentHash": record.winnerContentHash,
+		"tangle.baselineSearchComposite": record.baselineSearchComposite,
+		"tangle.gateDecision": record.gate.decision,
+		"tangle.backendVerdict": record.backend.verdict,
+		"tangle.workerCallCount": record.backend.workerCallCount,
+		"tangle.totalCostUsd": record.totalCostUsd
+	};
+	if (record.heldOutLift !== void 0) rootAttributes["tangle.heldOutLift"] = record.heldOutLift;
+	if (record.holdout) rootAttributes["tangle.holdout"] = record.holdout;
+	spans.push({
+		traceId,
+		spanId: rootSpanId,
+		name: "improvement-loop",
+		startTimeUnixNano: baseNano,
+		endTimeUnixNano: endNano,
+		attributes: rootAttributes,
+		status: { code: "OK" },
+		"tangle.runId": record.runId
+	});
+	const byGen = /* @__PURE__ */ new Map();
+	for (const c of record.candidates) {
+		const arr = byGen.get(c.generation) ?? [];
+		arr.push(c);
+		byGen.set(c.generation, arr);
+	}
+	for (const [generation, cands] of [...byGen.entries()].sort((a, b) => a[0] - b[0])) {
+		const genSpanId = hashId([
+			"gen",
+			record.runId,
+			String(generation)
+		]).slice(0, 16);
+		const measuredComposites = cands.flatMap((candidate) => candidate.composite === null ? [] : [candidate.composite]);
+		spans.push({
+			traceId,
+			spanId: genSpanId,
+			parentSpanId: rootSpanId,
+			name: `generation-${generation}`,
+			startTimeUnixNano: baseNano,
+			endTimeUnixNano: endNano,
+			attributes: {
+				"tangle.runId": record.runId,
+				"tangle.generation": generation,
+				"tangle.populationSize": cands.length,
+				...measuredComposites.length > 0 ? { "tangle.bestComposite": Math.max(...measuredComposites) } : {}
+			},
+			"tangle.runId": record.runId,
+			"tangle.generation": generation
+		});
+		for (let i = 0; i < cands.length; i++) {
+			const c = cands[i];
+			const candSpanId = hashId([
+				"cand",
+				record.runId,
+				String(generation),
+				c.surfaceHash
+			]).slice(0, 16);
+			const attributes = {
+				"tangle.runId": record.runId,
+				"tangle.generation": generation,
+				"tangle.surfaceHash": c.surfaceHash,
+				"tangle.contentHash": c.contentHash,
+				"tangle.parentSurfaceHash": c.parentSurfaceHash,
+				"tangle.parentComposite": c.parentComposite,
+				"tangle.eligibleForPromotion": c.eligibleForPromotion,
+				"tangle.expectedCells": c.coverage.expectedCells,
+				"tangle.scorableCells": c.coverage.scorableCells,
+				"tangle.unscorableCells": c.coverage.unscorableCells.length,
+				"tangle.promoted": c.promoted
+			};
+			if (c.composite !== null) attributes["tangle.composite"] = c.composite;
+			if (c.observedDeltaFromParent !== void 0) attributes["tangle.observedDeltaFromParent"] = c.observedDeltaFromParent;
+			if (c.label) attributes["tangle.candidateLabel"] = c.label;
+			if (c.rationale) attributes["tangle.candidateRationale"] = c.rationale;
+			spans.push({
+				traceId,
+				spanId: candSpanId,
+				parentSpanId: genSpanId,
+				name: `candidate-${c.surfaceHash}`,
+				startTimeUnixNano: baseNano,
+				endTimeUnixNano: endNano,
+				attributes,
+				"tangle.runId": record.runId,
+				"tangle.generation": generation
+			});
+		}
+	}
+	const gateSpanId = hashId(["gate", record.runId]).slice(0, 16);
+	const gateAttributes = {
+		"tangle.runId": record.runId,
+		"tangle.gateDecision": record.gate.decision,
+		"tangle.gateReasons": JSON.stringify(record.gate.reasons)
+	};
+	const gateDelta = record.gate.delta ?? record.heldOutLift;
+	if (gateDelta !== void 0) gateAttributes["tangle.gateDelta"] = gateDelta;
+	if (record.heldOutLift !== void 0) gateAttributes["tangle.heldOutLift"] = record.heldOutLift;
+	if (record.baselineHoldoutComposite !== void 0) gateAttributes["tangle.baselineHoldoutComposite"] = record.baselineHoldoutComposite;
+	if (record.winnerHoldoutComposite !== void 0) gateAttributes["tangle.winnerHoldoutComposite"] = record.winnerHoldoutComposite;
+	if (record.holdout) gateAttributes["tangle.holdout"] = record.holdout;
+	spans.push({
+		traceId,
+		spanId: gateSpanId,
+		parentSpanId: rootSpanId,
+		name: "gate-decision",
+		startTimeUnixNano: endNano,
+		endTimeUnixNano: endNano,
+		attributes: gateAttributes,
+		status: { code: "OK" },
+		"tangle.runId": record.runId
+	});
+	return spans;
+}
+/** Canonical durable paths under the run dir. */
+function provenanceRecordPath(runDir) {
+	return join(runDir, "loop-provenance.json");
+}
+/**
+* Canonical path for the durable OTLP spans JSONL file under a loop run directory.
