@tangle-network/agent-eval 0.180.0 → 0.181.0

package/dist/{llm-judge-v80Kmu9g.js → llm-judge-DEFZeSiu.js}

@@ -1,14 +1,14 @@
 import { i as JudgeError, s as ValidationError } from "./errors-Dngq5h35.js";
-import { a as hashCanonical, i as compareCodeUnits, r as canonicalString } from "./canonical-DPyQ_rpt.js";
+import { a as hashCanonical, i as compareCodeUnits, r as canonicalString, t as LEDGER_HASH_PATTERN } from "./canonical-DPyQ_rpt.js";
 import { o as summarizeNumberSeries, s as weightedComposite, t as confidenceInterval } from "./descriptive-1V17A-qa.js";
-import { r as pairedBootstrap } from "./paired-tests-C8iCsioC.js";
-import { i as modelHasSnapshot } from "./run-record-DQpSf7t-.js";
+import { o as projectCampaignCellQuality, s as decidePairedPromotion, t as campaignCellCostProvenance } from "./run-record-Br-Yzt_k.js";
+import { $ as formatCoverageFailures, A as FinalEvidenceConflictError, B as surfaceDispatchRef, C as campaignMeanCompositeOrNull, H as surfaceHashMatches, J as assertCompleteCampaign, K as assertCampaignDesign, N as defineEvaluationClaim, P as summarizeEvaluationUnits, R as renderSurfaceDiff, S as campaignMeanComposite, U as BackendIntegrityError, V as surfaceHash, X as campaignScenarioIdentity, Y as campaignCoverage, Z as campaignSplitDigest, at as pairHoldout, b as assertFiniteRankKey, it as heldoutSignificance, j as FinalEvidenceError, q as assertCampaignSplitIdentity, rt as dimensionRegressions, t as createCampaignEvidenceReceipt, w as compareRankKeys, x as campaignBreakdown, z as surfaceContentHash } from "./campaign-evidence-B8oF9xQ6.js";
+import { i as modelHasSnapshot } from "./run-record-DualPTn2.js";
 import { n as contentHash } from "./verdict-cache-B3eCVQtY.js";
-import { o as projectCampaignCellQuality, t as campaignCellCostProvenance } from "./run-record-CR63CpHK.js";
 import { i as CostLedger, t as CostAccountingIncompleteError } from "./cost-ledger-B1qx30B4.js";
-import { $ as campaignScenarioIdentity, C as campaignMeanCompositeOrNull, G as surfaceHashMatches, H as surfaceContentHash, K as BackendIntegrityError, M as heldoutSignificance, N as pairHoldout, Q as campaignCoverage, S as campaignMeanComposite, U as surfaceDispatchRef, V as renderSurfaceDiff, W as surfaceHash, X as assertCampaignSplitIdentity, Y as assertCampaignDesign, Z as assertCompleteCampaign, b as assertFiniteRankKey, et as campaignSplitDigest, j as dimensionRegressions, nt as formatCoverageFailures, t as createCampaignEvidenceReceipt, w as compareRankKeys, x as campaignBreakdown } from "./campaign-evidence-D8DBLqLI.js";
-import { d as mapConcurrent, n as replayLedgerText, t as FileLedgerJournal } from "./ledger-core-Cs9f7385.js";
-import { D as SearchLedgerIntegrityError, E as SearchLedgerError, S as fsCampaignStorage, T as SearchLedgerConflictError, g as isRecord, h as isExternalTextCandidate, w as SEARCH_LEDGER_FILE_CONTEXT, x as createRunCostLedger } from "./external-optimizer-subprocess-q3VzlGAO.js";
+import { d as mapConcurrent, n as replayLedgerText, t as FileLedgerJournal } from "./journal-Cs9f7385.js";
+import "./ledger-core/index.js";
+import { D as SearchLedgerIntegrityError, E as SearchLedgerError, S as fsCampaignStorage, T as SearchLedgerConflictError, g as isRecord, h as isExternalTextCandidate, w as SEARCH_LEDGER_FILE_CONTEXT, x as createRunCostLedger } from "./external-optimizer-subprocess-D4dzUBZI.js";
 import { t as DEFAULT_REDACTION_RULES } from "./redact-7Aq1ukl-.js";
 import { t as detectRewardHacking } from "./reward-hacking-D0XwhVWE.js";
 import { n as assertProposalFindings, t as combineAbortSignals } from "./abort-signal-CtzAM_sJ.js";
@@ -975,6 +975,75 @@ async function runEval(opts) {
 	return runCampaign(opts);
 }
 //#endregion
+//#region src/campaign/final-evidence.ts
+/** Capture identities before an asynchronous search can mutate its caller's options. */
+function captureFinalEvidencePolicy(policy) {
+	return Object.freeze({
+		ledger: policy.ledger,
+		requestId: policy.requestId,
+		evaluatorDigest: policy.evaluatorDigest
+	});
+}
+function evaluationUnitMap(claim, scenarios) {
+	const map = /* @__PURE__ */ new Map();
+	for (const scenario of scenarios) {
+		const unit = summarizeEvaluationUnits(claim, [scenario]).units[0];
+		if (!unit) throw new ValidationError("final evidence has a scenario without an independent unit");
+		if (map.has(scenario.id)) throw new ValidationError(`duplicate final scenario '${scenario.id}'`);
+		map.set(scenario.id, unit.id);
+	}
+	return map;
+}
+/** Shared source variants cannot serve as unseen-unit evidence after development. */
+function assertIndependentEvaluationSplit(claim, finalScenarios, developmentScenarios) {
+	const finalUnitIds = new Set(evaluationUnitMap(claim, finalScenarios).values());
+	const overlap = summarizeEvaluationUnits(claim, developmentScenarios).units.filter((unit) => finalUnitIds.has(unit.id));
+	if (overlap.length) throw new ValidationError(`development and final evidence share independent units: ${overlap.map((unit) => unit.id).join(", ")}`);
+}
+/** Reserve before search. An identical retry may resume until final data is exposed. */
+async function reserveFinalEvidence(policy, claimInput, scenarios, developmentScenarios = []) {
+	policy = captureFinalEvidencePolicy(policy);
+	if (claimInput === void 0) throw new ValidationError("fresh final evidence requires an evaluation claim");
+	const claim = defineEvaluationClaim(claimInput);
+	if (claim.use === "development") throw new ValidationError("final evidence requires a comparison or certification claim");
+	if (!LEDGER_HASH_PATTERN.test(policy.evaluatorDigest)) throw new ValidationError("final evidence requires the evaluator content digest");
+	const units = evaluationUnitMap(claim, scenarios);
+	const finalUnitIds = new Set(units.values());
+	assertIndependentEvaluationSplit(claim, scenarios, developmentScenarios);
+	const result = await policy.ledger.reserve({
+		requestId: policy.requestId,
+		claimDigest: hashCanonical({
+			claim,
+			evaluatorDigest: policy.evaluatorDigest
+		}),
+		populationId: claim.population.id,
+		inputDigest: hashCanonical([...scenarios].sort((a, b) => compareCodeUnits(a.id, b.id))),
+		unitIds: [...finalUnitIds].sort(compareCodeUnits)
+	});
+	if (!result.succeeded) throw new FinalEvidenceError(result.error.kind, result.error.message);
+	if (result.value.record.exposure !== null) throw new FinalEvidenceConflictError(`final evidence for '${policy.requestId}' was already exposed; read its recorded result or use fresh evidence`);
+	return {
+		claim,
+		record: result.value.record
+	};
+}
+/** Append exposure before dispatch, so a failed or interrupted measurement still consumes evidence. */
+async function exposeFinalEvidence(policy, claim, scenarios, surfaces) {
+	policy = captureFinalEvidencePolicy(policy);
+	const measurement = {
+		evaluatorDigest: policy.evaluatorDigest,
+		candidateDigests: surfaces.map((surface) => hashCanonical(surface))
+	};
+	const reserved = await reserveFinalEvidence(policy, claim, scenarios);
+	const result = await policy.ledger.expose(policy.requestId, measurement);
+	if (!result.succeeded) throw new FinalEvidenceError(result.error.kind, result.error.message);
+	if (result.value.replayed) throw new FinalEvidenceConflictError(`final evidence for '${policy.requestId}' is already being measured`);
+	return {
+		claim: reserved.claim,
+		record: result.value.record
+	};
+}
+//#endregion
 //#region src/canary.ts
 /**
 * Run all configured canaries against a chronological run list.
