@tangle-network/agent-eval 0.188.0 → 0.190.0

package/dist/{llm-judge-DF18J3CR.js → llm-judge-bwbgDMP0.js}

@@ -3,26 +3,26 @@ import { a as hashCanonical, i as compareCodeUnits, r as canonicalString, t as L
 import { o as summarizeNumberSeries, s as weightedComposite, t as confidenceInterval } from "./descriptive-1V17A-qa.js";
 import { t as decidePairedPromotion } from "./paired-promotion-decision-6cn3bLc3.js";
 import { a as heldoutSignificance, i as dimensionRegressions, o as pairHoldout } from "./statistical-heldout-GcLIPxk4.js";
-import { i as modelHasSnapshot } from "./run-record-tg_5H2IK.js";
+import { i as modelHasSnapshot, l as searchCellRunId } from "./run-record-BRlM99rX.js";
 import { n as contentHash } from "./verdict-cache-BQEsVy9n.js";
-import { o as projectCampaignCellQuality, t as campaignCellCostProvenance } from "./run-record-CNNzWGpB.js";
+import { o as projectCampaignCellQuality, t as campaignCellCostProvenance } from "./run-record-DnMFyg_g.js";
 import { i as CostLedger, t as CostAccountingIncompleteError } from "./cost-ledger-_IbkejCF.js";
-import { $ as formatCoverageFailures, A as FinalEvidenceConflictError, B as surfaceDispatchRef, C as campaignMeanCompositeOrNull, H as surfaceHashMatches, J as assertCompleteCampaign, K as assertCampaignDesign, N as defineEvaluationClaim, P as summarizeEvaluationUnits, R as renderSurfaceDiff, S as campaignMeanComposite, U as BackendIntegrityError, V as surfaceHash, X as campaignScenarioIdentity, Y as campaignCoverage, Z as campaignSplitDigest, b as assertFiniteRankKey, j as FinalEvidenceError, q as assertCampaignSplitIdentity, t as createCampaignEvidenceReceipt, w as compareRankKeys, x as campaignBreakdown, z as surfaceContentHash } from "./campaign-evidence-IF1p0oDa.js";
-import { d as mapConcurrent, n as replayLedgerText, t as FileLedgerJournal } from "./journal-BuRLm6ho.js";
+import { A as FinalEvidenceConflictError, B as surfaceContentHash, C as campaignMeanCompositeOrNull, F as summarizeEvaluationUnits, H as surfaceHash, J as assertCampaignSplitIdentity, N as defineEvaluationClaim, P as evaluationClaimSchema, Q as campaignSplitDigest, S as campaignMeanComposite, U as surfaceHashMatches, V as surfaceDispatchRef, W as BackendIntegrityError, X as campaignCoverage, Y as assertCompleteCampaign, Z as campaignScenarioIdentity, b as assertFiniteRankKey, et as formatCoverageFailures, j as FinalEvidenceError, q as assertCampaignDesign, t as createCampaignEvidenceReceipt, w as compareRankKeys, x as campaignBreakdown, z as renderSurfaceDiff } from "./campaign-evidence-CWF8pEIk.js";
+import { d as mapConcurrent, n as replayLedgerText, t as FileLedgerJournal } from "./journal-CDP0Vhx_.js";
+import { t as deepFreezeCanonicalJson } from "./deep-freeze-CurcOQg3.js";
 import "./ledger-core/index.js";
-import { D as SearchLedgerIntegrityError, E as SearchLedgerError, S as fsCampaignStorage, T as SearchLedgerConflictError, g as isRecord, h as isExternalTextCandidate, w as SEARCH_LEDGER_FILE_CONTEXT, x as createRunCostLedger } from "./external-optimizer-subprocess-BrfsgL92.js";
-import { f as redactText, o as detectCredential, s as detectPersonalData } from "./redact-DxwlUAvh.js";
+import { D as SearchLedgerIntegrityError, E as SearchLedgerError, S as fsCampaignStorage, T as SearchLedgerConflictError, g as isRecord, h as isExternalTextCandidate, w as SEARCH_LEDGER_FILE_CONTEXT, x as createRunCostLedger } from "./external-optimizer-subprocess-C0dHXH8e.js";
+import { f as redactText, n as REDACTION_VERSION, o as detectCredential, s as detectPersonalData } from "./redact-8fX8-uKr.js";
 import { t as detectRewardHacking } from "./reward-hacking-D0XwhVWE.js";
 import { n as assertProposalFindings, t as combineAbortSignals } from "./abort-signal-CtzAM_sJ.js";