+*/
+function provenanceSpansPath(runDir) {
+	return join(runDir, "loop-provenance-spans.jsonl");
+}
+/** Snapshot a held-out campaign into the hosted `EvalRunGenerationSnapshot`
+*  shape — per-cell composite + per-judge dimensions, aggregate mean, cost,
+*  duration. The dashboard renders these as the baseline → winner comparison. */
+function snapshotFromHoldout(index, surfaceHash, surface, campaign) {
+	return {
+		index,
+		surfaceHash,
+		surface,
+		cells: campaign.cells.map((cell) => {
+			const execution = campaignCellExecutionEvidence(cell);
+			const quality = projectCampaignCellQuality(cell);
+			const score = {
+				scenarioId: cell.scenarioId,
+				rep: cell.rep,
+				compositeMean: quality.score ?? null,
+				dimensions: quality.judgeScores?.perJudge ?? {},
+				terminalOutcome: execution.terminalOutcome,
+				executionErrorCount: execution.executionErrorCount ?? null
+			};
+			if (cell.error) score.errorMessage = cell.error;
+			return score;
+		}),
+		compositeMean: campaignMeanCompositeOrNull(campaign),
+		costUsd: campaign.aggregates.cost.totalCostUsd,
+		durationMs: campaign.durationMs
+	};
+}
+/** Build the hosted `EvalRunEvent` from the loop args + record — baseline +
+*  winner snapshots, gate decision, held-out lift, cost, duration. Shipped to
+*  `/v1/ingest/eval-runs` so the run appears in the dashboard's run list (the
+*  trace spans, shipped separately, back the per-candidate drill-down). */
+function buildEvalRunEvent(args, record) {
+	return {
+		runId: args.runId,
+		runDir: args.runDir,
+		timestamp: args.timestamp,
+		status: "finished",
+		labels: {},
+		baseline: snapshotFromHoldout(0, record.baselineContentHash, args.baselineSurface, args.baselineOnHoldout),
+		generations: [snapshotFromHoldout(1, record.winnerContentHash, args.winnerSurface, args.winnerOnHoldout)],
+		gateDecision: args.gate.decision,
+		...record.heldOutLift !== void 0 ? { holdoutLift: record.heldOutLift } : {},
+		totalCostUsd: args.totalCostUsd,
+		totalDurationMs: args.totalDurationMs
+	};
+}
+/**
+* Build the provenance record + OTel spans and persist them durably under the
+* run dir (and ship spans to a hosted collector when one is wired). Returns
+* both artifacts so the caller can assert on / re-derive from them.
+*
+* Fail-loud: the durable write throws on storage failure (a swallowed write is
+* exactly the "emitted but lost" failure this closes). The hosted span ship is
+* the one best-effort leg — its failure is logged, not thrown, so an offline
+* collector never fails the loop (the durable artifact is the source of truth).
+*/
+async function emitLoopProvenance(args) {
+	const record = buildLoopProvenanceRecord(args);
+	const spans = loopProvenanceSpans(record);
+	args.storage.ensureDir(args.runDir);
+	const recordPath = provenanceRecordPath(args.runDir);
+	const spansPath = provenanceSpansPath(args.runDir);
+	args.storage.write(recordPath, JSON.stringify(record, null, 2));
+	args.storage.write(spansPath, spans.map((s) => JSON.stringify(s)).join("\n"));
+	if (args.hostedClient) {
+		try {
+			await args.hostedClient.ingestEvalRun(buildEvalRunEvent(args, record));
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			console.warn(`[agent-eval] hosted eval-run ingest failed (continuing): ${msg}`);
+		}
+		try {
+			await args.hostedClient.ingestTraces(spans);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			console.warn(`[agent-eval] provenance span ingest failed (continuing): ${msg}`);
+		}
+	}
+	return {
+		record,
+		spans,
+		recordPath,
+		spansPath
+	};
+}
+//#endregion
+//#region src/attestation.ts
+/**
+* Reproducibility attestation for any serializable report object.