@@ -1790,6 +1859,12 @@ function defaultProductionGate(options) {
 	const minProductiveRuns = options.minProductiveRuns ?? 3;
 	const heldoutStatistic = options.heldoutStatistic ?? "mean";
 	const explicitlyRequired = new Set(options.requiredChecks ?? []);
+	const scenarioIds = new Set(options.holdoutScenarios.map((scenario) => scenario.id));
+	const independentUnitByScenarioId = options.independentUnitByScenarioId === void 0 ? void 0 : new Map(options.independentUnitByScenarioId);
+	if (independentUnitByScenarioId !== void 0) for (const id of scenarioIds) {
+		const unit = independentUnitByScenarioId.get(id);
+		if (typeof unit !== "string" || unit.length === 0 || unit.trim() !== unit) throw new Error(`defaultProductionGate: missing independent unit for holdout scenario '${id}'`);
+	}
 	return {
 		name: "defaultProductionGate",
 		async decide(ctx) {
@@ -1811,7 +1886,6 @@ function defaultProductionGate(options) {
 					reasons.push(`${name}: ${reason}`);
 				}
 			};
-			const scenarioIds = new Set(options.holdoutScenarios.map((s) => s.id));
 			let delta;
 			if (!ctx.baselineJudgeScores) unavailable("heldout-significance", true, "baselineJudgeScores is required for a held-out comparison");
 			else {
@@ -1821,7 +1895,8 @@ function defaultProductionGate(options) {
 					confidence,
 					resamples,
 					seed,
-					statistic: heldoutStatistic
+					statistic: heldoutStatistic,
+					independentUnitByScenarioId
 				});
 				const dec = sig.decision;
 				delta = dec.delta;
@@ -1831,6 +1906,9 @@ function defaultProductionGate(options) {
 					status: sig.fewRuns ? "not_evaluated" : heldoutPass ? "pass" : "fail",
 					detail: {
 						n: sig.n,
+						pairedCellN: sig.pairedCellN,
+						observationUnit: sig.observationUnit,
+						unitIds: sig.unitIds,
 						delta,
 						decisionStatistic: sig.decisionStatistic,
 						decisionMethod: sig.decisionMethod,
@@ -1852,9 +1930,9 @@ function defaultProductionGate(options) {
 				});
 				if (sig.fewRuns) requiredUnavailable.add("heldout-significance");
 				if (!heldoutPass) {
-					const tieNote = sig.tieFraction >= .4 ? `; ${(sig.tieFraction * 100).toFixed(0)}% tied scenarios` : "";
+					const tieNote = sig.tieFraction >= .4 ? `; ${(sig.tieFraction * 100).toFixed(0)}% tied observation units` : "";
 					const ci = `${(dec.confidence * 100).toFixed(0)}% CI [${dec.low.toFixed(3)}, ${dec.high.toFixed(3)}]`;
-					reasons.push(sig.fewRuns ? `held-out: only ${sig.n} paired runs (< ${sig.minimumRequired}) — too few to claim significance` : dec.indeterminate ? `held-out: ${dec.indeterminateCause}, so the paired CI is ${ci} and carries no direction — it cannot clear threshold ${deltaThreshold} on evidence${tieNote}` : dec.exactTestVetoes ? `held-out: McNemar exact p=${dec.mcnemar?.pValue.toExponential(2)} does not reject at α=${(1 - dec.confidence).toFixed(4)} (${dec.label} Δ ${delta.toFixed(3)}, ${ci}${tieNote})` : `held-out CI.low ${dec.low.toFixed(3)} ≤ threshold ${deltaThreshold} (${dec.label} Δ ${delta.toFixed(3)}, ${ci}${tieNote})`);
+					reasons.push(sig.fewRuns ? `held-out: only ${sig.n} paired observation units (< ${sig.minimumRequired}) — too few to claim significance` : dec.indeterminate ? `held-out: ${dec.indeterminateCause}, so the paired CI is ${ci} and carries no direction — it cannot clear threshold ${deltaThreshold} on evidence${tieNote}` : dec.exactTestVetoes ? `held-out: McNemar exact p=${dec.mcnemar?.pValue.toExponential(2)} does not reject at α=${(1 - dec.confidence).toFixed(4)} (${dec.label} Δ ${delta.toFixed(3)}, ${ci}${tieNote})` : dec.method === "exact-sign" ? `held-out: exact one-sided sign test p=${dec.pValue} does not reject at α=${((1 - dec.confidence) / 2).toFixed(4)} (${dec.label} Δ ${delta.toFixed(3)}, diagnostic ${ci}${tieNote})` : `held-out CI.low ${dec.low.toFixed(3)} ≤ threshold ${deltaThreshold} (${dec.label} Δ ${delta.toFixed(3)}, ${ci}${tieNote})`);
 				}
 			}
 			const dimensionsProvided = options.criticalDimensions !== void 0;
@@ -1868,18 +1946,22 @@ function defaultProductionGate(options) {
 					tolerance: options.regressionTolerance,
 					confidence,
 					resamples,
-					seed
+					seed,
+					independentUnitByScenarioId,
+					minProductiveRuns
 				});
 				const measured = new Set(dimRegs.map((result) => result.dimension));
 				const missingDimensions = criticalDimensions.filter((dimension) => !measured.has(dimension));
 				const regressed = dimRegs.filter((result) => result.regressed);
-				const dimensionStatus = regressed.length > 0 ? "fail" : missingDimensions.length > 0 ? "not_evaluated" : "pass";
+				const incompleteDimensions = dimRegs.filter((result) => result.fewRuns || result.missingCellIds.length > 0 || result.missingScenarioIds.length > 0);
+				const dimensionStatus = regressed.length > 0 ? "fail" : missingDimensions.length > 0 || incompleteDimensions.length > 0 ? "not_evaluated" : "pass";
 				contributing.push({
 					name: "dimension-regression",
 					status: dimensionStatus,
 					detail: {
 						guarded: criticalDimensions,
 						missingDimensions,
+						incompleteDimensions: incompleteDimensions.map((result) => result.dimension),
 						regressions: dimRegs.map((result) => ({
 							dimension: result.dimension,
 							ciLow: result.ci.low,
@@ -1890,6 +1972,12 @@ function defaultProductionGate(options) {
 							median: result.bootstrap.median,
 							tolerance: result.tolerance,
 							n: result.n,
+							pairedCellN: result.pairedCellN,
+							observationUnit: result.observationUnit,
+							minimumRequired: result.minimumRequired,
+							fewRuns: result.fewRuns,
+							missingCellIds: result.missingCellIds,
+							missingScenarioIds: result.missingScenarioIds,
 							regressed: result.regressed
 						}))
 					}
@@ -1898,7 +1986,11 @@ function defaultProductionGate(options) {
 					requiredUnavailable.add("dimension-regression");
 					reasons.push(`critical dimension(s) were not scored: ${missingDimensions.join(", ")}`);
 				}
-				if (regressed.length > 0) reasons.push(`critical dimension(s) regressed: ${regressed.map((result) => `${result.dimension} CI.low ${result.ci.low.toFixed(3)} < -${result.tolerance}`).join("; ")}`);
+				if (incompleteDimensions.length > 0) {
+					requiredUnavailable.add("dimension-regression");
+					reasons.push(`critical dimension evidence is incomplete: ${incompleteDimensions.map((result) => `${result.dimension} has ${result.n} paired observation units (minimum ${result.minimumRequired}), ${result.missingCellIds.length} unscored cells, ${result.missingScenarioIds.length} unscored scenarios`).join("; ")}`);
+				}
+				if (regressed.length > 0) reasons.push(`critical dimension(s) regressed: ${regressed.map((result) => result.bootstrap.low < -result.tolerance ? `${result.dimension} bootstrap CI.low ${result.bootstrap.low.toFixed(3)} < -${result.tolerance}` : `${result.dimension} paired test supports a drop greater than ${result.tolerance}`).join("; ")}`);
 			}
 			const budgetUsd = options.budgetUsd;
 			const budgetConfigured = budgetUsd !== void 0;
@@ -2050,6 +2142,29 @@ function extractText(artifact) {
 	}
 }
 //#endregion
+//#region src/campaign/judge-snapshot.ts
+/** Capture configuration and callbacks; receiver and closed-over state remain caller-owned. */
+function captureJudge(judge) {
+	const dimensions = judge.dimensions.map((dimension) => Object.freeze({
