@tangle-network/agent-eval 0.180.0 → 0.181.0

package/dist/{campaign-evidence-D8DBLqLI.js → campaign-evidence-B8oF9xQ6.js}

@@ -1,11 +1,264 @@
-import { t as AgentEvalError } from "./errors-Dngq5h35.js";
+import { s as ValidationError, t as AgentEvalError } from "./errors-Dngq5h35.js";
 import { a as hashCanonical, i as compareCodeUnits, r as canonicalString } from "./canonical-DPyQ_rpt.js";
-import { g as pairedRiskDifferenceScore, h as pairedRiskDifferenceExact, p as pairedBinaryScale } from "./paired-arms-D4aeIHUy.js";
-import { a as pairedSignTest, i as pairedDeltaTieFraction, r as pairedBootstrap } from "./paired-tests-C8iCsioC.js";
+import { r as pairedBootstrap } from "./paired-tests-C8iCsioC.js";
+import { n as campaignCellExecutionEvidence, o as projectCampaignCellQuality, s as decidePairedPromotion } from "./run-record-Br-Yzt_k.js";
 import { n as contentHash } from "./verdict-cache-B3eCVQtY.js";
-import { n as campaignCellExecutionEvidence, o as projectCampaignCellQuality } from "./run-record-CR63CpHK.js";
+import { t as FileLedgerJournal } from "./journal-Cs9f7385.js";
+import { g as readField } from "./ast-CP9ae9B0.js";
 import { createHash } from "node:crypto";
+import { z } from "zod";
 import { join } from "node:path";
+//#region src/campaign/gates/statistical-heldout.ts
+/**
+* Held-out inference pairs execution cells and judge identities before taking
+* means within registered independent units. Repetitions can improve a unit's
+* precision without increasing n. Ungrouped inference concerns independently
+* sampled execution cells conditional on a fixed scenario roster.
+*
+* The shared paired decision rule selects the estimator and statistical test.
+* Dimension reports retain missing coverage so required safety checks cannot
+* pass through absent evidence. Thresholds use the judge's native score scale.
+*/
+/** Tie fraction at/above which a gate annotates its verdict with the tie share.
+*  Tie-domination of the median bites structurally at >= 0.5 (the median is then
+*  0 by construction); 0.4 is a softer warn threshold that flags a run APPROACHING
+*  that regime, so an operator sees it before the median goes fully blind. */
+const TIE_WARN_FRACTION = .4;
+/** Campaign cell IDs append a numeric repetition after the scenario's full ID. */
+function scenarioIdFromCellId(cellId) {
+	const separator = cellId.lastIndexOf(":");
+	const repetition = cellId.slice(separator + 1);
+	if (separator < 1 || cellId.trim() !== cellId || !/^(0|[1-9]\d*)$/.test(repetition) || !Number.isSafeInteger(Number(repetition))) throw new Error(`pairHoldout: malformed cellId '${cellId}'; expected scenarioId:rep`);
+	return cellId.slice(0, separator);
+}
+/** Preserve cell pairing before taking equal-weight independent-unit means. */
+function aggregatePairedHoldout(paired, independentUnitByScenarioId) {
+	if (paired.before.length !== paired.after.length || paired.before.length !== paired.cellIds.length) throw new Error("aggregatePairedHoldout: scores and cellIds must have the same length");
+	if (new Set(paired.cellIds).size !== paired.cellIds.length) throw new Error("aggregatePairedHoldout: duplicate cellIds cannot count as new observations");
+	if (paired.before.some((value) => !Number.isFinite(value)) || paired.after.some((value) => !Number.isFinite(value))) throw new Error("aggregatePairedHoldout: paired scores must be finite");
+	if (independentUnitByScenarioId === void 0) return {
+		before: [...paired.before],
+		after: [...paired.after],
+		unitIds: [...paired.cellIds]
+	};
+	const scenarioIds = paired.cellIds.map(scenarioIdFromCellId);
+	const groups = /* @__PURE__ */ new Map();
+	for (let i = 0; i < paired.cellIds.length; i++) {
+		const scenarioId = scenarioIds[i];
+		const unitId = independentUnitByScenarioId.get(scenarioId);
+		if (typeof unitId !== "string" || unitId.length === 0 || unitId.trim() !== unitId) throw new Error(`aggregatePairedHoldout: missing independent unit for scenario '${scenarioId}'`);
+		const group = groups.get(unitId) ?? {
+			before: 0,
+			after: 0,
+			n: 0
+		};
+		group.before += paired.before[i];
+		group.after += paired.after[i];
+		group.n += 1;
+		groups.set(unitId, group);
+	}
+	const unitIds = [...groups.keys()].sort();
+	return {
+		before: unitIds.map((id) => groups.get(id).before / groups.get(id).n),
+		after: unitIds.map((id) => groups.get(id).after / groups.get(id).n),
+		unitIds
+	};
+}
+/**
+* Pair candidate vs baseline holdout observations by FULL cellId. `select`
+* pulls the scalar from a cell's judge reports (composite, or a named
+* dimension); a cell contributes the mean of `select` across its judges. Cells
+* whose scenario is not in `scenarioIds`, or where `select` is undefined for
+* every judge on both sides, are skipped. The selected judge IDs must agree
+* within each pair. Throws when the two maps disagree on holdout cell IDs — a
+* load-bearing invariant: the baseline + winner holdout campaigns run the same
+* scenarios with the same seed base, so their cellIds MUST align; a mismatch
+* means a silent pairing bug, not a soft fallback.
+*/
+function pairHoldout(candidate, baseline, scenarioIds, select) {
+	const cellValues = (byCell, cellId) => {
+		const scores = byCell.get(cellId);
+		const values = /* @__PURE__ */ new Map();
+		if (!scores) return values;
+		for (const [judgeId, s] of Object.entries(scores)) {
+			if (s.failed === true) throw new Error(`pairHoldout: cell '${cellId}' contains a failed judge score`);
+			const v = select(s);
+			if (typeof v === "number" && !Number.isFinite(v)) throw new Error(`pairHoldout: cell '${cellId}' contains a non-finite selected score`);
+			if (typeof v === "number") values.set(judgeId, v);
+		}
+		return values;
+	};
+	const inScope = (cellId) => scenarioIds.has(scenarioIdFromCellId(cellId));
+	const candCells = [...candidate.keys()].filter(inScope).sort();
+	const baseCells = [...baseline.keys()].filter(inScope).sort();
+	if (candCells.length !== baseCells.length || candCells.some((c, i) => c !== baseCells[i])) throw new Error(`pairHoldout: candidate/baseline holdout cells do not align — candidate=[${candCells.join(",")}] baseline=[${baseCells.join(",")}]. Both holdout campaigns must run the same scenarios with the same seed base.`);
+	const before = [];
+	const after = [];
+	const cellIds = [];
+	for (const cellId of candCells) {
+		const b = cellValues(baseline, cellId);
+		const a = cellValues(candidate, cellId);
+		if (b.size === 0 && a.size === 0) continue;
+		if (b.size === 0 || a.size === 0) throw new Error(`pairHoldout: cell '${cellId}' has a selected score on only one arm`);
+		if (b.size !== a.size || [...b.keys()].some((id) => !a.has(id))) throw new Error(`pairHoldout: cell '${cellId}' selected judge IDs do not align`);
+		const judgeIds = [...b.keys()].sort();
+		before.push(meanSelectedScores(judgeIds.map((id) => b.get(id))));
+		after.push(meanSelectedScores(judgeIds.map((id) => a.get(id))));
+		cellIds.push(cellId);
+	}
+	return {
+		before,
+		after,
+		cellIds
+	};
+}
+function meanSelectedScores(values) {
+	const first = values[0];
+	return values.every((value) => value === first) ? first : values.reduce((sum, value) => sum + value, 0) / values.length;
+}
+/**
+* Significance of the held-out composite lift: ship only when the lower bound
+* of the interval the outcome's shape ADMITS exceeds `deltaThreshold` (default
+* 0 ⇒ "confidently positive"). Interpret `deltaThreshold` in the judge's native
+* scale.