+*
+* `attest()` binds a report to its content address (sha-256 over canonical
+* JSON) AND binds that address to the provenance needed to reproduce it:
+* model versions, seeds, price-table hash, code SHA, inputs hash. The outer
+* `envelopeHash` prevents provenance from being rewritten while leaving the
+* report hash valid.
+*
+* Layering: content-addressing is the substrate's job; cryptographic SIGNING
+* (who vouches for the attestation, key management, transparency logs) is the
+* consumer's layer on top. An `AttestedReport` is a stable byte-identical
+* payload a consumer can sign — the substrate never holds keys.
+*
+* Generic by design: the report parameter is ANY value `canonicalJson`
+* accepts (campaign results, fuzz capsules, scorecards, cost ledgers). Do not
+* couple this module to a specific report schema.
+*/
+/** Hash scheme identifier carried by every attestation. A verifier rejects
+* unknown algorithms instead of guessing. */
+const ATTESTATION_ALGORITHM = "sha256/canonical-json";
+function envelopeMaterial(reportHash, provenance, algorithm) {
+	return {
+		reportHash,
+		provenance,
+		algorithm
+	};
+}
+/**
+* Content-address a report and bind it to its provenance. Throws (via
+* `canonicalJson`) if the report or provenance contains undefined / function /
+* symbol / non-finite numbers — an attestation that cannot be unambiguously
+* serialized cannot be trusted.
+*/
+function attest(report, provenance) {
+	const reportHash = contentHash(report);
+	const algorithm = ATTESTATION_ALGORITHM;
+	return {
+		reportHash,
+		provenance,
+		algorithm,
+		envelopeHash: contentHash(envelopeMaterial(reportHash, provenance, algorithm))
+	};
+}
+/**
+* Verify a report against its attestation. Returns a typed outcome rather
+* than throwing: an unverifiable report (e.g. one that no longer
+* canonicalizes) is a verification failure with the cause in `reason`, not a
+* crash — verifiers run in pipelines that must record WHY, not die.
+*
+* Legacy attestations without `envelopeHash` remain readable, but verification
+* explicitly marks their provenance as unbound so a promotion path can refuse
+* them instead of accidentally treating old metadata as cryptographic proof.
+*/
+function verifyAttestation(report, attested) {
+	if (attested.algorithm !== "sha256/canonical-json") return {
+		valid: false,
+		reason: `unknown algorithm '${attested.algorithm}' — this verifier only checks '${ATTESTATION_ALGORITHM}'`
+	};
+	let recomputed;
+	try {
+		recomputed = contentHash(report);
+	} catch (err) {
+		return {
+			valid: false,
+			reason: `report is not canonicalizable: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+	if (recomputed !== attested.reportHash) return {
+		valid: false,
+		reason: `report hash mismatch: attested ${attested.reportHash}, recomputed ${recomputed}`
+	};
+	if (attested.envelopeHash === void 0) return {
+		valid: true,
+		legacyUnboundProvenance: true
+	};
+	let envelopeHash;
+	try {
+		envelopeHash = contentHash(envelopeMaterial(attested.reportHash, attested.provenance, attested.algorithm));
+	} catch (err) {
+		return {
+			valid: false,
+			reason: `attestation provenance is not canonicalizable: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+	if (envelopeHash !== attested.envelopeHash) return {
+		valid: false,
+		reason: `attestation envelope hash mismatch: attested ${attested.envelopeHash}, recomputed ${envelopeHash}`
+	};
+	return { valid: true };
+}
+//#endregion
+//#region src/experiment/evidence-receipt.ts
+/**
+* Evidence receipts are the join between Runtime execution and Eval promotion.
+*
+* Runtime says what actually ran. Eval says what independently measured it.
+* This receipt binds those worlds without making either package import the other:
+* stable pursuit/run identity, exact candidate/evaluator/environment/input/output
+* content identities, and the authority class that produced the observation.
+*
+* The payload is attested with agent-eval's existing canonical report attestation.
+* Signing/key management deliberately remains outside this substrate; consumers may
+* sign the byte-stable receipt or anchor its attestation in a transparency log.