+		key: dimension.key,
+		description: dimension.description
+	}));
+	Object.freeze(dimensions);
+	const captured = {
+		name: judge.name,
+		judgeVersion: judge.judgeVersion,
+		dimensions,
+		score: judge.score,
+		appliesTo: judge.appliesTo
+	};
+	return Object.freeze({
+		...captured,
+		judgeVersion: judgeVersionFor(captured),
+		score: captured.score.bind(judge),
+		appliesTo: captured.appliesTo?.bind(judge)
+	});
+}
+//#endregion
 //#region src/campaign/auto-pr.ts
 /**
 * `openAutoPr` — thin shell-out helper for the `runImprovementLoop` preset's
@@ -2180,6 +2295,12 @@ function quoteArg(arg) {
 //#region src/campaign/presets/run-final-comparison.ts
 /** Compare a search-selected surface without changing the search's selection. */
 async function runFinalComparison(opts) {
+	opts = {
+		...opts,
+		judges: opts.judges?.map(captureJudge),
+		claim: opts.claim && defineEvaluationClaim(opts.claim),
+		finalEvidence: opts.finalEvidence && captureFinalEvidencePolicy(opts.finalEvidence)
+	};
 	const storage = opts.storage ?? fsCampaignStorage();
 	const costLedger = opts.costLedger ?? createRunCostLedger({
 		storage,
@@ -2193,6 +2314,13 @@ async function runFinalComparison(opts) {
 	const finalScenarios = structuredClone(opts.scenarios);
 	const winnerIsBaseline = surfaceHash(winnerSurface) === surfaceHash(baselineSurface);
 	const holdoutDeferred = (opts.holdout ?? "measured") === "deferred";
+	if (opts.finalEvidence && holdoutDeferred) throw new Error("final evidence requires a measured comparison");
+	const controlSurface = opts.neutralize && !winnerIsBaseline && !holdoutDeferred ? structuredClone(opts.neutralize(structuredClone(winnerSurface), structuredClone(baselineSurface))) : void 0;
+	const finalEvidence = opts.finalEvidence ? await exposeFinalEvidence(opts.finalEvidence, opts.claim, finalScenarios, [
+		baselineSurface,
+		winnerSurface,
+		...controlSurface === void 0 ? [] : [controlSurface]
+	]) : void 0;
 	const baselineOnHoldout = holdoutDeferred ? await runCampaign({
 		...opts,
 		labeledStore: "off",
@@ -2251,8 +2379,8 @@ async function runFinalComparison(opts) {
 	let neutralizedJudgeScores;
 	let neutralizedOnHoldout;
 	let neutralizedSurface;
-	if (opts.neutralize && !winnerIsBaseline && !holdoutDeferred) {
-		const surface = opts.neutralize(structuredClone(winnerSurface), structuredClone(baselineSurface));
+	if (controlSurface !== void 0) {
+		const surface = controlSurface;
 		neutralizedSurface = surface;
 		neutralizedOnHoldout = await runCampaign({
 			...opts,
@@ -2308,6 +2436,8 @@ async function runFinalComparison(opts) {
 	});
 	const promotedDiff = surfaceHash(winnerSurface) === surfaceHash(baselineSurface) ? "" : renderSurfaceDiff(winnerSurface, baselineSurface);
 	return {
+		...opts.claim ? { claim: opts.claim } : {},
+		...finalEvidence ? { finalEvidence } : {},
 		baselineOnHoldout,
 		winnerOnHoldout,
 		...neutralizedOnHoldout && neutralizedSurface ? {
@@ -2399,391 +2529,15 @@ function paretoFrontierWithCrowding(candidates, objectives) {
 	return crowdingDistance(frontier, objectives).sort((a, b) => b.distance - a.distance);
 }
 //#endregion
-//#region src/campaign/search-ledger.ts
-/**
-* Durable append-only audit log for improvement searches.
-*
-* Existing campaign artifacts keep their own rich records: `RunRecord` owns a
-* measured run and `CostLedger` owns per-call accounting. This ledger does not
-* copy those structures. It binds their immutable ids and receipts into one replayable event stream so a
-* search can answer, after a crash, exactly which candidates and task attempts
-* existed, which surfaces actually fired, what they cost, and why they were
-* selected or rejected.
-*
-* The file format is canonical JSONL with a SHA-256 hash chain. Every append is
-* serialized across processes, fsynced before acknowledgement, and idempotent
-* by `eventId`. A malformed, non-canonical, truncated, reordered, or conflicting
-* log fails loudly; the implementation never skips a bad row.
-*
-* The journal machinery itself (hash chain, locking, fsync, idempotent append)
-* is the generic `ledger-core` journal; this module supplies the campaign
-* codec: event schemas, canonical event ordering, and the search state machine.
-*/
-const SEARCH_LEDGER_SCHEMA = "tangle.search-ledger.v1";
-const NON_EMPTY = z.string().min(1).refine((value) => value.trim() === value, "must not contain surrounding whitespace");
-const HASH = z.string().regex(/^sha256:[a-f0-9]{64}$/);
-const LINEAGE_NODE_ID = z.string().regex(/^[a-f0-9]{16}$/);
-const IMMUTABLE_REVISION = z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|sha256:[a-f0-9]{64}|sha512:[A-Za-z0-9+/=]+)$/);
-const ISO_TIMESTAMP = z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/).refine((value) => Number.isFinite(Date.parse(value)), "invalid timestamp");
-const NON_NEGATIVE_INT = z.number().int().nonnegative().safe();
-const FINITE_NUMBER = z.number().finite();
-const ArtifactRefSchema = z.object({
-	role: NON_EMPTY,
-	uri: NON_EMPTY,
-	sha256: HASH,
-	byteLength: NON_NEGATIVE_INT
-}).strict();
-const SourceRefSchema = z.object({
-	uri: NON_EMPTY,
-	revision: IMMUTABLE_REVISION
-}).strict();
-const FailureReasonSchema = z.object({
-	code: NON_EMPTY,
-	message: NON_EMPTY
-}).strict();
-const EventBaseShape = {
-	eventId: NON_EMPTY,
-	occurredAt: ISO_TIMESTAMP,
-	artifacts: z.array(ArtifactRefSchema).min(1)
-};
-const OperationKindSchema = z.enum([
-	"candidate-generation",
-	"analysis",
-	"selection",
-	"judge",
-	"other"
-]);
-const CandidateSlotSchema = z.object({
-	slotId: NON_EMPTY,
-	generationOperationId: NON_EMPTY
-}).strict();
-const PlannedOperationSchema = z.object({
-	operationId: NON_EMPTY,
-	kind: OperationKindSchema
-}).strict();
-const SearchPlanExtendedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("search-plan-extended"),
-	extension: z.object({
-		candidateSlots: z.array(CandidateSlotSchema),
-		operations: z.array(PlannedOperationSchema)
-	}).strict().superRefine((extension, ctx) => {
-		if (extension.candidateSlots.length === 0 && extension.operations.length === 0) ctx.addIssue({
-			code: "custom",
-			message: "a plan extension must add slots or operations"
-		});
-	})
-}).strict();
-const SearchPlannedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("search-planned"),
-	plan: z.object({
-		candidateSlots: z.array(CandidateSlotSchema).min(1),
-		tasks: z.array(z.object({
-			taskId: NON_EMPTY,
-			source: SourceRefSchema,
-			benchmark: SourceRefSchema,
-			maxAttempts: z.number().int().positive().safe()
-		}).strict()).min(1),
-		operations: z.array(PlannedOperationSchema).min(1)
-	}).strict()
-}).strict();
-const CandidateRegisteredSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("candidate-registered"),
-	slotId: NON_EMPTY,
-	generationOperationId: NON_EMPTY,
-	candidateId: NON_EMPTY,
-	lineage: z.object({
-		lineageNodeId: LINEAGE_NODE_ID,
-		parentCandidateIds: z.array(NON_EMPTY),
-		generation: NON_NEGATIVE_INT,
-		proposer: NON_EMPTY,
-		proposerSource: SourceRefSchema
-	}).strict(),
-	surfaces: z.array(z.object({
-		surfaceId: NON_EMPTY,
-		kind: z.enum([
-			"prompt",
-			"tool-contract",
-			"runtime-config",
-			"memory",
-			"knowledge",
-			"agent-profile",
-			"code",
-			"deployment"
-		]),
-		artifact: ArtifactRefSchema
-	}).strict()).min(1)
-}).strict();