+*
+* The decision is delegated whole to {@link decidePairedPromotion}, the one
+* copy of the rule (`src/paired-promotion-decision.ts`), which `HeldOutGate`
+* also calls. That module's header carries the measurements; the short version
+* is three guards a bare `bootstrap.low > threshold` does not have:
+*
+*   - a two-point (pass/fail) outcome decides on Tango's SCORE interval, the
+*     only paired-binary construction that stays valid at a nonzero margin;
+*   - McNemar's exact test VETOES at any non-negative threshold;
+*   - a ZERO-WIDTH interval is refused rather than promoted, in either
+*     direction — [0,0] clears every negative threshold and [g,g] clears every
+*     threshold below g, and both are an absence of evidence, not a result.
+*
+* Measured on this function before those guards landed, at a nominal 5 %:
+* 14.60 % false promotion at n = 40 on a paired-binary noninferiority boundary,
+* and 88.50 % at n = 6 under a bounded asymmetric null whose true mean paired
+* delta is exactly 0.
+*
+* Continuous mean targets require bootstrap eligibility. Explicit median
+* targets can use the exact sign test at its confidence-dependent minimum.
+*/
+function heldoutSignificance(paired, opts = {}) {
+	const deltaThreshold = opts.deltaThreshold ?? 0;
+	const confidence = opts.confidence ?? .95;
+	const resamples = opts.resamples ?? 2e3;
+	const seed = opts.seed ?? 1337;
+	const statistic = opts.statistic ?? "mean";
+	const observations = aggregatePairedHoldout(paired, opts.independentUnitByScenarioId);
+	const decision = decidePairedPromotion(observations.before, observations.after, {
+		confidence,
+		resamples,
+		statistic,
+		seed,
+		threshold: deltaThreshold,
+		minPairs: opts.minProductiveRuns
+	});
+	const bootstrap = decision.bootstrap ?? pairedBootstrap(observations.before, observations.after, {
+		confidence,
+		resamples,
+		statistic,
+		seed
+	});
+	const medianBootstrap = statistic === "median" ? bootstrap : pairedBootstrap(observations.before, observations.after, {
+		confidence,
+		resamples,
+		statistic: "median",
+		seed
+	});
+	const n = observations.before.length;
+	let ties = 0;
+	for (let i = 0; i < n; i += 1) {
+		const after = observations.after[i];
+		const before = observations.before[i];
+		if (Math.abs(after - before) < 1e-9) ties += 1;
+	}
+	const tieFraction = n === 0 ? 0 : ties / n;
+	return {
+		paired,
+		bootstrap,
+		medianBootstrap,
+		decision,
+		decisionStatistic: decision.statistic,
+		mcnemar: decision.mcnemar,
+		tieFraction,
+		n,
+		pairedCellN: paired.cellIds.length,
+		observationUnit: opts.independentUnitByScenarioId === void 0 ? "cell" : "registered",
+		unitIds: observations.unitIds,
+		minimumRequired: decision.minimumPairs,
+		decisionMethod: decision.method,
+		pValue: decision.pValue,
+		significant: decision.promote,
+		fewRuns: !decision.sufficient
+	};
+}
+/** Detect the native scale of a set of scores: 0-100 when any magnitude clears
+*  1.5, else [0,1]. Used to auto-scale the regression tolerance so a default
+*  expressed for [0,1] is not silently a no-op on a 0-100 dimension. */
+function detectScale(values) {
+	return values.some((v) => Math.abs(v) > 1.5) ? 100 : 1;
+}
+/**
+* Report required-dimension evidence after full pairing and optional unit means.
+* A bootstrap floor breach or a shared paired test supporting a drop marks
+* regression. These two criteria are distinct; `ci` records the shared
+* estimator and `bootstrap` records the floor interval. Missing observations
+* and insufficient n remain explicit for the caller's evidence policy.
+* The default tolerance is 0.05 on [0,1] and 5 on a detected 0-100 scale.
+*/
+function dimensionRegressions(candidate, baseline, scenarioIds, criticalDimensions, opts = {}) {
+	const out = [];
+	const expectedCellIds = [...baseline.keys()].filter((cellId) => scenarioIds.has(scenarioIdFromCellId(cellId))).sort();
+	for (const dim of criticalDimensions) {
+		const paired = pairHoldout(candidate, baseline, scenarioIds, (s) => s.dimensions[dim]);
+		if (paired.before.length === 0) continue;
+		const observations = aggregatePairedHoldout(paired, opts.independentUnitByScenarioId);
+		const measuredCells = new Set(paired.cellIds);
+		const measuredScenarios = new Set(paired.cellIds.map(scenarioIdFromCellId));
+		const tolerance = opts.tolerance ?? .05 * detectScale([...paired.before, ...paired.after]);
+		const bootstrapStatistic = opts.statistic ?? "mean";
+		const shared = {
+			confidence: opts.confidence ?? .95,
+			resamples: opts.resamples ?? 2e3,
+			statistic: bootstrapStatistic,
+			seed: opts.seed ?? 1337,
+			minPairs: opts.minProductiveRuns
+		};
+		const guard = decidePairedPromotion(observations.before, observations.after, shared);
+		const regression = decidePairedPromotion(observations.after, observations.before, {
+			...shared,
+			threshold: tolerance
+		});
+		const bootstrap = guard.bootstrap ?? pairedBootstrap(observations.before, observations.after, shared);
+		out.push({
+			dimension: dim,
+			bootstrap,
+			bootstrapStatistic,
+			ci: {
+				low: guard.low,
+				high: guard.high
+			},
+			decisionStatistic: guard.statistic,
+			mcnemar: guard.mcnemar,
+			indeterminate: guard.indeterminate,
+			regressed: bootstrap.low < -tolerance || regression.promote,
+			tolerance,
+			n: observations.before.length,
+			pairedCellN: paired.cellIds.length,
+			observationUnit: opts.independentUnitByScenarioId === void 0 ? "cell" : "registered",
+			minimumRequired: guard.minimumPairs,
+			fewRuns: !guard.sufficient,
+			missingCellIds: expectedCellIds.filter((cellId) => !measuredCells.has(cellId)),
+			missingScenarioIds: [...scenarioIds].filter((id) => !measuredScenarios.has(id)).sort()
+		});
+	}
+	return out;
+}
+//#endregion
 //#region src/campaign/coverage.ts
 /** Reject campaign designs whose denominator cannot be identified exactly. */
 function assertCampaignDesign(scenarios, reps) {
@@ -401,457 +654,227 @@ function surfaceDispatchRef(surface, executionRef = "anonymous") {
 	return `surface:${executionRef}:${surfaceContentHash(surface)}`;
 }
 //#endregion
-//#region src/paired-delta-test.ts
-/** Smallest all-positive sample that can clear a one-sided exact sign test. */
-function minimumPairsForPairedDeltaTest(confidence = .95) {
-	if (!Number.isFinite(confidence) || confidence <= 0 || confidence >= 1) throw new Error(`minimumPairsForPairedDeltaTest: confidence must be in (0,1), got ${confidence}`);
-	const oneSidedAlpha = (1 - confidence) / 2;
-	return Math.ceil(Math.log2(1 / oneSidedAlpha));
+//#region src/experiment/claim.ts
+const nonEmpty = z.string().min(1).refine((value) => value.trim() === value);
+const claimSchema = z.object({
+	use: z.enum([
+		"development",
+		"comparison",
+		"certification"
+	]),
+	population: z.object({
+		id: nonEmpty,
+		description: nonEmpty
+	}).strict(),
+	samplingFrame: nonEmpty,
+	independentUnit: nonEmpty,
+	generalization: z.enum(["fixed-roster", "new-units"]),
+	minimumEffect: z.number().finite().positive().optional()
+}).strict();
+/** Validate a claim before binding it to a sealed experiment or final evidence. */
+function defineEvaluationClaim(input) {
+	const parsed = claimSchema.safeParse(input);
+	if (!parsed.success) throw new ValidationError(`invalid evaluation claim: ${parsed.error.message}`);
+	return Object.freeze({
+		...parsed.data,
+		population: Object.freeze(parsed.data.population)
+	});
 }
-/**
-* Tests whether a paired candidate-minus-baseline delta clears a threshold.