-import { a as deepFreezeCanonicalJson } from "./types-C8VBbiw6.js";
-import { d as stripFencedJson, o as costReceiptFromLlm, s as costReceiptFromLlmError, u as maximumChargeForLlmRequest } from "./llm-client-DF9bPNYA.js";
+import { d as stripFencedJson, o as costReceiptFromLlm, s as costReceiptFromLlmError, u as maximumChargeForLlmRequest } from "./llm-client-BqmRnibA.js";
 import { createHash } from "node:crypto";
 import { writeFileSync } from "node:fs";
 import { z } from "zod";
-import { basename, isAbsolute, join } from "node:path";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { homedir, tmpdir } from "node:os";
 import { execSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 //#region src/campaign/campaign-manifest.ts
 /**
 * Campaign identity: the manifest hash over (scenarios, judges, dispatch,
@@ -2531,6 +2531,22 @@ function paretoFrontierWithCrowding(candidates, objectives) {
 	return crowdingDistance(frontier, objectives).sort((a, b) => b.distance - a.distance);
 }
 //#endregion
+//#region src/campaign/types.ts
+/** Type guard: a proposal carrying its rationale vs a bare
+*  surface. The loop branches on this to populate `GenerationCandidate`. */
+function isProposedCandidate(value) {
+	return typeof value === "object" && value !== null && "surface" in value && "label" in value && "rationale" in value;
+}
+const LABEL_TRUST_RANK = {
+	unverified: 0,
+	"verified-signal": 1,
+	"human-rated": 2
+};
+/** Ordinal rank for a label-trust tier; absent ⇒ `unverified` (rank 0). */
+function labelTrustRank(trust) {
+	return LABEL_TRUST_RANK[trust ?? "unverified"];
+}
+//#endregion
 //#region src/campaign/search-ledger-ordering.ts
 function artifactKey(artifact) {
 	return canonicalString(artifact);
@@ -2539,337 +2555,848 @@ function compareStrings(a, b) {
 	return a < b ? -1 : a > b ? 1 : 0;
 }
 //#endregion
-//#region src/campaign/search-ledger-projector.ts
-/** Replay the campaign search state machine over chain-verified entries. The
-* generic journal owns sequence, hash, and eventId-uniqueness checks; this
-* projector owns every campaign invariant and builds the replay projection. */
-function createSearchLedgerProjector(campaignId) {
-	const candidates = /* @__PURE__ */ new Map();
-	const plannedSlots = /* @__PURE__ */ new Map();
-	const plannedOperations = /* @__PURE__ */ new Map();
-	const planExtensions = [];
-	const candidateBySlot = /* @__PURE__ */ new Map();
-	const closedSlots = /* @__PURE__ */ new Map();
-	const lineageNodes = /* @__PURE__ */ new Map();
-	const runIds = /* @__PURE__ */ new Set();
-	const attemptKeys = /* @__PURE__ */ new Set();
-	const candidateEvents = [];
-	const closedSlotEvents = [];
-	const attempts = [];
-	const operationEvents = [];
-	const operationsById = /* @__PURE__ */ new Map();
-	const decisions = [];
-	let planEvent = null;
-	let completion = null;
-	let previousOccurredAt = Number.NEGATIVE_INFINITY;
-	const apply = (entry, index) => {
+//#region src/campaign/search-ledger-types.ts
+/**
+* Schema tag every search-ledger entry carries. A ledger written under another
+* tag, such as the retired `tangle.search-ledger.v1` candidate-slot format, is
+* refused with its tag named; it is never translated.
+*/
+const SEARCH_LEDGER_SCHEMA = "tangle.search-ledger.2026-09";
+//#endregion
+//#region src/campaign/search-state.ts
+/**
+* `SearchState`: the one projection of a search ledger.
+*
+* The same code checks every invariant for the producer's journal, the kernel,
+* and the Intelligence verifier, and builds the read model they share. It keeps
+* compact indexes (nodes, edges, cells, per-unit score sums, running audit
+* totals), not the raw event list, and applies each entry in time proportional
+* to that entry, so a search of any length appends at a constant cost.