-const CandidateSlotClosedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("candidate-slot-closed"),
-	slotId: NON_EMPTY,
-	generationOperationId: NON_EMPTY,
-	reason: FailureReasonSchema
-}).strict();
-const KnownTokensSchema = z.object({
-	status: z.literal("known"),
-	inputTokens: NON_NEGATIVE_INT,
-	outputTokens: NON_NEGATIVE_INT,
-	cachedTokens: NON_NEGATIVE_INT
-}).strict();
-const UnknownSchema = z.object({
-	status: z.literal("unknown"),
-	reason: NON_EMPTY
-}).strict();
-const KnownCostSchema = z.object({
-	status: z.literal("known"),
-	usd: z.number().finite().nonnegative(),
-	source: z.enum([
-		"provider",
-		"pricing-table",
-		"free"
-	])
-}).strict().superRefine((cost, ctx) => {
-	if (cost.source === "free" && cost.usd !== 0) ctx.addIssue({
-		code: "custom",
-		message: "free cost source must have usd 0"
-	});
-});
-const UnknownCostSchema = z.object({
-	status: z.literal("unknown"),
-	knownLowerBoundUsd: z.number().finite().nonnegative(),
-	reason: NON_EMPTY
-}).strict();
-const AccountingSchema = z.object({
-	tokens: z.discriminatedUnion("status", [KnownTokensSchema, UnknownSchema]),
-	cost: z.discriminatedUnion("status", [KnownCostSchema, UnknownCostSchema])
-}).strict();
-const MetricsSchema = z.record(NON_EMPTY, FINITE_NUMBER).superRefine((metrics, ctx) => {
-	for (const key of Object.keys(metrics)) if (key === "__proto__" || key === "constructor" || key === "prototype") ctx.addIssue({
-		code: "custom",
-		message: `unsafe metric key ${key}`
-	});
-});
-const OutcomeSchema = z.discriminatedUnion("status", [
-	z.object({
-		status: z.literal("passed"),
-		score: FINITE_NUMBER,
-		metrics: MetricsSchema
-	}).strict(),
-	z.object({
-		status: z.literal("failed"),
-		score: FINITE_NUMBER,
-		metrics: MetricsSchema,
-		failure: FailureReasonSchema
-	}).strict(),
-	z.object({
-		status: z.literal("errored"),
-		metrics: MetricsSchema,
-		error: FailureReasonSchema.extend({ retryable: z.boolean() }).strict()
-	}).strict()
-]);
-const EffectSchema = z.discriminatedUnion("status", [z.object({
-	status: z.literal("measured"),
-	metric: NON_EMPTY,
-	baselineValue: FINITE_NUMBER,
-	candidateValue: FINITE_NUMBER,
-	delta: FINITE_NUMBER
-}).strict().superRefine((effect, ctx) => {
-	const expected = effect.candidateValue - effect.baselineValue;
-	const tolerance = Number.EPSILON * Math.max(1, Math.abs(expected), Math.abs(effect.delta)) * 8;
-	if (Math.abs(effect.delta - expected) > tolerance) ctx.addIssue({
-		code: "custom",
-		message: "delta must equal candidateValue - baselineValue"
-	});
-}), z.object({
-	status: z.literal("not-measured"),
-	reason: NON_EMPTY
-}).strict()]);
-const SurfaceEvidenceSchema = z.object({
-	surfaceId: NON_EMPTY,
-	fired: z.boolean(),
-	firingCount: NON_NEGATIVE_INT,
-	effect: EffectSchema,
-	evidence: z.array(ArtifactRefSchema).min(1)
-}).strict().superRefine((evidence, ctx) => {
-	if (evidence.fired && evidence.firingCount === 0) ctx.addIssue({
-		code: "custom",
-		message: "a fired surface must have firingCount >= 1"
-	});
-	if (!evidence.fired && evidence.firingCount !== 0) ctx.addIssue({
-		code: "custom",
-		message: "a surface that did not fire must have firingCount 0"
-	});
-	if (!evidence.fired && evidence.effect.status === "measured" && evidence.effect.delta !== 0) ctx.addIssue({
-		code: "custom",
-		message: "a surface that did not fire cannot claim non-zero effect"
-	});
-});
-const TaskAttemptedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("task-attempted"),
-	candidateId: NON_EMPTY,
-	runId: NON_EMPTY,
-	attemptIndex: NON_NEGATIVE_INT,
-	task: z.object({
-		taskId: NON_EMPTY,
-		source: SourceRefSchema
-	}).strict(),
-	identity: z.object({
-		model: z.object({
-			provider: NON_EMPTY,
-			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
-		}).strict(),
-		agent: SourceRefSchema,
-		benchmark: SourceRefSchema
-	}).strict(),
-	outcome: OutcomeSchema,
-	accounting: AccountingSchema,
-	surfaceEvidence: z.array(SurfaceEvidenceSchema).min(1)
-}).strict();
-const SearchOperationRecordedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("search-operation-recorded"),
-	operationId: NON_EMPTY,
-	operationKind: OperationKindSchema,
-	execution: z.discriminatedUnion("kind", [z.object({
-		kind: z.literal("model"),
-		model: z.object({
-			provider: NON_EMPTY,
-			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
-		}).strict(),
-		source: SourceRefSchema
-	}).strict(), z.object({
-		kind: z.literal("deterministic"),
-		source: SourceRefSchema
-	}).strict()]),
-	outcome: z.discriminatedUnion("status", [
-		z.object({ status: z.literal("completed") }).strict(),
-		z.object({
-			status: z.literal("partial"),
-			failure: FailureReasonSchema
-		}).strict(),
-		z.object({
-			status: z.literal("failed"),
-			failure: FailureReasonSchema
-		}).strict()
-	]),
-	accounting: AccountingSchema
-}).strict();
-const CandidateDecidedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("candidate-decided"),
-	candidateId: NON_EMPTY,
-	decision: z.discriminatedUnion("status", [z.object({ status: z.literal("selected") }).strict(), z.object({
-		status: z.literal("rejected"),
-		reason: FailureReasonSchema
-	}).strict()])
-}).strict();
-const SearchCompletedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("search-completed"),
-	result: z.discriminatedUnion("status", [z.object({
-		status: z.literal("selected"),
-		candidateId: NON_EMPTY
-	}).strict(), z.object({
-		status: z.literal("all-rejected"),
-		reason: FailureReasonSchema
-	}).strict()])
-}).strict();
-const EventSchema = z.discriminatedUnion("kind", [
-	SearchPlannedSchema,
-	SearchPlanExtendedSchema,
-	CandidateRegisteredSchema,
-	CandidateSlotClosedSchema,
-	TaskAttemptedSchema,
-	SearchOperationRecordedSchema,
-	CandidateDecidedSchema,
-	SearchCompletedSchema
-]);
-const EntrySchema = z.object({
-	schema: z.literal(SEARCH_LEDGER_SCHEMA),
-	campaignId: NON_EMPTY,
-	sequence: NON_NEGATIVE_INT,
-	previousHash: z.union([HASH, z.null()]),
-	event: EventSchema,
-	entryHash: HASH
-}).strict();
-/** Validate and return a canonical copy. Arrays whose order is not semantic are
-* sorted so retries from different processes produce byte-identical events. */
-function validateSearchLedgerEvent(input) {
-	const parsed = EventSchema.safeParse(input);
-	if (!parsed.success) throw new SearchLedgerError(`invalid search ledger event: ${formatZodError(parsed.error)}`);
-	return normalizeEvent(parsed.data);
-}
-/** Open a durable filesystem search ledger. Construction performs no I/O; the
-* first `append` or `replay` validates the complete existing file. */
-function openSearchLedger(options) {
-	if (options.path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
-	return new FileSearchLedger(options.path, options.campaignId, options.trustedHead);
-}
-/** Replay immutable search-ledger JSONL through the same codec as FileSearchLedger. */
-function replaySearchLedgerText(text, campaignId, source) {
-	return replayLedgerText(text, source, searchLedgerCodec(campaignId)).projection;
-}
-function searchLedgerCodec(campaignId) {
-	return {
-		...SEARCH_LEDGER_FILE_CONTEXT,
-		header: {
-			schema: SEARCH_LEDGER_SCHEMA,
-			campaignId
-		},
-		conflictError: (message) => new SearchLedgerConflictError(message),
-		parseEntry: parseSearchLedgerEntry,
-		checkEntryHeader: (entry, index) => {