+*/
+const EVIDENCE_RECEIPT_VERSION = "1.0.0";
+/** Closed promotion vocabulary. A typo or unknown future kind is never independent by default. */
+const EVIDENCE_AUTHORITY_KINDS = [
+	"candidate-self-report",
+	"independent-evaluator",
+	"independent-replication",
+	"human-review",
+	"production-canary"
+];
+const INDEPENDENT_EVIDENCE_AUTHORITY_KINDS = [
+	"independent-evaluator",
+	"independent-replication",
+	"human-review",
+	"production-canary"
+];
+/**
+* Mint a content-attested evidence receipt. Required identity fields are deliberately
+* non-optional: unknown evidence stays unknown and cannot accidentally look certified.
+* The attestation's input provenance must equal the receipt commitment so two competing
+* descriptions of the evaluated population cannot coexist inside one valid receipt.
+*/
+function createEvidenceReceipt(input, provenance) {
+	const inputSetCommitment = requiredIdentity(input.inputSetCommitment, "inputSetCommitment");
+	assertInputCommitment(provenance, inputSetCommitment);
+	const binding = Object.freeze({
+		schemaVersion: EVIDENCE_RECEIPT_VERSION,
+		pursuitId: requiredIdentity(input.pursuitId, "pursuitId"),
+		runId: requiredIdentity(input.runId, "runId"),
+		candidateDigest: requiredIdentity(input.candidateDigest, "candidateDigest"),
+		evaluatorDigest: requiredIdentity(input.evaluatorDigest, "evaluatorDigest"),
+		environmentDigest: requiredIdentity(input.environmentDigest, "environmentDigest"),
+		inputSetCommitment,
+		outputDigest: requiredIdentity(input.outputDigest, "outputDigest"),
+		resultDigest: requiredIdentity(input.resultDigest, "resultDigest"),
+		authority: requiredAuthority(input.authority),
+		...input.experimentDigest === void 0 ? {} : { experimentDigest: requiredIdentity(input.experimentDigest, "experimentDigest") },
+		...input.observerDigest === void 0 ? {} : { observerDigest: requiredIdentity(input.observerDigest, "observerDigest") }
+	});
+	return Object.freeze({
+		binding,
+		attestation: attest(binding, provenance)
+	});
+}
+/**
+* Verify promotion-grade evidence. Generic report attestation keeps a legacy read path,
+* but an EvidenceReceipt never accepts unbound provenance: changing the evaluator code,
+* model versions, input commitment provenance, or creation record must invalidate the
+* evidence rather than merely annotating it as legacy.
+*/
+function verifyEvidenceReceipt(receipt) {
+	if (receipt.binding.schemaVersion !== "1.0.0") return {
+		valid: false,
+		reason: `unsupported evidence receipt version '${receipt.binding.schemaVersion}'`
+	};
+	try {
+		for (const [field, value] of Object.entries({
+			pursuitId: receipt.binding.pursuitId,
+			runId: receipt.binding.runId,
+			candidateDigest: receipt.binding.candidateDigest,
+			evaluatorDigest: receipt.binding.evaluatorDigest,
+			environmentDigest: receipt.binding.environmentDigest,
+			inputSetCommitment: receipt.binding.inputSetCommitment,
+			outputDigest: receipt.binding.outputDigest,
+			resultDigest: receipt.binding.resultDigest
+		})) requiredIdentity(value, field);
+		requiredAuthority(receipt.binding.authority);
+		assertInputCommitment(receipt.attestation.provenance, receipt.binding.inputSetCommitment);
+	} catch (error) {
+		return {
+			valid: false,
+			reason: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const verification = verifyAttestation(receipt.binding, receipt.attestation);
+	if (!verification.valid) return verification;
+	if (verification.legacyUnboundProvenance === true || receipt.attestation.envelopeHash === void 0) return {
+		valid: false,
+		reason: "evidence receipt provenance is not bound by an attestation envelope"
+	};
+	return { valid: true };
+}
+/**
+* Promotion may choose a stricter policy, but this primitive makes the basic separation
+* explicit: only a recognized independent authority is independent. Unknown/forged kinds
+* and candidate self-reports both return false.