+*
+* The journal asks for a snapshot after every append. A snapshot is a
+* `SearchStateView` that reads the live indexes, so taking one costs nothing.
+* The view is valid until the state applies its next entry; a read after that
+* throws rather than returning numbers from a later ledger position. Read the
+* ledger's state again to see newer entries. The audit, header, head and claim
+* on a view are plain values and stay readable.
+*/
+/** Deterministic node id: identical content in one search is one node. */
+function searchNodeId(searchId, artifactDigest) {
+	return `node_${shortDigest([searchId, artifactDigest])}`;
+}
+/** Deterministic cell id: one node on one task in one split at one repeat. */
+function searchCellId(searchId, nodeId, taskId, split, rep) {
+	return `cell_${shortDigest([
+		searchId,
+		nodeId,
+		taskId,
+		split,
+		rep
+	])}`;
+}
+/** Digest a split's task list in taskId order. */
+function searchTaskSetDigest(tasks) {
+	return hashCanonical([...tasks].sort((left, right) => compareCodeUnits(left.taskId, right.taskId)));
+}
+/** 128 bits of SHA-256 over the canonical encoding: collision-safe and short
+* enough for directory names. */
+function shortDigest(value) {
+	return createHash("sha256").update(canonicalString(value)).digest("hex").slice(0, 32);
+}
+const MAX_LABEL_CHARS$1 = 200;
+const USD_TOLERANCE = 1e-9;
+const SPLITS = [
+	"train",
+	"selection",
+	"test"
+];
+/**
+* Per-unit means of scored cells, in unitId order. Each unit sums its cells in
+* cellId order, so the result depends on the set of cells alone, never on the
+* order they settled in: a verifier that reads the same cells from a database
+* gets the same bits.
+*/
+function searchUnitScores(cells) {
+	const byUnit = /* @__PURE__ */ new Map();
+	for (const cell of cells) {
+		const unit = byUnit.get(cell.unitId);
+		if (unit) unit.push(cell);
+		else byUnit.set(cell.unitId, [cell]);
+	}
+	return [...byUnit.entries()].sort(([left], [right]) => compareCodeUnits(left, right)).map(([unitId, unitCells]) => {
+		let sum = 0;
+		for (const cell of unitCells.sort((left, right) => compareCodeUnits(left.cellId, right.cellId))) sum += cell.score;
+		return {
+			unitId,
+			sum,
+			count: unitCells.length,
+			mean: sum / unitCells.length
+		};
+	});
+}
+/**
+* The pure, incremental projection of one search ledger. `apply` refuses any
+* entry that breaks an invariant; the journal then discards this instance and
+* replays into a new one, so a refused entry leaves no partial state behind.
+*/
+var SearchState = class {
+	searchId;
+	version = 0;
+	header = null;
+	closed = null;
+	head = null;
+	lastOccurredAt = Number.NEGATIVE_INFINITY;
+	lastOccurredAtText = null;
+	tasks = /* @__PURE__ */ new Map();
+	nodes = /* @__PURE__ */ new Map();
+	nodeOrder = [];
+	nodeByDigest = /* @__PURE__ */ new Map();
+	edges = /* @__PURE__ */ new Map();
+	edgeOrder = [];
+	cells = /* @__PURE__ */ new Map();
+	operations = /* @__PURE__ */ new Map();
+	selectedNodeId = null;
+	claimUsedUsd = 0;
+	audit;
+	constructor(searchId) {
+		this.searchId = searchId;
+		this.audit = {
+			searchId,
+			eventCount: 0,
+			headHash: null,
+			status: "open",
+			closeReason: null,
+			nodes: 0,
+			nodesWithoutEdge: 0,
+			undecidedNodes: 0,
+			selectedNodeId: null,
+			edges: {
+				explicit: 0,
+				correlated: 0,
+				unknown: 0,
+				reproposals: 0
+			},
+			cells: {
+				allocated: 0,
+				settled: 0,
+				cancelled: 0,
+				open: 0
+			},
+			attempts: 0,
+			outcomes: {
+				passed: 0,
+				failed: 0,
+				errored: 0
+			},
+			operations: {
+				started: 0,
+				recorded: 0,
+				open: 0
+			},
+			spend: {
+				knownUsd: 0,
+				floorUsd: 0,
+				unknownCostCells: 0,
+				unknownCostOperations: 0,
+				committedUsd: 0,
+				openReservationUsd: 0,
+				overspendUsd: 0,
+				unreservedCells: 0,
+				boxMinutes: 0
+			},
+			tokens: {
+				inputTokens: 0,
+				outputTokens: 0,
+				cachedTokens: 0,
+				unknownTokenAttempts: 0
+			}
+		};
+	}
+	apply(entry, index) {