-*
-* At 20 or more pairs, the percentile bootstrap lower bound carries the
-* decision. Below that point the interval is descriptive only, so the function
-* switches to a pre-registered one-sided exact sign test. The exact path is
-* deliberately conservative: it requires both a point estimate above the
-* threshold and enough consistently positive paired differences.
-*
-* ## A zero-width interval is never significant
-*
-* When every paired delta is identical the resample distribution is a point
-* mass and the interval collapses: `[0, 0]` when all pairs tie, `[g, g]` on n
-* identical deltas of g. Neither says the effect is certain — both say the
-* sample carries no information about how far the estimate could be wrong, and
-* `low > threshold` then answers on the point estimate alone. It fails in both
-* directions: `[0, 0]` clears every NEGATIVE threshold, which is how a
-* tie-dominated pass/fail comparison laundered a regression into a
-* noninferiority pass, and `[g, g]` clears every threshold below g with no
-* spread behind it. Under a bounded asymmetric null whose true mean paired
-* delta is exactly 0 — 2 % of pairs dropping by 1.0, the rest gaining 0.0204 —
-* every sample that misses the drop is exactly that shape, and deciding on
-* `low > 0` promoted 65.65 % of samples at n = 20 against a nominal 5 %.
-*
-* So `indeterminate` is reported and `significant` is false whenever the
-* interval has zero width, on BOTH paths: at small n the exact sign test is a
-* test of the MEDIAN and a zero-spread sample is precisely where it stops
-* saying anything about the mean the caller is thresholding.
-*
-* `threshold` may be negative — that is a noninferiority margin, and it is the
-* regime the zero-width hole is worst in. For a two-point (pass/fail) outcome
-* the percentile bootstrap is not a valid interval at a nonzero margin at all;
-* use {@link decidePairedPromotion}, which routes those to Tango's score
-* interval, rather than thresholding this function's bootstrap directly.
-*/
-function pairedDeltaTest(before, after, options = {}) {
-	const threshold = options.threshold ?? 0;
-	if (!Number.isFinite(threshold)) throw new Error(`pairedDeltaTest: threshold must be finite, got ${threshold}`);
-	const exactMinimum = minimumPairsForPairedDeltaTest(options.confidence ?? .95);
-	const requestedMinimum = options.minPairs ?? exactMinimum;
-	if (!Number.isInteger(requestedMinimum) || requestedMinimum < 1) throw new Error(`pairedDeltaTest: minPairs must be a positive integer, got ${requestedMinimum}`);
-	const minimumPairs = Math.max(requestedMinimum, exactMinimum);
-	const bootstrap = pairedBootstrap(before, after, options);
-	const sufficient = bootstrap.n >= minimumPairs;
-	const indeterminate = bootstrap.n > 0 && (!Number.isFinite(bootstrap.low) || !Number.isFinite(bootstrap.high) || bootstrap.low === bootstrap.high);
-	if (bootstrap.gateEligible) return {
-		bootstrap,
-		method: "bootstrap-ci",
-		pValue: null,
-		minimumPairs,
-		sufficient,
-		indeterminate,
-		significant: sufficient && !indeterminate && bootstrap.low > threshold
-	};
-	const exact = pairedSignTest(before.map((value, index) => after[index] - value - threshold), "greater");
-	const estimate = options.statistic === "mean" ? bootstrap.mean : bootstrap.median;
+/** Repetitions retain their denominator without becoming additional independent units. */
+function summarizeEvaluationUnits(claim, rows) {
+	const validated = defineEvaluationClaim(claim);
+	const counts = /* @__PURE__ */ new Map();
+	for (const [index, row] of rows.entries()) {
+		if (row === null || typeof row !== "object" || Array.isArray(row)) throw new ValidationError(`evaluation claim: row ${index} must be an object`);
+		const value = readField(row, validated.independentUnit);
+		if (typeof value !== "string" || !value.trim() || value.trim() !== value) throw new ValidationError(`evaluation claim: row ${index} needs a nonempty string at '${validated.independentUnit}'`);
+		counts.set(value, (counts.get(value) ?? 0) + 1);
+	}
 	return {
-		bootstrap,
-		method: "exact-sign",
-		pValue: exact.pValue,
-		minimumPairs,
-		sufficient,
-		indeterminate,
-		significant: sufficient && !indeterminate && estimate > threshold && exact.pValue <= (1 - bootstrap.confidence) / 2
+		observations: rows.length,
+		independentUnits: counts.size,
+		units: [...counts].sort(([left], [right]) => compareCodeUnits(left, right)).map(([id, observations]) => ({
+			id,
+			observations
+		}))
 	};
 }
 //#endregion
-//#region src/paired-promotion-decision.ts
-/**
-* @module
-* ONE rule for "does this paired interval clear a promotion threshold".
-*
-* The rule below was derived on `HeldOutGate` (#479) after the same estimator
-* bug shipped twice. It then turned out that a SECOND gate — the composable
-* `heldOutGate`, plus everything else routed through `heldoutSignificance` —
-* still carried the original defect, because the rule had been written into one
-* gate's method body rather than into a shared function. Two copies of a
-* statistical rule is how a defect survives in one of them, so there is now
-* exactly one copy and both gates call it.
-*
-* Three things the rule does that a bare `pairedBootstrap(...).low > threshold`
-* does not:
-*
-* 1. **Two-point (pass/fail) outcomes decide on Tango's SCORE interval.** On a
-*    pass/fail eval the paired delta vector is dominated by ties, so the
-*    bootstrap of the mean is a resample of a lattice with three atoms and its
-*    percentile interval is not valid at a nonzero margin. The score interval
-*    (`pairedRiskDifferenceScore`) re-estimates the nuisance loss rate under
-*    each hypothesised margin instead of fixing it at the observed value, which
-*    is the only construction that stays a confidence interval as the margin
-*    moves off zero — the regime every noninferiority threshold lives in.
-*    Measured on the composable gate before this change, at a true risk
-*    difference sitting exactly on the production caller's -0.05 margin and a
-*    nominal 5 %: 14.60 % false promotion at n = 40 and 10.10 % at n = 76.
-* 2. **McNemar's exact test holds a VETO at every non-negative threshold.**
-*    Redundant with the interval by construction and kept anyway, so that
-*    swapping the estimator for one without that duality cannot silently
-*    reintroduce "promotes what the exact test refuses". Witness: n = 6, b = 5,
-*    c = 0 — no exact argument reaches alpha = 0.05 with 5 discordant pairs
-*    (two-sided floor 2/2^5 = 0.0625), whatever an interval says. A NEGATIVE
-*    threshold is a noninferiority question, which McNemar's test of "no
-*    difference" is not the right test for, so the veto does not apply there.
-* 3. **A ZERO-WIDTH interval is refused, wherever it sits.** At [0, 0] it
-*    cannot tell a gain from a regression and clears every negative threshold.
-*    Away from zero it fails the opposite way: n identical positive deltas give
-*    [g, g], which clears threshold 0 on no spread at all. Both are an absence
-*    of evidence. Measured on the composable gate before this change, under a
-*    bounded asymmetric null whose true mean paired delta is exactly 0: 88.50 %
-*    false promotion at n = 6 and 65.65 % at n = 20 against a nominal 5 %.
-*
-* Orthogonal to the small-sample switch inside {@link pairedDeltaTest}: that
-* picks the TEST from the sample size (bootstrap CI at n >= 20, pre-registered
-* exact sign test below it), this picks the ESTIMATOR from the outcome's shape.