-			if (entry.campaignId !== campaignId) throw new SearchLedgerIntegrityError(`entry ${index} belongs to campaign ${entry.campaignId}, expected ${campaignId}`);
-		},
-		createProjector: () => createSearchLedgerProjector(campaignId)
-	};
+//#region src/campaign/search-ledger-ordering.ts
+function artifactKey(artifact) {
+	return canonicalString(artifact);
 }
-/** Append-only file-backed search ledger with idempotent writes and replay. */
-var FileSearchLedger = class {
-	path;
-	campaignId;
-	trustedHeadPath;
-	trustedHeadMode;
-	journal;
-	constructor(path, campaignId, trustedHead = "pin") {
-		if (path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
-		if (campaignId.length === 0) throw new SearchLedgerError("campaignId is empty");
-		if (campaignId.trim() !== campaignId) throw new SearchLedgerError("campaignId must not contain surrounding whitespace");
-		this.campaignId = campaignId;
-		this.trustedHeadMode = trustedHead;
-		this.journal = new FileLedgerJournal(path, searchLedgerCodec(campaignId), { requireTrustedHead: trustedHead === "require" });
-		this.path = this.journal.path;
-		this.trustedHeadPath = this.journal.trustedHeadPath;
-	}
-	async replay() {
-		return (await this.journal.replay()).projection;
-	}
-	async append(input) {
-		const event = validateSearchLedgerEvent(input);
-		const { entry, appended, projection } = await this.journal.append(event, { pinHead: this.trustedHeadMode !== "off" });
-		return {
-			entry,
-			appended,
-			replay: projection
-		};
-	}
-	async trustedHead() {
-		return this.journal.trustedHead();
-	}
-	async pinTrustedHead() {
-		return this.journal.pinTrustedHead();
-	}
-	async clearTrustedHead() {
-		return this.journal.clearTrustedHead();
-	}
-};
-function parseSearchLedgerEntry(raw, context) {
-	const parsed = EntrySchema.safeParse(raw);
-	if (!parsed.success) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has a malformed entry at line ${context.line}: ${formatZodError(parsed.error)}`);
-	const entry = parsed.data;
-	if (canonicalString(validateSearchLedgerEvent(entry.event)) !== canonicalString(entry.event)) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has non-canonical event ordering at line ${context.line}`);
-	return entry;
+function compareStrings(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
 }
+//#endregion
+//#region src/campaign/search-ledger-projector.ts
 /** Replay the campaign search state machine over chain-verified entries. The
 * generic journal owns sequence, hash, and eventId-uniqueness checks; this
 * projector owns every campaign invariant and builds the replay projection. */
@@ -3062,23 +2816,414 @@ function createSearchLedgerProjector(campaignId) {
 		};
 	};
 	return {
-		apply,
-		finish
+		apply,
+		finish
+	};
+}
+/** Every candidate slot must name a planned candidate-generation operation,
+* whether it arrives with the plan or with a later extension. */
+function assertSlotGenerationOperation(slot, plannedOperations) {
+	if (plannedOperations.get(slot.generationOperationId)?.kind !== "candidate-generation") throw new SearchLedgerIntegrityError(`candidate slot ${slot.slotId} references unplanned candidate-generation operation ${slot.generationOperationId}`);
+}
+function plannedTaskOutcomeKeys(planEvent, candidates) {
+	const missing = [];
+	const registeredCandidates = [...candidates.values()].sort((a, b) => compareStrings(a.registered.slotId, b.registered.slotId));
+	for (const candidate of registeredCandidates) {
+		const slotId = candidate.registered.slotId;
+		for (const task of planEvent.plan.tasks) if (!candidate.attempts.some((attempt) => attempt.task.taskId === task.taskId && attempt.outcome.status !== "errored")) missing.push(`${slotId}/${task.taskId}`);
+	}
+	return missing;
+}
+function assertUnique(values, label, eventId) {
+	if (new Set(values).size !== values.length) throw new SearchLedgerIntegrityError(`event ${eventId} contains duplicate ${label} values`);
+}
+//#endregion
+//#region src/campaign/search-ledger-types.ts
+const SEARCH_LEDGER_SCHEMA = "tangle.search-ledger.v1";
+//#endregion
+//#region src/campaign/search-ledger.ts
+/**
+* Durable append-only audit log for improvement searches.
+*
+* Existing campaign artifacts keep their own rich records: `RunRecord` owns a
+* measured run and `CostLedger` owns per-call accounting. This ledger does not
+* copy those structures. It binds their immutable ids and receipts into one replayable event stream so a
+* search can answer, after a crash, exactly which candidates and task attempts
+* existed, which surfaces actually fired, what they cost, and why they were
+* selected or rejected.
+*
+* The file format is canonical JSONL with a SHA-256 hash chain. Every append is
+* serialized across processes, fsynced before acknowledgement, and idempotent
+* by `eventId`. A malformed, non-canonical, truncated, reordered, or conflicting
+* log fails loudly; the implementation never skips a bad row.
+*
+* The journal machinery itself (hash chain, locking, fsync, idempotent append)
+* is the generic `ledger-core` journal; this module supplies the campaign
+* codec: event schemas, canonical event ordering, and the search state machine.
+*/
+const NON_EMPTY = z.string().min(1).refine((value) => value.trim() === value, "must not contain surrounding whitespace");
+const HASH = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const LINEAGE_NODE_ID = z.string().regex(/^[a-f0-9]{16}$/);
+const IMMUTABLE_REVISION = z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|sha256:[a-f0-9]{64}|sha512:[A-Za-z0-9+/=]+)$/);
+const ISO_TIMESTAMP = z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/).refine((value) => Number.isFinite(Date.parse(value)), "invalid timestamp");
+const NON_NEGATIVE_INT = z.number().int().nonnegative().safe();
+const FINITE_NUMBER = z.number().finite();
+const ArtifactRefSchema = z.object({
+	role: NON_EMPTY,
+	uri: NON_EMPTY,
+	sha256: HASH,
+	byteLength: NON_NEGATIVE_INT
+}).strict();
+const SourceRefSchema = z.object({
+	uri: NON_EMPTY,
+	revision: IMMUTABLE_REVISION
+}).strict();
+const FailureReasonSchema = z.object({
+	code: NON_EMPTY,
+	message: NON_EMPTY
+}).strict();
+const EventBaseShape = {
+	eventId: NON_EMPTY,
+	occurredAt: ISO_TIMESTAMP,
+	artifacts: z.array(ArtifactRefSchema).min(1)
+};
+const OperationKindSchema = z.enum([
+	"candidate-generation",
+	"analysis",
+	"selection",
+	"judge",
+	"other"
+]);
+const CandidateSlotSchema = z.object({
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY
+}).strict();
+const PlannedOperationSchema = z.object({
+	operationId: NON_EMPTY,
+	kind: OperationKindSchema
+}).strict();
+const SearchPlanExtendedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-plan-extended"),
+	extension: z.object({
+		candidateSlots: z.array(CandidateSlotSchema),
+		operations: z.array(PlannedOperationSchema)
+	}).strict().superRefine((extension, ctx) => {
+		if (extension.candidateSlots.length === 0 && extension.operations.length === 0) ctx.addIssue({
+			code: "custom",
+			message: "a plan extension must add slots or operations"
+		});
+	})
+}).strict();
+const SearchPlannedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-planned"),
+	plan: z.object({
+		candidateSlots: z.array(CandidateSlotSchema).min(1),
+		tasks: z.array(z.object({
+			taskId: NON_EMPTY,
+			source: SourceRefSchema,
+			benchmark: SourceRefSchema,
+			maxAttempts: z.number().int().positive().safe()
+		}).strict()).min(1),