 		const event = entry.event;
-		if (completion) throw new SearchLedgerIntegrityError(`event ${event.eventId} appears after terminal event ${completion.eventId}`);
+		if (this.closed) throw integrity(`event ${event.eventId} follows search-closed ${this.closed.eventId}`);
 		const occurredAt = Date.parse(event.occurredAt);
-		if (occurredAt < previousOccurredAt) throw new SearchLedgerIntegrityError(`event ${event.eventId} occurred before the preceding durable event`);
-		previousOccurredAt = occurredAt;
+		if (occurredAt < this.lastOccurredAt) throw integrity(`event ${event.eventId} occurred before the preceding event`);
 		assertUnique(event.artifacts.map(artifactKey), "artifact receipt", event.eventId);
-		if (event.kind === "search-planned") {
-			if (index !== 0 || planEvent) throw new SearchLedgerIntegrityError("search plan must be the first and only plan event");
-			assertUnique(event.plan.candidateSlots.map((slot) => slot.slotId), "candidate slot", event.eventId);
-			assertUnique(event.plan.tasks.map((task) => task.taskId), "planned taskId", event.eventId);
-			assertUnique(event.plan.operations.map((operation) => operation.operationId), "planned operationId", event.eventId);
-			for (const operation of event.plan.operations) plannedOperations.set(operation.operationId, operation);
-			for (const slot of event.plan.candidateSlots) {
-				assertSlotGenerationOperation(slot, plannedOperations);
-				plannedSlots.set(slot.slotId, slot);
+		if (event.kind === "search-opened") {
+			if (index !== 0 || this.header) throw integrity("search-opened must be the first and only opening event");
+			this.open(event);
+		} else {
+			if (!this.header) throw integrity(`event ${event.eventId} appears before search-opened`);
+			this.applyEvent(event, index);
+		}
+		this.lastOccurredAt = occurredAt;
+		this.lastOccurredAtText = event.occurredAt;
+		this.head = {
+			sequence: index,
+			entryHash: entry.entryHash
+		};
+		this.audit.eventCount = index + 1;
+		this.audit.headHash = entry.entryHash;
+		this.version += 1;
+	}
+	snapshot() {
+		return new SearchStateView(this, this.version);
+	}
+	/** @internal Views check this before every read of the live indexes. */
+	isAt(version) {
+		return this.version === version;
+	}
+	applyEvent(event, index) {
+		switch (event.kind) {
+			case "operation-started":
+				this.startOperation(event);
+				return;
+			case "operation-recorded":
+				this.recordOperation(event);
+				return;
+			case "node-registered":
+				this.registerNode(event, index);
+				return;
+			case "edge-recorded":
+				this.recordEdge(event, index);
+				return;
+			case "cell-allocated":
+				this.allocateCell(event, index);
+				return;
+			case "cell-settled":
+				this.settleCell(event, index);
+				return;
+			case "cell-cancelled":
+				this.cancelCell(event, index);
+				return;
+			case "node-decided":
+				this.decideNode(event, index);
+				return;
+			case "search-closed":
+				this.close(event);
+				return;
+		}
+	}
+	open(event) {
+		if (event.containment?.searchId === this.searchId) throw integrity("a search cannot contain itself");
+		if (event.derivedFrom?.searchId === this.searchId) throw integrity("a search cannot derive from itself");
+		const units = {
+			train: /* @__PURE__ */ new Set(),
+			selection: /* @__PURE__ */ new Set(),
+			test: /* @__PURE__ */ new Set()
+		};
+		for (const split of SPLITS) {
+			const { tasks, taskSetDigest } = event.splits[split];
+			if (searchTaskSetDigest(tasks) !== taskSetDigest) throw integrity(`the ${split} split's taskSetDigest does not match its tasks`);
+			for (const task of tasks) {
+				const owner = this.tasks.get(task.taskId);
+				if (owner) throw integrity(`task ${task.taskId} is in both the ${owner.split} and ${split} splits`);
+				this.tasks.set(task.taskId, {
+					split,
+					unitId: task.unitId
+				});
+				units[split].add(task.unitId);
 			}
-			planEvent = event;
-			return;
 		}
-		if (!planEvent) throw new SearchLedgerIntegrityError(`event ${event.eventId} appears before the required search plan`);