-* Both are needed — an exact sign test applied to a tie-pinned median is still
-* blind, and a mean bootstrap CI at n = 6 is still not a valid test.
-*/
-/**
-* Which estimator {@link decidePairedPromotion} would use on this data, and the
-* shape facts behind it — for callers that must report the shape on a path
-* where no interval is computed at all (an early rejection, or zero pairs).
-* Cheap: no bootstrap, no interval.
-*/
-function pairedDecisionShape(before, after, statistic = "mean") {
-	const tieFraction = before.length === 0 ? null : pairedDeltaTieFraction(before, after);
-	if (statistic === "median") return {
-		statistic: "median_bootstrap",
-		binaryScale: null,
-		tieFraction
-	};
-	const binaryScale = pairedBinaryScale(before, after);
-	if (binaryScale !== null) return {
-		statistic: "paired_risk_difference",
-		binaryScale,
-		tieFraction
-	};
-	return {
-		statistic: "mean_bootstrap",
-		binaryScale: null,
-		tieFraction
-	};
-}
-/**
-* Decide whether a paired candidate-minus-baseline delta clears a promotion
-* threshold. `before` is the baseline arm, `after` the candidate arm, paired by
-* position. Throws on unequal lengths.
-*/
-function decidePairedPromotion(before, after, options = {}) {
-	if (before.length !== after.length) throw new Error(`decidePairedPromotion: unequal sample sizes (${before.length} vs ${after.length})`);
-	const threshold = options.threshold ?? 0;
-	if (!Number.isFinite(threshold)) throw new Error(`decidePairedPromotion: threshold must be finite, got ${threshold}`);
-	const confidence = options.confidence ?? .95;
-	const exactMinimum = minimumPairsForPairedDeltaTest(confidence);
-	const requestedMinimum = options.minPairs ?? exactMinimum;
-	if (!Number.isInteger(requestedMinimum) || requestedMinimum < 1) throw new Error(`decidePairedPromotion: minPairs must be a positive integer, got ${requestedMinimum}`);
-	const minimumPairs = Math.max(requestedMinimum, exactMinimum);
-	const n = before.length;
-	const sufficient = n >= minimumPairs;
-	const { binaryScale, tieFraction } = pairedDecisionShape(before, after, options.statistic);
-	let core;
-	if (binaryScale !== null) {
-		const unitControl = before.map((v) => v / binaryScale);
-		const unitTreatment = after.map((v) => v / binaryScale);
-		const exact = pairedRiskDifferenceExact(unitControl, unitTreatment, confidence);
-		const score = pairedRiskDifferenceScore(unitControl, unitTreatment, confidence);
-		const low = score.lower * binaryScale;
-		core = {
-			statistic: "paired_risk_difference",
-			method: "score-interval",
-			delta: score.riskDifference * binaryScale,
-			low,
-			high: score.upper * binaryScale,
-			bootstrap: null,
-			mcnemar: {
-				b: exact.b,
-				c: exact.c,
-				nDiscordant: exact.nDiscordant,
-				pValue: exact.pValue
-			},
-			pValue: null,
-			clearsThreshold: low > threshold,
-			label: "success-rate",
-			methodDetail: ""
-		};
-	} else {
-		const bootstrapStatistic = options.statistic === "median" ? "median" : "mean";
-		const test = pairedDeltaTest(before, after, {
-			confidence,
-			resamples: options.resamples,
-			statistic: bootstrapStatistic,
-			seed: options.seed,
-			threshold,
-			minPairs: options.minPairs
-		});
-		const ci = test.bootstrap;
-		core = {
-			statistic: bootstrapStatistic === "mean" ? "mean_bootstrap" : "median_bootstrap",
-			method: test.method,
-			delta: bootstrapStatistic === "mean" ? ci.mean : ci.median,
-			low: ci.low,
-			high: ci.high,
-			bootstrap: ci,
-			mcnemar: null,
-			pValue: test.pValue,
-			clearsThreshold: test.significant,
-			label: bootstrapStatistic,
-			methodDetail: test.method === "exact-sign" ? ` Below ${test.minimumPairs} pairs the interval is descriptive only; the decision is the exact one-sided sign test, p=${fmt(test.pValue ?? 1)}.` : ""
-		};
+//#region src/experiment/final-evidence.ts
+const identity = z.string().min(1).refine((value) => value.trim() === value);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const reservationSchema = z.object({
+	requestId: identity,
+	claimDigest: digest,
+	populationId: identity,
+	inputDigest: digest,
+	unitIds: z.array(identity).min(1)
+}).strict();
+const measurementSchema = z.object({
+	evaluatorDigest: digest,
+	candidateDigests: z.array(digest).min(1)
+}).strict();
+const eventSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("reserved"),
+	eventId: identity,
+	reservation: reservationSchema
+}).strict(), z.object({
+	kind: z.literal("exposed"),
+	eventId: identity,
+	requestId: identity,
+	measurement: measurementSchema
+}).strict()]);
+const schema = "agent-eval.final-evidence.v1";
+const entrySchema = z.object({
+	schema: z.literal(schema),
+	sequence: z.number().int().nonnegative(),
+	previousHash: digest.nullable(),
+	event: eventSchema,
+	entryHash: digest
+}).strict();
+/** Retains the distinction between invalid input, consumed evidence, and unavailable storage. */
+var FinalEvidenceError = class extends Error {
+	kind;
+	constructor(kind, message) {
+		super(message);
+		this.kind = kind;
+		this.name = "FinalEvidenceError";
 	}
-	const indeterminate = !Number.isFinite(core.low) || !Number.isFinite(core.high) || core.low === core.high;
-	const indeterminateCause = !indeterminate ? "" : tieFraction === 1 ? "every paired delta is an exact tie" : core.mcnemar !== null && core.mcnemar.nDiscordant === 0 ? "every pair is concordant (0 discordant pairs)" : `the ${core.label} CI collapsed to a point at ${fmt(core.low)}`;
-	const exactTestVetoes = core.mcnemar !== null && threshold >= 0 && !(core.mcnemar.pValue < 1 - confidence);
+};
+/** A consumed or conflicting dataset cannot authorize another adaptive decision. */
+var FinalEvidenceConflictError = class extends FinalEvidenceError {
+	constructor(message) {
+		super("conflict", message);
+		this.name = "FinalEvidenceConflictError";
+	}
+};
+function invalid(message) {
+	return /* @__PURE__ */ new TypeError(`final evidence: ${message}`);
+}
+function normalizeReservation(input) {
+	const parsed = reservationSchema.parse(input);
+	if (new Set(parsed.unitIds).size !== parsed.unitIds.length) throw invalid("unitIds must be unique independent source identities");
 	return {
-		n,
-		threshold,
-		confidence,
-		binaryScale,
-		tieFraction,
-		minimumPairs,
-		sufficient,
-		indeterminate,
-		indeterminateCause,
-		exactTestVetoes,
-		promote: sufficient && !indeterminate && core.clearsThreshold && !exactTestVetoes,
-		...core
+		...parsed,
+		unitIds: [...parsed.unitIds].sort(compareCodeUnits)
 	};
 }
-function fmt(x) {
-	return x.toFixed(4);
-}
-//#endregion
-//#region src/campaign/gates/statistical-heldout.ts
-/**
-* Statistical held-out promotion machinery — the trustworthy core the
-* point-estimate `heldout-delta` gate lacked.
-*
-* The shipped false positive it prevents: a winner re-scored against the
-* baseline on the holdout read run-to-run model NOISE (e.g. 91 vs 95) as a
-* "+4 lift" and shipped, because the gate compared point estimates with no
-* confidence interval. Here we pair candidate vs baseline holdout observations
-* and bootstrap a CI on the paired delta — a candidate ships only when the CI
-* lower bound clears the effect-size threshold (the gain is real at the
-* confidence level, not noise), and is blocked when a critical dimension
-* (e.g. `hallucination_free` for a legal agent) significantly regresses even if
-* the net composite rose (anti-Goodhart).