+*/
+function isIndependentEvidence(receipt) {
+	return INDEPENDENT_EVIDENCE_AUTHORITY_KINDS.includes(receipt.binding.authority?.kind);
+}
+function requiredAuthority(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new TypeError("evidence receipt: authority must be an object");
+	const authority = value;
+	if (typeof authority.kind !== "string" || !EVIDENCE_AUTHORITY_KINDS.includes(authority.kind)) throw new TypeError(`evidence receipt: unknown authority kind '${String(authority.kind)}'`);
+	if (typeof authority.id !== "string") throw new TypeError("evidence receipt: authority.id must be a string");
+	return Object.freeze({
+		kind: authority.kind,
+		id: requiredIdentity(authority.id, "authority.id")
+	});
+}
+function assertInputCommitment(provenance, inputSetCommitment) {
+	if (typeof provenance?.inputsHash !== "string" || provenance.inputsHash.trim().length === 0) throw new TypeError("evidence receipt: provenance.inputsHash is required");
+	if (provenance.inputsHash.trim() !== inputSetCommitment) throw new TypeError("evidence receipt: provenance.inputsHash must equal binding.inputSetCommitment");
+}
+function requiredIdentity(value, field) {
+	const normalized = value.trim();
+	if (normalized.length === 0) throw new TypeError(`evidence receipt: ${field} must be non-empty`);
+	return normalized;
+}
+//#endregion
+//#region src/experiment/campaign-evidence.ts
+/** Bind a complete measured campaign to its executed surface and actual outputs. */
+function createCampaignEvidenceReceipt(input) {
+	const { campaign, surface, context } = input;
+	assertCampaignSplitIdentity(campaign.scenarios, campaign.reps, campaign.splitDigest);
+	const coverage = campaignCoverage(campaign.cells, campaign.scenarios, campaign.reps, true);
+	if (campaign.scenarios.length === 0 || !coverage.complete) throw new Error("campaign evidence requires a complete, nonempty measurement");
+	const { provenance, ...binding } = context;
+	return createEvidenceReceipt({
+		...binding,
+		runId: campaign.runDir,
+		candidateDigest: surfaceContentHash(surface),
+		inputSetCommitment: campaign.splitDigest,
+		outputDigest: hashCanonical([...campaign.cells].sort((a, b) => a.cellId < b.cellId ? -1 : a.cellId > b.cellId ? 1 : 0).map((cell) => ({
+			cellId: cell.cellId,
+			artifact: cell.artifact
+		}))),
+		resultDigest: campaignMeasurementDigest(campaign)
+	}, {
+		...provenance,
+		inputsHash: campaign.splitDigest
+	});
+}
+//#endregion
+export { campaignScenarioIdentity as $, detectScale as A, componentSurfaceIdentityMaterial as B, campaignMeanCompositeOrNull as C, recoverTruncatedJson as D, parseReflectionResponse as E, pairedDecisionShape as F, surfaceHashMatches as G, surfaceContentHash as H, minimumPairsForPairedDeltaTest as I, summarizeBackendIntegrity as J, BackendIntegrityError as K, pairedDeltaTest as L, heldoutSignificance as M, pairHoldout as N, powerPreflight as O, decidePairedPromotion as P, campaignCoverage as Q, assertCodeSurfaceIdentity as R, campaignMeanComposite as S, buildReflectionPrompt as T, surfaceDispatchRef as U, renderSurfaceDiff as V, surfaceHash as W, assertCampaignSplitIdentity as X, assertCampaignDesign as Y, assertCompleteCampaign as Z, provenanceRecordPath as _, createEvidenceReceipt as a, assertFiniteRankKey as b, ATTESTATION_ALGORITHM as c, buildLoopProvenanceRecord as d, campaignSplitDigest as et, campaignMeasurementDigest as f, loopProvenanceSpans as g, loopProvenanceArgsFromResult as h, INDEPENDENT_EVIDENCE_AUTHORITY_KINDS as i, dimensionRegressions as j, TIE_WARN_FRACTION as k, attest as l, emitLoopProvenance as m, EVIDENCE_AUTHORITY_KINDS as n, formatCoverageFailures as nt, isIndependentEvidence as o, canonicalDigest as p, assertRealBackend as q, EVIDENCE_RECEIPT_VERSION as r, verifyEvidenceReceipt as s, createCampaignEvidenceReceipt as t, campaignSplitDigestFromIdentities as tt, verifyAttestation as u, provenanceSpansPath as v, compareRankKeys as w, campaignBreakdown as x, verifyLoopProvenanceRecord as y, codeSurfaceIdentityMaterial as z };
+
+//# sourceMappingURL=campaign-evidence-D8DBLqLI.js.map