-		if (event.kind === "search-plan-extended") {
-			assertUnique(event.extension.candidateSlots.map((slot) => slot.slotId), "candidate slot", event.eventId);
-			assertUnique(event.extension.operations.map((operation) => operation.operationId), "planned operationId", event.eventId);
-			for (const operation of event.extension.operations) {
-				if (plannedOperations.has(operation.operationId)) throw new SearchLedgerIntegrityError(`plan extension ${event.eventId} re-plans operation ${operation.operationId}`);
-				plannedOperations.set(operation.operationId, operation);
+		if (event.splits.heldOutUnits) {
+			const seen = [...units.test].filter((unit) => units.train.has(unit) || units.selection.has(unit));
+			if (seen.length > 0) throw integrity(`test units ${seen.join(", ")} also appear in train or selection, but the splits declare heldOutUnits`);
+		}
+		const { budget } = event;
+		if (budget.maxUsd !== null && budget.reservedClaimUsd > budget.maxUsd + USD_TOLERANCE) throw integrity(`the claim reserve $${budget.reservedClaimUsd} exceeds the search cap $${budget.maxUsd}`);
+		this.header = event;
+	}
+	startOperation(event) {
+		if (this.operations.has(event.operationId)) throw integrity(`operation ${event.operationId} was started twice`);
+		this.admit(event.reservation, false, `operation ${event.operationId}`);
+		this.operations.set(event.operationId, {
+			operationId: event.operationId,
+			operationKind: event.operationKind,
+			reservation: event.reservation,
+			recorded: false,
+			spentUsd: 0
+		});
+		this.audit.operations.started += 1;
+		this.audit.operations.open += 1;
+		this.audit.spend.openReservationUsd += event.reservation?.usd ?? 0;
+	}
+	recordOperation(event) {
+		const operation = this.operations.get(event.operationId);
+		if (!operation) throw integrity(`operation ${event.operationId} was recorded before it started`);
+		if (operation.recorded) throw integrity(`operation ${event.operationId} was recorded twice`);
+		if (operation.operationKind !== event.operationKind) throw integrity(`operation ${event.operationId} started as ${operation.operationKind} but recorded as ${event.operationKind}`);
+		const cost = this.book(event.accounting);
+		if (cost.unknown) this.audit.spend.unknownCostOperations += 1;
+		const reserved = operation.reservation?.usd ?? 0;
+		this.audit.spend.openReservationUsd -= reserved;
+		if (operation.reservation) this.audit.spend.overspendUsd += Math.max(0, cost.usd - reserved);
+		operation.recorded = true;
+		operation.spentUsd = cost.usd;
+		this.audit.operations.recorded += 1;
+		this.audit.operations.open -= 1;
+	}
+	registerNode(event, index) {
+		const expected = searchNodeId(this.searchId, event.artifactDigest);
+		if (event.nodeId !== expected) throw integrity(`node ${event.nodeId} does not match its artifact digest (expected ${expected})`);
+		if (this.nodes.has(event.nodeId)) throw integrity(`node ${event.nodeId} was registered twice; a re-proposal is a second edge into it`);
+		assertUnique(event.surfaces.map((surface) => surface.surfaceId), "surfaceId", event.eventId);
+		const maxNodes = this.header.budget.maxNodes;
+		if (maxNodes !== null && this.nodes.size + 1 > maxNodes) throw integrity(`node ${event.nodeId} exceeds the search's maxNodes ${maxNodes}`);
+		this.nodes.set(event.nodeId, {
+			event,
+			ordinal: this.nodeOrder.length,
+			registeredSequence: index,
+			updatedSequence: index,
+			edgeIds: [],
+			parents: [],
+			parentKeys: /* @__PURE__ */ new Set(),
+			primaryParentId: null,
+			depth: null,
+			children: [],
+			decisions: [],
+			finalist: false,
+			cellIds: [],
+			scoredCells: 0,
+			spend: {
+				knownUsd: 0,
+				floorUsd: 0,
+				unknownCostCells: 0,
+				boxMinutes: 0
 			}
-			for (const slot of event.extension.candidateSlots) {
-				if (plannedSlots.has(slot.slotId)) throw new SearchLedgerIntegrityError(`plan extension ${event.eventId} re-plans candidate slot ${slot.slotId}`);
-				assertSlotGenerationOperation(slot, plannedOperations);