-*
-* Two traps this module is built around (both produce a NEW false positive if
-* gotten wrong):
-*   1. PAIRING GRANULARITY — pairs by FULL `cellId` (`scenario:rep`), never by
-*      `scenarioId` (which averages reps away and destroys the within-pair
-*      variance reduction that makes a paired bootstrap tighter than unpaired).
-*      One paired observation per cell ⇒ reps multiply n.
-*   2. SCALE — a judge may emit composites/dimensions on [0,1] or 0-100. The
-*      threshold + tolerance are interpreted in the judge's NATIVE scale; the
-*      per-dimension tolerance auto-scales off the observed baseline magnitudes
-*      so `-0.10` on [0,1] doesn't silently become a no-op on a 0-100 dimension.
-*/
-/** Tie fraction at/above which a gate annotates its verdict with the tie share.
-*  Tie-domination of the median bites structurally at >= 0.5 (the median is then
-*  0 by construction); 0.4 is a softer warn threshold that flags a run APPROACHING
-*  that regime, so an operator sees it before the median goes fully blind. */
-const TIE_WARN_FRACTION = .4;
-/**
-* Pair candidate vs baseline holdout observations by FULL cellId. `select`
-* pulls the scalar from a cell's judge reports (composite, or a named
-* dimension); a cell contributes the mean of `select` across its judges. Cells
-* whose scenario is not in `scenarioIds`, or where `select` is undefined for
-* every judge on either side, are skipped on BOTH sides so the arrays stay
-* paired. Throws when the two maps disagree on which holdout cells exist — a
-* load-bearing invariant: the baseline + winner holdout campaigns run the same
-* scenarios with the same seed base, so their cellIds MUST align; a mismatch
-* means a silent pairing bug, not a soft fallback.
-*/
-function pairHoldout(candidate, baseline, scenarioIds, select) {
-	const cellValue = (byCell, cellId) => {
-		const scores = byCell.get(cellId);
-		if (!scores) return void 0;
-		const vals = [];
-		for (const s of Object.values(scores)) {
-			if (s.failed === true) throw new Error(`pairHoldout: cell '${cellId}' contains a failed judge score`);
-			const v = select(s);
-			if (typeof v === "number" && !Number.isFinite(v)) throw new Error(`pairHoldout: cell '${cellId}' contains a non-finite selected score`);
-			if (typeof v === "number") vals.push(v);
-		}
-		if (vals.length === 0) return void 0;
-		return vals.reduce((a, b) => a + b, 0) / vals.length;
-	};
-	const inScope = (cellId) => scenarioIds.has(cellId.split(":")[0] ?? "");
-	const candCells = [...candidate.keys()].filter(inScope).sort();
-	const baseCells = [...baseline.keys()].filter(inScope).sort();
-	if (candCells.length !== baseCells.length || candCells.some((c, i) => c !== baseCells[i])) throw new Error(`pairHoldout: candidate/baseline holdout cells do not align — candidate=[${candCells.join(",")}] baseline=[${baseCells.join(",")}]. Both holdout campaigns must run the same scenarios with the same seed base.`);
-	const before = [];
-	const after = [];
-	const cellIds = [];
-	for (const cellId of candCells) {
-		const b = cellValue(baseline, cellId);
-		const a = cellValue(candidate, cellId);
-		if (b === void 0 && a === void 0) continue;
-		if (b === void 0 || a === void 0) throw new Error(`pairHoldout: cell '${cellId}' has a selected score on only one arm`);
-		before.push(b);
-		after.push(a);
-		cellIds.push(cellId);
-	}
+function normalizeMeasurement(input) {
+	const parsed = measurementSchema.parse(input);
 	return {
-		before,
-		after,
-		cellIds
+		...parsed,
+		candidateDigests: [...new Set(parsed.candidateDigests)].sort(compareCodeUnits)
 	};
 }
-/**
-* Significance of the held-out composite lift: ship only when the lower bound
-* of the interval the outcome's shape ADMITS exceeds `deltaThreshold` (default
-* 0 ⇒ "confidently positive"). Interpret `deltaThreshold` in the judge's native
-* scale.
-*
-* The decision is delegated whole to {@link decidePairedPromotion}, the one
-* copy of the rule (`src/paired-promotion-decision.ts`), which `HeldOutGate`
-* also calls. That module's header carries the measurements; the short version
-* is three guards a bare `bootstrap.low > threshold` does not have:
-*
-*   - a two-point (pass/fail) outcome decides on Tango's SCORE interval, the
-*     only paired-binary construction that stays valid at a nonzero margin;
-*   - McNemar's exact test VETOES at any non-negative threshold;
-*   - a ZERO-WIDTH interval is refused rather than promoted, in either
-*     direction — [0,0] clears every negative threshold and [g,g] clears every
-*     threshold below g, and both are an absence of evidence, not a result.
-*
-* Measured on this function before those guards landed, at a nominal 5 %:
-* 14.60 % false promotion at n = 40 on a paired-binary noninferiority boundary,
-* and 88.50 % at n = 6 under a bounded asymmetric null whose true mean paired
-* delta is exactly 0.
-*
-* At small n, where the percentile bootstrap is descriptive only, a
-* pre-registered exact sign test still carries the bootstrap path.
-*/
-function heldoutSignificance(paired, opts = {}) {
-	const deltaThreshold = opts.deltaThreshold ?? 0;
-	const confidence = opts.confidence ?? .95;
-	const resamples = opts.resamples ?? 2e3;
-	const seed = opts.seed ?? 1337;
-	const statistic = opts.statistic ?? "mean";
-	const decision = decidePairedPromotion(paired.before, paired.after, {
-		confidence,
-		resamples,
-		statistic,
-		seed,
-		threshold: deltaThreshold,
-		minPairs: opts.minProductiveRuns
-	});
-	const bootstrap = decision.bootstrap ?? pairedBootstrap(paired.before, paired.after, {
-		confidence,
-		resamples,
-		statistic,
-		seed
-	});
-	const medianBootstrap = statistic === "median" ? bootstrap : pairedBootstrap(paired.before, paired.after, {
-		confidence,
-		resamples,
-		statistic: "median",
-		seed
-	});
-	const n = paired.before.length;
-	let ties = 0;
-	for (let i = 0; i < n; i += 1) {
-		const after = paired.after[i] ?? 0;
-		const before = paired.before[i] ?? 0;
-		if (Math.abs(after - before) < 1e-9) ties += 1;
-	}
-	const tieFraction = n === 0 ? 0 : ties / n;
+function codec() {
 	return {
-		paired,
-		bootstrap,
-		medianBootstrap,
-		decision,
-		decisionStatistic: decision.statistic,
-		mcnemar: decision.mcnemar,
-		tieFraction,
-		n,
-		minimumRequired: decision.minimumPairs,
-		decisionMethod: decision.method,
-		pValue: decision.pValue,
-		significant: decision.promote,
-		fewRuns: !decision.sufficient
+		subject: "final evidence ledger",
+		header: { schema },
+		integrityError: (message, options) => new Error(message, options),
+		conflictError: (message) => new FinalEvidenceConflictError(message),
+		parseEntry: (raw, context) => {
+			const decoded = entrySchema.safeParse(raw);
+			if (!decoded.success) throw new Error(`final evidence ledger ${context.path}:${context.line} is invalid: ${decoded.error.message}`);
+			const parsed = decoded.data;
+			return {
+				...parsed,
+				previousHash: parsed.previousHash,
+				entryHash: parsed.entryHash
+			};
+		},
+		checkEntryHeader: (entry) => {
+			if (entry.schema !== schema) throw invalid("unsupported ledger schema");
+		},
+		createProjector: () => {
+			const records = /* @__PURE__ */ new Map();
+			const owners = /* @__PURE__ */ new Map();
+			const inputOwners = /* @__PURE__ */ new Map();
+			return {
+				apply: (entry) => {
+					const event = entry.event;
+					if (event.kind === "reserved") {
+						const reservation = normalizeReservation(event.reservation);
+						if (event.eventId !== `reserve:${reservation.requestId}` || records.has(reservation.requestId)) throw invalid("invalid or duplicate reservation identity");
+						const inputOwner = inputOwners.get(reservation.inputDigest);
+						if (inputOwner !== void 0) throw new FinalEvidenceConflictError(`final input is already reserved by '${inputOwner}'`);
+						for (const unitId of reservation.unitIds) {
+							const owner = owners.get(unitId);
+							if (owner !== void 0) throw new FinalEvidenceConflictError(`final unit '${unitId}' is already reserved by '${owner}'`);
+							owners.set(unitId, reservation.requestId);
+						}
+						inputOwners.set(reservation.inputDigest, reservation.requestId);
+						records.set(reservation.requestId, {
+							reservation,
+							reservationHash: entry.entryHash,
+							exposure: null
+						});
+					} else {
+						const record = records.get(event.requestId);
+						if (event.eventId !== `expose:${event.requestId}` || !record || record.exposure !== null) throw invalid("exposure requires one unexposed reservation");
+						record.exposure = {
+							measurement: normalizeMeasurement(event.measurement),
+							entryHash: entry.entryHash
+						};
+					}
+				},
+				finish: () => [...records.values()]
+			};
+		}
 	};
 }
-/** Detect the native scale of a set of scores: 0-100 when any magnitude clears
-*  1.5, else [0,1]. Used to auto-scale the regression tolerance so a default
-*  expressed for [0,1] is not silently a no-op on a 0-100 dimension. */
-function detectScale(values) {
-	return values.some((v) => Math.abs(v) > 1.5) ? 100 : 1;
-}
-/** Per-critical-dimension regression guard. For each dimension, pair the
-*  candidate vs baseline values by full cellId and bootstrap the paired delta;
-*  a dimension is "regressed" when the CI lower bound < −tolerance (conservative
-*  — blocks if the credible worst case exceeds tolerance, which is the right
-*  posture for safety dimensions like `hallucination_free`). When `tolerance`
-*  is omitted it auto-scales: 0.05 on [0,1], 5 on 0-100.