+		operations: z.array(PlannedOperationSchema).min(1)
+	}).strict()
+}).strict();
+const CandidateRegisteredSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-registered"),
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY,
+	candidateId: NON_EMPTY,
+	lineage: z.object({
+		lineageNodeId: LINEAGE_NODE_ID,
+		parentCandidateIds: z.array(NON_EMPTY),
+		generation: NON_NEGATIVE_INT,
+		proposer: NON_EMPTY,
+		proposerSource: SourceRefSchema
+	}).strict(),
+	surfaces: z.array(z.object({
+		surfaceId: NON_EMPTY,
+		kind: z.enum([
+			"prompt",
+			"tool-contract",
+			"runtime-config",
+			"memory",
+			"knowledge",
+			"agent-profile",
+			"code",
+			"deployment"
+		]),
+		artifact: ArtifactRefSchema
+	}).strict()).min(1)
+}).strict();
+const CandidateSlotClosedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-slot-closed"),
+	slotId: NON_EMPTY,
+	generationOperationId: NON_EMPTY,
+	reason: FailureReasonSchema
+}).strict();
+const KnownTokensSchema = z.object({
+	status: z.literal("known"),
+	inputTokens: NON_NEGATIVE_INT,
+	outputTokens: NON_NEGATIVE_INT,
+	cachedTokens: NON_NEGATIVE_INT
+}).strict();
+const UnknownSchema = z.object({
+	status: z.literal("unknown"),
+	reason: NON_EMPTY
+}).strict();
+const KnownCostSchema = z.object({
+	status: z.literal("known"),
+	usd: z.number().finite().nonnegative(),
+	source: z.enum([
+		"provider",
+		"pricing-table",
+		"free"
+	])
+}).strict().superRefine((cost, ctx) => {
+	if (cost.source === "free" && cost.usd !== 0) ctx.addIssue({
+		code: "custom",
+		message: "free cost source must have usd 0"
+	});
+});
+const UnknownCostSchema = z.object({
+	status: z.literal("unknown"),
+	knownLowerBoundUsd: z.number().finite().nonnegative(),
+	reason: NON_EMPTY
+}).strict();
+const AccountingSchema = z.object({
+	tokens: z.discriminatedUnion("status", [KnownTokensSchema, UnknownSchema]),
+	cost: z.discriminatedUnion("status", [KnownCostSchema, UnknownCostSchema])
+}).strict();
+const MetricsSchema = z.record(NON_EMPTY, FINITE_NUMBER).superRefine((metrics, ctx) => {
+	for (const key of Object.keys(metrics)) if (key === "__proto__" || key === "constructor" || key === "prototype") ctx.addIssue({
+		code: "custom",
+		message: `unsafe metric key ${key}`
+	});
+});
+const OutcomeSchema = z.discriminatedUnion("status", [
+	z.object({
+		status: z.literal("passed"),
+		score: FINITE_NUMBER,
+		metrics: MetricsSchema
+	}).strict(),
+	z.object({
+		status: z.literal("failed"),
+		score: FINITE_NUMBER,
+		metrics: MetricsSchema,
+		failure: FailureReasonSchema
+	}).strict(),
+	z.object({
+		status: z.literal("errored"),
+		metrics: MetricsSchema,
+		error: FailureReasonSchema.extend({ retryable: z.boolean() }).strict()
+	}).strict()
+]);
+const EffectSchema = z.discriminatedUnion("status", [z.object({
+	status: z.literal("measured"),
+	metric: NON_EMPTY,
+	baselineValue: FINITE_NUMBER,
+	candidateValue: FINITE_NUMBER,
+	delta: FINITE_NUMBER
+}).strict().superRefine((effect, ctx) => {
+	const expected = effect.candidateValue - effect.baselineValue;
+	const tolerance = Number.EPSILON * Math.max(1, Math.abs(expected), Math.abs(effect.delta)) * 8;
+	if (Math.abs(effect.delta - expected) > tolerance) ctx.addIssue({
+		code: "custom",
+		message: "delta must equal candidateValue - baselineValue"
+	});
+}), z.object({
+	status: z.literal("not-measured"),
+	reason: NON_EMPTY
+}).strict()]);
+const SurfaceEvidenceSchema = z.object({
+	surfaceId: NON_EMPTY,
+	fired: z.boolean(),
+	firingCount: NON_NEGATIVE_INT,
+	effect: EffectSchema,
+	evidence: z.array(ArtifactRefSchema).min(1)
+}).strict().superRefine((evidence, ctx) => {
+	if (evidence.fired && evidence.firingCount === 0) ctx.addIssue({
+		code: "custom",
+		message: "a fired surface must have firingCount >= 1"
+	});
+	if (!evidence.fired && evidence.firingCount !== 0) ctx.addIssue({
+		code: "custom",
+		message: "a surface that did not fire must have firingCount 0"
+	});
+	if (!evidence.fired && evidence.effect.status === "measured" && evidence.effect.delta !== 0) ctx.addIssue({
+		code: "custom",
+		message: "a surface that did not fire cannot claim non-zero effect"
+	});
+});
+const TaskAttemptedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("task-attempted"),
+	candidateId: NON_EMPTY,
+	runId: NON_EMPTY,
+	attemptIndex: NON_NEGATIVE_INT,
+	task: z.object({
+		taskId: NON_EMPTY,
+		source: SourceRefSchema
+	}).strict(),
+	identity: z.object({
+		model: z.object({
+			provider: NON_EMPTY,
+			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
+		}).strict(),
+		agent: SourceRefSchema,
+		benchmark: SourceRefSchema
+	}).strict(),
+	outcome: OutcomeSchema,
+	accounting: AccountingSchema,
+	surfaceEvidence: z.array(SurfaceEvidenceSchema).min(1)
+}).strict();
+const SearchOperationRecordedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-operation-recorded"),
+	operationId: NON_EMPTY,
+	operationKind: OperationKindSchema,
+	execution: z.discriminatedUnion("kind", [z.object({
+		kind: z.literal("model"),
+		model: z.object({
+			provider: NON_EMPTY,
+			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
+		}).strict(),
+		source: SourceRefSchema
+	}).strict(), z.object({
+		kind: z.literal("deterministic"),
+		source: SourceRefSchema
+	}).strict()]),
+	outcome: z.discriminatedUnion("status", [
+		z.object({ status: z.literal("completed") }).strict(),
+		z.object({
+			status: z.literal("partial"),
+			failure: FailureReasonSchema
+		}).strict(),
+		z.object({
+			status: z.literal("failed"),
+			failure: FailureReasonSchema
+		}).strict()
+	]),
+	accounting: AccountingSchema
+}).strict();
+const CandidateDecidedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("candidate-decided"),
+	candidateId: NON_EMPTY,
+	decision: z.discriminatedUnion("status", [z.object({ status: z.literal("selected") }).strict(), z.object({
+		status: z.literal("rejected"),
+		reason: FailureReasonSchema
+	}).strict()])
+}).strict();
+const SearchCompletedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-completed"),
+	result: z.discriminatedUnion("status", [z.object({
+		status: z.literal("selected"),
+		candidateId: NON_EMPTY
+	}).strict(), z.object({
+		status: z.literal("all-rejected"),
+		reason: FailureReasonSchema
+	}).strict()])
+}).strict();
+const EventSchema = z.discriminatedUnion("kind", [
+	SearchPlannedSchema,
+	SearchPlanExtendedSchema,
+	CandidateRegisteredSchema,
+	CandidateSlotClosedSchema,
+	TaskAttemptedSchema,
+	SearchOperationRecordedSchema,
+	CandidateDecidedSchema,
+	SearchCompletedSchema
+]);
+const EntrySchema = z.object({
+	schema: z.literal(SEARCH_LEDGER_SCHEMA),
+	campaignId: NON_EMPTY,
+	sequence: NON_NEGATIVE_INT,
+	previousHash: z.union([HASH, z.null()]),
+	event: EventSchema,
+	entryHash: HASH
+}).strict();
+/** Validate and return a canonical copy. Arrays whose order is not semantic are
+* sorted so retries from different processes produce byte-identical events. */
+function validateSearchLedgerEvent(input) {
+	const parsed = EventSchema.safeParse(input);
+	if (!parsed.success) throw new SearchLedgerError(`invalid search ledger event: ${formatZodError(parsed.error)}`);
+	return normalizeEvent(parsed.data);
+}
+/** Open a durable filesystem search ledger. Construction performs no I/O; the
+* first `append` or `replay` validates the complete existing file. */
+function openSearchLedger(options) {