-				plannedSlots.set(slot.slotId, slot);
+		});
+		this.nodeOrder.push(event.nodeId);
+		this.nodeByDigest.set(event.artifactDigest, event.nodeId);
+		this.audit.nodes += 1;
+		this.audit.nodesWithoutEdge += 1;
+		this.audit.undecidedNodes += 1;
+	}
+	recordEdge(event, index) {
+		if (this.edges.has(event.edgeId)) throw integrity(`edge ${event.edgeId} was recorded twice`);
+		const child = this.nodes.get(event.childNodeId);
+		if (!child) throw integrity(`edge ${event.edgeId} names unregistered child ${event.childNodeId}`);
+		if (event.label.length > MAX_LABEL_CHARS$1) throw integrity(`edge ${event.edgeId} label exceeds ${MAX_LABEL_CHARS$1} characters`);
+		if (event.diffs.length !== event.parents.length) throw integrity(`edge ${event.edgeId} needs one diff per parent`);
+		assertUnique(event.parents.map((parent) => canonicalString(parent)), "parent", event.eventId);
+		const { operator, attribution, parents } = event;
+		if (operator === "seed" !== (event.proposer === null)) throw integrity(`edge ${event.edgeId}: exactly the seed edge has no proposer`);
+		if (operator === "seed" && (parents.length > 0 || attribution === "unknown")) throw integrity(`seed edge ${event.edgeId} must have no parents and a known attribution`);
+		if (attribution === "unknown" && parents.length > 0) throw integrity(`edge ${event.edgeId} has unknown attribution but names parents`);
+		if (operator !== "seed" && attribution !== "unknown" && parents.length === 0) throw integrity(`${operator} edge ${event.edgeId} names no parent`);
+		if (operator === "merge" && attribution !== "unknown" && parents.length < 2) throw integrity(`merge edge ${event.edgeId} needs at least two parents`);
+		const operationId = event.proposer?.operationId ?? null;
+		if (operationId !== null && !this.operations.has(operationId)) throw integrity(`edge ${event.edgeId} names operation ${operationId}, which never started`);
+		const inSearch = [];
+		for (const parent of parents) {
+			if (parent.searchId !== this.searchId) {
+				const from = this.header.derivedFrom;
+				if (operator !== "derive" || parents.length !== 1 || !from || from.searchId !== parent.searchId || from.nodeId !== parent.nodeId) throw integrity(`edge ${event.edgeId} names a parent in search ${parent.searchId}; only a derive edge matching derivedFrom may`);
+				continue;
 			}
-			planExtensions.push(event);
-			return;
+			if (operator === "derive") throw integrity(`derive edge ${event.edgeId} must name the parent in derivedFrom`);
+			const record = this.nodes.get(parent.nodeId);
+			if (!record) throw integrity(`edge ${event.edgeId} names unregistered parent ${parent.nodeId}`);
+			if (record.ordinal >= child.ordinal) throw integrity(`edge ${event.edgeId}: parent ${parent.nodeId} registered after child ${child.event.nodeId}`);
+			if (record.edgeIds.length === 0) throw integrity(`edge ${event.edgeId}: parent ${parent.nodeId} has no edge of its own yet`);
+			inSearch.push(record);
 		}
-		if (event.kind === "candidate-registered") {
-			if (candidates.has(event.candidateId)) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} was registered twice`);
-			const plannedSlot = plannedSlots.get(event.slotId);
-			if (!plannedSlot) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} binds unknown slot ${event.slotId}`);
-			if (candidateBySlot.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was bound twice`);
-			if (closedSlots.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was already closed`);
-			if (event.generationOperationId !== plannedSlot.generationOperationId) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} generation operation ${event.generationOperationId} does not match slot ${event.slotId} plan ${plannedSlot.generationOperationId}`);
-			const generationOperation = operationsById.get(event.generationOperationId);
-			if (!generationOperation) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} precedes generation operation ${event.generationOperationId}`);