-*
-*  The interval comes from {@link decidePairedPromotion}, so a pass/fail
-*  dimension is judged on Tango's score interval rather than a percentile
-*  bootstrap of the mean — `tolerance` is a NONZERO margin, and the bootstrap
-*  is not a valid interval at one. That matters most here because this guard
-*  fails OPEN by construction: `tolerance` is positive, so an interval pinned at
-*  [0,0] never satisfies `low < −tolerance` and a real regression on a safety
-*  dimension would be reported as `regressed: false`. On the median it fails the
-*  same way for the same reason — when most pairs tie, which is automatic for a
-*  pass/fail dimension on {0,1} and on the 0-100 encoding `detectScale` exists
-*  to support, the median CI collapses to [0,0]. Pass `statistic: 'median'` to
-*  restore the pre-0.134 behaviour. */
-function dimensionRegressions(candidate, baseline, scenarioIds, criticalDimensions, opts = {}) {
-	const out = [];
-	for (const dim of criticalDimensions) {
-		const paired = pairHoldout(candidate, baseline, scenarioIds, (s) => s.dimensions[dim]);
-		if (paired.before.length === 0) continue;
-		const tolerance = opts.tolerance ?? .05 * detectScale([...paired.before, ...paired.after]);
-		const bootstrapStatistic = opts.statistic ?? "mean";
-		const shared = {
-			confidence: opts.confidence ?? .95,
-			resamples: opts.resamples ?? 2e3,
-			statistic: bootstrapStatistic,
-			seed: opts.seed ?? 1337
+async function outcome(operation) {
+	try {
+		return {
+			succeeded: true,
+			value: await operation()
+		};
+	} catch (error) {
+		return {
+			succeeded: false,
+			error: {
+				kind: error instanceof FinalEvidenceConflictError ? "conflict" : error instanceof TypeError || error instanceof z.ZodError ? "invalid" : "unavailable",
+				message: error instanceof Error ? error.message : String(error)
+			}
 		};
-		const guard = decidePairedPromotion(paired.before, paired.after, shared);
-		const regression = decidePairedPromotion(paired.after, paired.before, {
-			...shared,
-			threshold: tolerance
-		});
-		const bootstrap = guard.bootstrap ?? pairedBootstrap(paired.before, paired.after, shared);
-		out.push({
-			dimension: dim,
-			bootstrap,
-			bootstrapStatistic,
-			ci: {
-				low: guard.low,
-				high: guard.high
-			},
-			decisionStatistic: guard.statistic,
-			mcnemar: guard.mcnemar,
-			indeterminate: guard.indeterminate,
-			regressed: bootstrap.low < -tolerance || regression.promote,
-			tolerance,
-			n: paired.before.length
-		});
 	}
-	return out;
+}
+/** Uses the shared locked journal and requires its trusted head on every reopen. */
+function openFinalEvidenceLedger(options) {
+	if (!options.path.trim()) throw invalid("path is empty");
+	const journal = new FileLedgerJournal(options.path, codec(), { requireTrustedHead: true });
+	return {
+		reserve: (input) => outcome(async () => {
+			const reservation = normalizeReservation(input);
+			const result = await journal.append({
+				kind: "reserved",
+				eventId: `reserve:${reservation.requestId}`,
+				reservation
+			}, { pinHead: true });
+			const record = result.projection.find((item) => item.reservation.requestId === reservation.requestId);
+			if (!record) throw invalid("reserved record is missing after append");
+			return {
+				record,
+				replayed: !result.appended
+			};
+		}),
+		expose: (requestId, input) => outcome(async () => {
+			identity.parse(requestId);
+			const measurement = normalizeMeasurement(input);
+			const result = await journal.append({
+				kind: "exposed",
+				eventId: `expose:${requestId}`,
+				requestId,
+				measurement
+			}, { pinHead: true });
+			const record = result.projection.find((item) => item.reservation.requestId === requestId);
+			if (!record) throw invalid("exposed record is missing after append");
+			return {
+				record,
+				replayed: !result.appended
+			};
+		}),
+		read: () => outcome(async () => (await journal.replay()).projection)
+	};
 }
 //#endregion
 //#region src/campaign/gates/power-preflight.ts
@@ -862,10 +885,7 @@ function zFor(confidence) {
 	if (confidence >= .9) return 1.645;
 	return 1.282;
 }
-/** Estimate the minimum detectable lift a paired-holdout improvement run can
-*  ship at a given budget, from the baseline holdout composites — call it BEFORE
-*  spending a search to learn whether the effect you are hunting is even
-*  observable at this holdout size and worker variance. */
+/** Estimate detectable lift from baseline independent observations before budgeting a comparison. */
 function powerPreflight(opts) {
 	const composites = opts.baselineComposites.filter((v) => Number.isFinite(v));
 	if (composites.length < 3) throw new Error(`powerPreflight: need >= 3 finite baseline composites to estimate variance, got ${composites.length}`);
@@ -881,8 +901,8 @@ function powerPreflight(opts) {
 	const scaleAssumed = composites.every((v) => v >= -.001 && v <= 1.5);
 	const headroom = Math.max(0, 1 - mean);
 	const underpowered = scaleAssumed && mde > headroom;
-	const sharedChannelCaveat = opts.sharedScorerChannel ? "Holdout and gate share one scoring channel: raising n/reps reduces only idiosyncratic noise — systematic judge bias remains and this MDE is a lower bound. Full debiasing needs an independent second scoring channel (different judge/benchmark family)." : void 0;
-	const recommendation = underpowered ? `UNDERPOWERED: minimum detectable lift ${mde.toFixed(3)} exceeds the ${headroom.toFixed(3)} headroom above the baseline (${mean.toFixed(3)}) — no achievable effect can ship at this budget. Raise paired n (scenarios x reps) to ~${Math.ceil((z * Math.SQRT2 * sd / Math.max(headroom - deltaThreshold, .01)) ** 2)} or reduce worker variance before searching.` : `Minimum detectable lift at n=${n}: ${mde.toFixed(3)} (baseline sd ${sd.toFixed(3)}). Effects smaller than this cannot clear the gate; budget the search for effects you believe exceed it.`;
+	const sharedChannelCaveat = opts.sharedScorerChannel ? "Holdout and gate share one scoring channel: systematic judge bias remains outside this estimate. An independent second scoring channel can help test that bias." : void 0;
+	const recommendation = underpowered ? `UNDERPOWERED under this approximation: detectable lift ${mde.toFixed(3)} exceeds the ${headroom.toFixed(3)} headroom above the baseline (${mean.toFixed(3)}). Raise paired n using independent observations to ~${Math.ceil((z * Math.SQRT2 * sd / Math.max(headroom - deltaThreshold, .01)) ** 2)} or reduce observation variance. Recheck with measured paired deltas.` : `Approximate detectable lift at n=${n}: ${mde.toFixed(3)} (baseline sd ${sd.toFixed(3)}). Compare this estimate with the effect you expect, then recheck using measured paired deltas.`;
 	return {
 		n,
 		sd,
@@ -1202,6 +1222,35 @@ function parseReflectionResponse(raw, maxProposals) {
 * "composite of a campaign" and "per-scenario / per-dimension breakdown" so
 * the optimizers cannot drift on how a surface's score is computed.