+	if (options.path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
+	return new FileSearchLedger(options.path, options.campaignId, options.trustedHead);
+}
+/** Replay immutable search-ledger JSONL through the same codec as FileSearchLedger. */
+function replaySearchLedgerText(text, campaignId, source) {
+	return replayLedgerText(text, source, searchLedgerCodec(campaignId)).projection;
+}
+function searchLedgerCodec(campaignId) {
+	return {
+		...SEARCH_LEDGER_FILE_CONTEXT,
+		header: {
+			schema: SEARCH_LEDGER_SCHEMA,
+			campaignId
+		},
+		conflictError: (message) => new SearchLedgerConflictError(message),
+		parseEntry: parseSearchLedgerEntry,
+		checkEntryHeader: (entry, index) => {
+			if (entry.campaignId !== campaignId) throw new SearchLedgerIntegrityError(`entry ${index} belongs to campaign ${entry.campaignId}, expected ${campaignId}`);
+		},
+		createProjector: () => createSearchLedgerProjector(campaignId)
 	};
 }
-/** Every candidate slot must name a planned candidate-generation operation,
-* whether it arrives with the plan or with a later extension. */
-function assertSlotGenerationOperation(slot, plannedOperations) {
-	if (plannedOperations.get(slot.generationOperationId)?.kind !== "candidate-generation") throw new SearchLedgerIntegrityError(`candidate slot ${slot.slotId} references unplanned candidate-generation operation ${slot.generationOperationId}`);
-}
-function plannedTaskOutcomeKeys(planEvent, candidates) {
-	const missing = [];
-	const registeredCandidates = [...candidates.values()].sort((a, b) => compareStrings(a.registered.slotId, b.registered.slotId));
-	for (const candidate of registeredCandidates) {
-		const slotId = candidate.registered.slotId;
-		for (const task of planEvent.plan.tasks) if (!candidate.attempts.some((attempt) => attempt.task.taskId === task.taskId && attempt.outcome.status !== "errored")) missing.push(`${slotId}/${task.taskId}`);
+/** Append-only file-backed search ledger with idempotent writes and replay. */
+var FileSearchLedger = class {
+	path;
+	campaignId;
+	trustedHeadPath;
+	trustedHeadMode;
+	journal;
+	constructor(path, campaignId, trustedHead = "pin") {
+		if (path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
+		if (campaignId.length === 0) throw new SearchLedgerError("campaignId is empty");
+		if (campaignId.trim() !== campaignId) throw new SearchLedgerError("campaignId must not contain surrounding whitespace");
+		this.campaignId = campaignId;
+		this.trustedHeadMode = trustedHead;
+		this.journal = new FileLedgerJournal(path, searchLedgerCodec(campaignId), { requireTrustedHead: trustedHead === "require" });
+		this.path = this.journal.path;
+		this.trustedHeadPath = this.journal.trustedHeadPath;
 	}
-	return missing;
+	async replay() {
+		return (await this.journal.replay()).projection;
+	}
+	async append(input) {
+		const event = validateSearchLedgerEvent(input);
+		const { entry, appended, projection } = await this.journal.append(event, { pinHead: this.trustedHeadMode !== "off" });
+		return {
+			entry,
+			appended,
+			replay: projection
+		};
+	}
+	async trustedHead() {
+		return this.journal.trustedHead();
+	}
+	async pinTrustedHead() {
+		return this.journal.pinTrustedHead();
+	}
+	async clearTrustedHead() {
+		return this.journal.clearTrustedHead();
+	}
+};
+function parseSearchLedgerEntry(raw, context) {
+	const parsed = EntrySchema.safeParse(raw);
+	if (!parsed.success) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has a malformed entry at line ${context.line}: ${formatZodError(parsed.error)}`);
+	const entry = parsed.data;
+	if (canonicalString(validateSearchLedgerEvent(entry.event)) !== canonicalString(entry.event)) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has non-canonical event ordering at line ${context.line}`);
+	return entry;
 }
 function normalizeEvent(event) {
 	const artifacts = sortArtifacts(event.artifacts);
@@ -3127,18 +3272,9 @@ function normalizeEvent(event) {
 function sortArtifacts(artifacts) {
 	return [...artifacts].map((artifact) => ({ ...artifact })).sort((a, b) => compareStrings(artifactKey(a), artifactKey(b)));
 }
-function artifactKey(artifact) {
-	return canonicalString(artifact);
-}
-function compareStrings(a, b) {
-	return a < b ? -1 : a > b ? 1 : 0;
-}
 function sortedStrings(values) {
 	return [...values].sort();
 }
-function assertUnique(values, label, eventId) {
-	if (new Set(values).size !== values.length) throw new SearchLedgerIntegrityError(`event ${eventId} contains duplicate ${label} values`);
-}
 function formatZodError(error) {
 	return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`).join("; ");
 }
@@ -4622,6 +4758,16 @@ const DEFAULT_DISPATCH_TIMEOUT_MS = 6e5;
 * Gated-promotion shell over `runOptimization`: scores the winner against the baseline on a holdout set, runs the release gate, and optionally opens a PR.
 */
 async function runImprovementLoop(opts) {
+	opts = {
+		...opts,
+		judges: opts.judges?.map(captureJudge),
+		...opts.claim || opts.finalEvidence ? {
+			claim: opts.claim && defineEvaluationClaim(opts.claim),
+			finalEvidence: opts.finalEvidence && captureFinalEvidencePolicy(opts.finalEvidence),
+			scenarios: structuredClone(opts.scenarios),
+			holdoutScenarios: structuredClone(opts.holdoutScenarios)
+		} : {}
+	};
 	if (opts.autoOnPromote === "config") throw new Error("runImprovementLoop: autoOnPromote='config' requires isolated deployment, rollback, and independent validation. Use 'pr' or 'none'.");
 	if (opts.tracing === "off" && opts.proposer) throw new Error("runImprovementLoop: tracing='off' is forbidden when a proposer is wired. The improvement loop without traces is unattributable; candidate surfaces cannot be cited back to spans and the optimization dataset goes unfed.");
 	if (opts.autoOnPromote === "pr" && (!opts.ghOwner || !opts.ghRepo)) throw new Error("runImprovementLoop: autoOnPromote='pr' requires ghOwner + ghRepo.");
@@ -4637,6 +4783,11 @@ async function runImprovementLoop(opts) {
 		costCeilingUsd: opts.costCeiling
 	});
 	const dispatchTimeoutMs = opts.dispatchTimeoutMs ?? DEFAULT_DISPATCH_TIMEOUT_MS;
+	if (opts.claim?.generalization === "new-units") assertIndependentEvaluationSplit(opts.claim, opts.holdoutScenarios, opts.scenarios);
+	if (opts.finalEvidence) {
+		if (opts.holdout === "deferred") throw new Error("final evidence requires a measured comparison");
+		await reserveFinalEvidence(opts.finalEvidence, opts.claim, opts.holdoutScenarios, opts.scenarios);
+	}
 	const optimization = await runOptimization({
 		...opts,
 		dispatchTimeoutMs,
@@ -4960,14 +5111,7 @@ async function executeOptimizationMethod(options) {
 		baselineSurface: structuredClone(input.baselineSurface),
 		trainScenarios: cloneScenarios(input.trainScenarios),
 		selectionScenarios: cloneScenarios(input.selectionScenarios),
-		judges: Object.freeze(input.judges.map((judge) => {
-			const dimensions = judge.dimensions.map((dimension) => Object.freeze({ ...dimension }));
-			Object.freeze(dimensions);
-			return Object.freeze({
-				...judge,
-				dimensions
-			});
-		})),
+		judges: Object.freeze(input.judges.map(captureJudge)),
 		runOptions: Object.freeze({ ...input.runOptions }),
 		costLedger: costScope.ledger
 	});
@@ -5114,6 +5258,16 @@ function assertOptimizationProvenance(methodName, value) {
 * Compare complete optimization methods on disjoint train, selection, and final test data.