 */
+/** Reduce complete paired cells using the same observation units as held-out inference. */
+function pairedCampaignComposites(baseline, candidate, independentUnitByScenarioId) {
+	const scoresByCell = (campaign) => {
+		const scores = /* @__PURE__ */ new Map();
+		for (const cell of campaign.cells) {
+			if (scores.has(cell.cellId)) throw new Error(`pairedCampaignComposites: duplicate cell '${cell.cellId}'`);
+			const quality = projectCampaignCellQuality(cell);
+			scores.set(cell.cellId, quality.score === void 0 ? {} : quality.successfulJudgeScores);
+		}
+		return scores;
+	};
+	const scenarioIds = new Set([...baseline.cells, ...candidate.cells].map((cell) => cell.scenarioId));
+	const paired = pairHoldout(scoresByCell(candidate), scoresByCell(baseline), scenarioIds, (score) => score.composite);
+	const observations = aggregatePairedHoldout(paired, independentUnitByScenarioId);
+	const scoredCellIds = new Set(paired.cellIds);
+	if (observations.before.length === 0) throw new Error("pairedCampaignComposites: campaigns have no paired quality scores");
+	return {
+		before: observations.before,
+		after: observations.after,
+		beforeMean: observations.before.reduce((sum, score) => sum + score, 0) / observations.before.length,
+		afterMean: observations.after.reduce((sum, score) => sum + score, 0) / observations.after.length,
+		observations: {
+			pairedCellN: paired.cellIds.length,
+			unitIds: observations.unitIds,
+			unscoredCellIds: baseline.cells.filter((cell) => !scoredCellIds.has(cell.cellId)).map((cell) => cell.cellId).sort(),
+			...independentUnitByScenarioId ? { independentUnitByScenarioId: Object.fromEntries([...scenarioIds].sort().map((id) => [id, independentUnitByScenarioId.get(id)])) } : {}
+		}
+	};
+}
 /** Mean composite across cells with complete task-quality evidence.
 *  Partial judge results remain on their cells but never enter this value.
 *  A campaign with no complete score has no numeric mean and fails loudly. */
@@ -1344,6 +1393,8 @@ function loopProvenanceArgsFromResult(input) {
 		...result.holdout === "deferred" ? { holdout: "deferred" } : {},
 		baselineOnHoldout: result.baselineOnHoldout,
 		winnerOnHoldout: result.winnerOnHoldout,
+		...result.claim ? { claim: result.claim } : {},
+		...input.independentUnitByScenarioId ? { independentUnitByScenarioId: input.independentUnitByScenarioId } : {},
 		...result.neutralizedSurface && result.neutralizedOnHoldout ? {
 			neutralizedSurface: result.neutralizedSurface,
 			neutralizedOnHoldout: result.neutralizedOnHoldout
@@ -1353,9 +1404,6 @@ function loopProvenanceArgsFromResult(input) {
 		totalDurationMs: input.totalDurationMs
 	};
 }
-function meanHoldoutComposite(campaign) {
-	return campaignMeanComposite(campaign);
-}
 /** Build the durable provenance record from a completed loop result. */
 function buildLoopProvenanceRecord(args) {
 	if (!args.runId.trim() || !args.runDir.trim()) throw new Error("buildLoopProvenanceRecord: runId and runDir must be non-empty");
@@ -1422,15 +1470,18 @@ function buildLoopProvenanceRecord(args) {
 	}
 	if (surfaceHash(args.winnerSurface) !== incumbentSurfaceHash) throw new Error("buildLoopProvenanceRecord: winner surface does not match the final promoted incumbent");
 	const holdoutDeferred = args.holdout === "deferred";
+	const claim = args.claim ? defineEvaluationClaim(args.claim) : void 0;
+	if (claim && !holdoutDeferred && args.independentUnitByScenarioId === void 0) throw new Error("buildLoopProvenanceRecord: a measured claim requires its independent-unit map");
 	if (args.baselineOnHoldout.splitDigest !== args.winnerOnHoldout.splitDigest) throw new Error("buildLoopProvenanceRecord: baseline and winner use different holdout splits");
 	if (args.neutralizedSurface === void 0 !== (args.neutralizedOnHoldout === void 0)) throw new Error("buildLoopProvenanceRecord: neutralized surface and campaign must be supplied together");
 	if (args.neutralizedOnHoldout && args.neutralizedOnHoldout.splitDigest !== args.baselineOnHoldout.splitDigest) throw new Error("buildLoopProvenanceRecord: neutralized campaign uses a different holdout split");
 	if (holdoutDeferred && args.neutralizedOnHoldout) throw new Error("buildLoopProvenanceRecord: a deferred holdout cannot include a neutralized measurement");
-	const holdoutMeasurement = holdoutDeferred ? { kind: "deferred" } : {
+	const holdoutScores = holdoutDeferred ? void 0 : pairedCampaignComposites(args.baselineOnHoldout, args.winnerOnHoldout, args.independentUnitByScenarioId);
+	const holdoutMeasurement = holdoutScores === void 0 ? { kind: "deferred" } : {
 		kind: "measured",
-		baseline: meanHoldoutComposite(args.baselineOnHoldout),
-		winner: meanHoldoutComposite(args.winnerOnHoldout),
-		...args.neutralizedOnHoldout ? { neutralized: meanHoldoutComposite(args.neutralizedOnHoldout) } : {}
+		baseline: holdoutScores.beforeMean,
+		winner: holdoutScores.afterMean,
+		...args.neutralizedOnHoldout ? { neutralized: pairedCampaignComposites(args.baselineOnHoldout, args.neutralizedOnHoldout, args.independentUnitByScenarioId).afterMean } : {}
 	};
 	const diff = surfaceContentHash(args.baselineSurface) === surfaceContentHash(args.winnerSurface) ? "" : renderSurfaceDiff(args.winnerSurface, args.baselineSurface);
 	const recordWithoutDigest = {
@@ -1451,6 +1502,7 @@ function buildLoopProvenanceRecord(args) {
 				splitDigest: args.baselineOnHoldout.splitDigest,
 				baselineCampaignDigest: campaignMeasurementDigest(args.baselineOnHoldout),
 				winnerCampaignDigest: campaignMeasurementDigest(args.winnerOnHoldout),
+				...holdoutScores ? { observations: holdoutScores.observations } : {},
 				...args.neutralizedSurface && args.neutralizedOnHoldout && holdoutMeasurement.kind === "measured" && holdoutMeasurement.neutralized !== void 0 ? { neutralized: {
 					contentHash: surfaceContentHash(args.neutralizedSurface),
 					campaignDigest: campaignMeasurementDigest(args.neutralizedOnHoldout),
@@ -1461,6 +1513,7 @@ function buildLoopProvenanceRecord(args) {
 			costReceiptsDigest: canonicalDigest([...args.costReceipts].sort((left, right) => compareCodeUnits(left.callId, right.callId)))
 		},
 		baselineSearchComposite,
+		...claim ? { claim } : {},
 		gate: {
 			decision: args.gate.decision,
 			reasons: args.gate.reasons,
@@ -1890,15 +1943,18 @@ function attest(report, provenance) {
 * canonicalizes) is a verification failure with the cause in `reason`, not a
 * crash — verifiers run in pipelines that must record WHY, not die.
 *
-* Legacy attestations without `envelopeHash` remain readable, but verification
-* explicitly marks their provenance as unbound so a promotion path can refuse
-* them instead of accidentally treating old metadata as cryptographic proof.
+* Both the report hash and the provenance envelope must verify.
+* Missing envelope hashes cannot establish provenance and fail verification.
 */
 function verifyAttestation(report, attested) {
 	if (attested.algorithm !== "sha256/canonical-json") return {
 		valid: false,
 		reason: `unknown algorithm '${attested.algorithm}' — this verifier only checks '${ATTESTATION_ALGORITHM}'`
 	};
+	if (typeof attested.envelopeHash !== "string" || !/^[0-9a-f]{64}$/.test(attested.envelopeHash)) return {
+		valid: false,
+		reason: "attestation envelope hash is missing or invalid"
+	};
 	let recomputed;
 	try {
 		recomputed = contentHash(report);
@@ -1912,10 +1968,6 @@ function verifyAttestation(report, attested) {
 		valid: false,
 		reason: `report hash mismatch: attested ${attested.reportHash}, recomputed ${recomputed}`
 	};
-	if (attested.envelopeHash === void 0) return {
-		valid: true,
-		legacyUnboundProvenance: true
-	};
 	let envelopeHash;
 	try {
 		envelopeHash = contentHash(envelopeMaterial(attested.reportHash, attested.provenance, attested.algorithm));
@@ -1989,10 +2041,8 @@ function createEvidenceReceipt(input, provenance) {
 	});
 }
 /**
-* Verify promotion-grade evidence. Generic report attestation keeps a legacy read path,
-* but an EvidenceReceipt never accepts unbound provenance: changing the evaluator code,
-* model versions, input commitment provenance, or creation record must invalidate the
-* evidence rather than merely annotating it as legacy.
+* Verify evidence identity and its provenance envelope. Changing the evaluator,
+* model versions, input commitment, or creation record invalidates the evidence.
 */
 function verifyEvidenceReceipt(receipt) {
 	if (receipt.binding.schemaVersion !== "1.0.0") return {
@@ -2018,13 +2068,7 @@ function verifyEvidenceReceipt(receipt) {
 			reason: error instanceof Error ? error.message : String(error)
 		};
 	}
-	const verification = verifyAttestation(receipt.binding, receipt.attestation);
-	if (!verification.valid) return verification;
-	if (verification.legacyUnboundProvenance === true || receipt.attestation.envelopeHash === void 0) return {
-		valid: false,
-		reason: "evidence receipt provenance is not bound by an attestation envelope"
-	};
-	return { valid: true };
+	return verifyAttestation(receipt.binding, receipt.attestation);
 }
 /**
 * Promotion may choose a stricter policy, but this primitive makes the basic separation
@@ -2078,6 +2122,6 @@ function createCampaignEvidenceReceipt(input) {
 	});
 }
 //#endregion
-export { campaignScenarioIdentity as $, detectScale as A, componentSurfaceIdentityMaterial as B, campaignMeanCompositeOrNull as C, recoverTruncatedJson as D, parseReflectionResponse as E, pairedDecisionShape as F, surfaceHashMatches as G, surfaceContentHash as H, minimumPairsForPairedDeltaTest as I, summarizeBackendIntegrity as J, BackendIntegrityError as K, pairedDeltaTest as L, heldoutSignificance as M, pairHoldout as N, powerPreflight as O, decidePairedPromotion as P, campaignCoverage as Q, assertCodeSurfaceIdentity as R, campaignMeanComposite as S, buildReflectionPrompt as T, surfaceDispatchRef as U, renderSurfaceDiff as V, surfaceHash as W, assertCampaignSplitIdentity as X, assertCampaignDesign as Y, assertCompleteCampaign as Z, provenanceRecordPath as _, createEvidenceReceipt as a, assertFiniteRankKey as b, ATTESTATION_ALGORITHM as c, buildLoopProvenanceRecord as d, campaignSplitDigest as et, campaignMeasurementDigest as f, loopProvenanceSpans as g, loopProvenanceArgsFromResult as h, INDEPENDENT_EVIDENCE_AUTHORITY_KINDS as i, dimensionRegressions as j, TIE_WARN_FRACTION as k, attest as l, emitLoopProvenance as m, EVIDENCE_AUTHORITY_KINDS as n, formatCoverageFailures as nt, isIndependentEvidence as o, canonicalDigest as p, assertRealBackend as q, EVIDENCE_RECEIPT_VERSION as r, verifyEvidenceReceipt as s, createCampaignEvidenceReceipt as t, campaignSplitDigestFromIdentities as tt, verifyAttestation as u, provenanceSpansPath as v, compareRankKeys as w, campaignBreakdown as x, verifyLoopProvenanceRecord as y, codeSurfaceIdentityMaterial as z };
+export { formatCoverageFailures as $, FinalEvidenceConflictError as A, surfaceDispatchRef as B, campaignMeanCompositeOrNull as C, parseReflectionResponse as D, buildReflectionPrompt as E, assertCodeSurfaceIdentity as F, summarizeBackendIntegrity as G, surfaceHashMatches as H, codeSurfaceIdentityMaterial as I, assertCompleteCampaign as J, assertCampaignDesign as K, componentSurfaceIdentityMaterial as L, openFinalEvidenceLedger as M, defineEvaluationClaim as N, recoverTruncatedJson as O, summarizeEvaluationUnits as P, campaignSplitDigestFromIdentities as Q, renderSurfaceDiff as R, campaignMeanComposite as S, pairedCampaignComposites as T, BackendIntegrityError as U, surfaceHash as V, assertRealBackend as W, campaignScenarioIdentity as X, campaignCoverage as Y, campaignSplitDigest as Z, provenanceRecordPath as _, createEvidenceReceipt as a, pairHoldout as at, assertFiniteRankKey as b, ATTESTATION_ALGORITHM as c, buildLoopProvenanceRecord as d, TIE_WARN_FRACTION as et, campaignMeasurementDigest as f, loopProvenanceSpans as g, loopProvenanceArgsFromResult as h, INDEPENDENT_EVIDENCE_AUTHORITY_KINDS as i, heldoutSignificance as it, FinalEvidenceError as j, powerPreflight as k, attest as l, emitLoopProvenance as m, EVIDENCE_AUTHORITY_KINDS as n, detectScale as nt, isIndependentEvidence as o, canonicalDigest as p, assertCampaignSplitIdentity as q, EVIDENCE_RECEIPT_VERSION as r, dimensionRegressions as rt, verifyEvidenceReceipt as s, createCampaignEvidenceReceipt as t, aggregatePairedHoldout as tt, verifyAttestation as u, provenanceSpansPath as v, compareRankKeys as w, campaignBreakdown as x, verifyLoopProvenanceRecord as y, surfaceContentHash as z };
 
-//# sourceMappingURL=campaign-evidence-D8DBLqLI.js.map
+//# sourceMappingURL=campaign-evidence-B8oF9xQ6.js.map