 */
 async function compareOptimizationMethods(opts) {
+	opts = {
+		...opts,
+		methods: opts.methods.map((method) => ({ ...method })),
+		trainScenarios: structuredClone(opts.trainScenarios),
+		selectionScenarios: structuredClone(opts.selectionScenarios),
+		testScenarios: structuredClone(opts.testScenarios),
+		judges: opts.judges.map(captureJudge),
+		claim: opts.claim && defineEvaluationClaim(opts.claim),
+		finalEvidence: opts.finalEvidence && captureFinalEvidencePolicy(opts.finalEvidence)
+	};
 	assertOptimizationMethods(opts.methods);
 	assertComparisonPartitions(opts);
 	const searchHistoryPolicy = opts.searchHistoryPolicy ?? "allow-missing";
@@ -5160,11 +5314,38 @@ async function compareOptimizationMethods(opts) {
 		return byScenario;
 	};
 	const scenarioIds = opts.testScenarios.map((s) => s.id).sort();
+	const unitByScenario = opts.claim ? evaluationUnitMap(opts.claim, opts.testScenarios) : new Map(scenarioIds.map((id) => [id, id]));
+	const units = opts.claim ? summarizeEvaluationUnits(opts.claim, opts.testScenarios) : {
+		observations: scenarioIds.length,
+		independentUnits: scenarioIds.length,
+		units: scenarioIds.map((id) => ({
+			id,
+			observations: 1
+		}))
+	};
+	const aggregateUnits = (arr) => {
+		const values = /* @__PURE__ */ new Map();
+		scenarioIds.forEach((id, index) => {
+			const unitId = unitByScenario.get(id);
+			const bucket = values.get(unitId) ?? [];
+			bucket.push(arr[index]);
+			values.set(unitId, bucket);
+		});
+		return units.units.map((unit) => mean(values.get(unit.id)));
+	};
+	const decisionOptions = {
+		seed,
+		resamples,
+		confidence: intervalConfidence,
+		threshold: opts.claim?.minimumEffect ?? 0
+	};
 	const align = (byScenario, label) => {
 		const missing = scenarioIds.filter((id) => !(id in byScenario));
 		if (missing.length > 0) throw new Error(`compareOptimizationMethods: ${label} produced no test score for scenario(s) [${missing.join(", ")}]. A cell failed or its judges returned nothing. Fix the dispatch or judge; the comparison will not replace missing scores with zero.`);
 		return scenarioIds.map((id) => byScenario[id]);
 	};
+	if (opts.claim?.generalization === "new-units") assertIndependentEvaluationSplit(opts.claim, opts.testScenarios, [...opts.trainScenarios, ...opts.selectionScenarios]);
+	if (opts.finalEvidence) await reserveFinalEvidence(opts.finalEvidence, opts.claim, opts.testScenarios, [...opts.trainScenarios, ...opts.selectionScenarios]);
 	const optimizationOwner = new AbortController();
 	const optimized = await mapConcurrent(opts.methods, optimizationConcurrency, async (method) => {
 		try {
@@ -5195,6 +5376,7 @@ async function compareOptimizationMethods(opts) {
 		cost: result.cost
 	}))).totalCostUsd, opts.costCeiling, "optimization");
 	const testCostPhase = finalCostPhase(opts, baselineSurface, optimized, seed);
+	const finalEvidence = opts.finalEvidence ? await exposeFinalEvidence(opts.finalEvidence, opts.claim, opts.testScenarios, [baselineSurface, ...optimized.map((method) => method.winnerSurface)]) : void 0;
 	const baselineArr = align(await scoreOnTest(baselineSurface, "test/baseline", testCostPhase), "baseline");
 	const testScoresBySurface = /* @__PURE__ */ new Map([[surfaceContentHash(baselineSurface), baselineArr]]);
 	const winners = [];
@@ -5211,21 +5393,19 @@ async function compareOptimizationMethods(opts) {
 		});
 	}
 	const scores = winners.map((w) => {
-		const boot = pairedBootstrap(baselineArr, w.arr, {
-			seed,
-			resamples,
-			confidence: intervalConfidence,
-			statistic: "mean"
-		});
+		const baselineUnits = aggregateUnits(baselineArr);
+		const winnerUnits = aggregateUnits(w.arr);
+		const decision = decidePairedPromotion(baselineUnits, winnerUnits, decisionOptions);
 		const score = {
 			name: w.name,
-			baselineComposite: mean(baselineArr),
-			winnerComposite: mean(w.arr),
-			lift: boot.mean,
+			baselineComposite: mean(baselineUnits),
+			winnerComposite: mean(winnerUnits),
+			lift: decision.delta,
 			liftCi: {
-				low: boot.low,
-				high: boot.high
+				low: decision.low,
+				high: decision.high
 			},
+			decision,
 			optimizationCost: w.cost,
 			scenarioScores: scenarioIds.map((scenarioId, index) => ({
 				scenarioId,
@@ -5233,6 +5413,13 @@ async function compareOptimizationMethods(opts) {
 				winnerComposite: w.arr[index],
 				lift: w.arr[index] - baselineArr[index]
 			})),
+			unitScores: units.units.map((unit, index) => ({
+				unitId: unit.id,
+				scenarios: unit.observations,
+				baselineComposite: baselineUnits[index],
+				winnerComposite: winnerUnits[index],
+				lift: winnerUnits[index] - baselineUnits[index]
+			})),
 			winnerSurface: structuredClone(w.winnerSurface),
 			rank: 0
 		};
@@ -5266,23 +5453,20 @@ async function compareOptimizationMethods(opts) {
 	});
 	const best = scores[0];
 	const byName = new Map(winners.map((w) => [w.name, w]));
-	const bestArr = byName.get(best.name).arr;
+	const bestArr = aggregateUnits(byName.get(best.name).arr);
 	const pairwise = scores.slice(1).map((other) => {
-		const otherArr = byName.get(other.name).arr;
-		const boot = pairedBootstrap(otherArr, bestArr, {
-			seed,
-			resamples,
-			confidence: intervalConfidence,
-			statistic: "mean"
-		});
-		const favored = !Number.isFinite(boot.low) || !Number.isFinite(boot.high) || boot.low === boot.high ? "tie" : boot.low > 0 ? best.name : boot.high < 0 ? other.name : "tie";
+		const otherArr = aggregateUnits(byName.get(other.name).arr);
+		const decision = decidePairedPromotion(otherArr, bestArr, decisionOptions);
+		const reverse = decidePairedPromotion(bestArr, otherArr, decisionOptions);
+		const favored = decision.promote ? best.name : reverse.promote ? other.name : null;
 		return {
 			a: best.name,
 			b: other.name,
-			deltaMean: boot.mean,
-			low: boot.low,
-			high: boot.high,
-			favored
+			deltaMean: decision.delta,
+			low: decision.low,
+			high: decision.high,
+			favored,
+			decision
 		};
 	});
 	const optimizationCost = combineComparisonCosts(scores.map((score) => ({
@@ -5303,6 +5487,11 @@ async function compareOptimizationMethods(opts) {
 		best,
 		pairwise,
 		testScenarioIds: scenarioIds,
+		units,
+		observationUnit: opts.claim ? "registered" : "scenario",
+		pairedCellN: scenarioIds.length * (opts.reps ?? 1),
+		...opts.claim ? { claim: opts.claim } : {},
+		...finalEvidence ? { finalEvidence } : {},
 		optimizationCost,
 		testCost,
 		totalCost,
@@ -5963,6 +6152,6 @@ function firstString(value) {
 	return typeof value === "string" && value.trim() ? value : void 0;
 }
 //#endregion
-export { openSearchLedger as A, redTeamDataset as B, assertSearchHistoryAdmissionOptions as C, verifySearchHistoryArtifact as D, searchHistoryCoverageRow as E, paretoFrontierWithCrowding as F, runCampaign as G, scoreRedTeamOutput as H, runFinalComparison as I, tangleTracesRoot as J, planCampaignRun as K, openAutoPr as L, validateSearchLedgerEvent as M, dominates as N, verifySearchHistoryReceipt as O, paretoFrontier as P, computeManifestHash as Q, defaultProductionGate as R, assertCompleteSearchHistory as S, createSearchHistoryReceipt as T, runCanaries as U, redTeamReport as V, runEval as W, buildCellSchedule as X, readCachedCell as Y, cellCachePath as Z, isProposedCandidate as _, transientDispatchFailure as a, recordCandidatePopulationSearch as b, compareOptimizationMethods as c, combineComparisonCosts as d, costFromLedgerSummary as f, runOptimization as g, runImprovementLoop as h, quotaExhaustedUntil as i, replaySearchLedgerText as j, FileSearchLedger as k, optimizationTokenUsageFromSummary as l, readGepaCandidatePopulationArtifact as m, JudgeParseError as n, aggregateRunScore as o, assertGepaCandidatePopulationSummary as p, resolveRunDir as q, isTransientTransportFailure as r, clamp01 as s, llmJudge as t, executeOptimizationMethod as u, labelTrustRank as v, assertSearchHistoryMatchesReplay as w, SearchHistoryRequiredError as x, SearchRecorder as y, DEFAULT_RED_TEAM_CORPUS as z };
+export { tangleTracesRoot as $, openSearchLedger as A, DEFAULT_RED_TEAM_CORPUS as B, assertSearchHistoryAdmissionOptions as C, verifySearchHistoryArtifact as D, searchHistoryCoverageRow as E, paretoFrontierWithCrowding as F, assertIndependentEvaluationSplit as G, redTeamReport as H, runFinalComparison as I, reserveFinalEvidence as J, captureFinalEvidencePolicy as K, openAutoPr as L, validateSearchLedgerEvent as M, dominates as N, verifySearchHistoryReceipt as O, paretoFrontier as P, resolveRunDir as Q, captureJudge as R, assertCompleteSearchHistory as S, createSearchHistoryReceipt as T, scoreRedTeamOutput as U, redTeamDataset as V, runCanaries as W, runCampaign as X, runEval as Y, planCampaignRun as Z, isProposedCandidate as _, transientDispatchFailure as a, recordCandidatePopulationSearch as b, compareOptimizationMethods as c, combineComparisonCosts as d, readCachedCell as et, costFromLedgerSummary as f, runOptimization as g, runImprovementLoop as h, quotaExhaustedUntil as i, replaySearchLedgerText as j, FileSearchLedger as k, optimizationTokenUsageFromSummary as l, readGepaCandidatePopulationArtifact as m, JudgeParseError as n, cellCachePath as nt, aggregateRunScore as o, assertGepaCandidatePopulationSummary as p, evaluationUnitMap as q, isTransientTransportFailure as r, computeManifestHash as rt, clamp01 as s, llmJudge as t, buildCellSchedule as tt, executeOptimizationMethod as u, labelTrustRank as v, assertSearchHistoryMatchesReplay as w, SearchHistoryRequiredError as x, SearchRecorder as y, defaultProductionGate as z };
 
-//# sourceMappingURL=llm-judge-v80Kmu9g.js.map
+//# sourceMappingURL=llm-judge-DEFZeSiu.js.map