-			if (generationOperation.outcome.status === "failed") throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} cannot bind failed generation operation ${event.generationOperationId}`);
-			const previousCandidate = lineageNodes.get(event.lineage.lineageNodeId);
-			if (previousCandidate) throw new SearchLedgerIntegrityError(`lineage node ${event.lineage.lineageNodeId} is already bound to ${previousCandidate}`);
-			assertUnique(event.lineage.parentCandidateIds, "parentCandidateId", event.eventId);
-			const parents = event.lineage.parentCandidateIds.map((id) => {
-				const parent = candidates.get(id);
-				if (!parent) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} references unknown parent ${id}`);
-				return parent;
-			});
-			const expectedGeneration = parents.length === 0 ? 0 : Math.max(...parents.map((parent) => parent.registered.lineage.generation)) + 1;
-			if (event.lineage.generation !== expectedGeneration) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} generation ${event.lineage.generation} does not follow its parents (expected ${expectedGeneration})`);
-			assertUnique(event.surfaces.map((surface) => surface.surfaceId), "surfaceId", event.eventId);
-			candidates.set(event.candidateId, {
-				registered: event,
-				attempts: [],
-				decision: null
-			});
-			candidateBySlot.set(event.slotId, event.candidateId);
-			lineageNodes.set(event.lineage.lineageNodeId, event.candidateId);
-			candidateEvents.push(event);
-			return;
+		if (child.edgeIds.length === 0) {
+			const primary = inSearch[0];
+			child.primaryParentId = primary?.event.nodeId ?? null;
+			child.depth = operator === "seed" || operator === "derive" ? 0 : primary && primary.depth !== null ? primary.depth + 1 : null;
+			this.audit.nodesWithoutEdge -= 1;
+		} else this.audit.edges.reproposals += 1;
+		child.edgeIds.push(event.edgeId);
+		for (const parent of parents) {
+			const key = canonicalString(parent);
+			if (child.parentKeys.has(key)) continue;
+			child.parentKeys.add(key);
+			child.parents.push(parent);
 		}
-		if (event.kind === "task-attempted") {
-			const candidate = candidates.get(event.candidateId);
-			if (!candidate) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} references unknown candidate ${event.candidateId}`);
-			if (candidate.decision) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} appears after candidate ${event.candidateId} was decided`);
-			const plannedTask = planEvent.plan.tasks.find((task) => task.taskId === event.task.taskId);
-			if (!plannedTask) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} references unplanned task ${event.task.taskId}`);
-			if (canonicalString(plannedTask.source) !== canonicalString(event.task.source) || canonicalString(plannedTask.benchmark) !== canonicalString(event.identity.benchmark)) throw new SearchLedgerIntegrityError(`task ${event.task.taskId} does not match its planned source identity`);
-			if (event.attemptIndex >= plannedTask.maxAttempts) throw new SearchLedgerIntegrityError(`task ${event.task.taskId} attempt ${event.attemptIndex} exceeds planned maxAttempts ${plannedTask.maxAttempts}`);
-			if (runIds.has(event.runId)) throw new SearchLedgerIntegrityError(`runId ${event.runId} was recorded twice`);
-			runIds.add(event.runId);
-			const attemptKey = canonicalString([
-				event.candidateId,
-				event.task.taskId,
-				event.attemptIndex
-			]);
-			if (attemptKeys.has(attemptKey)) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} attempt ${event.attemptIndex} was recorded twice`);
-			const expectedAttemptIndex = candidate.attempts.filter((attempt) => attempt.task.taskId === event.task.taskId).length;
-			if (event.attemptIndex !== expectedAttemptIndex) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} attempt index ${event.attemptIndex} is not contiguous (expected ${expectedAttemptIndex})`);
-			const previousAttempt = candidate.attempts.find((attempt) => attempt.task.taskId === event.task.taskId);
-			if (previousAttempt?.outcome.status !== void 0 && previousAttempt.outcome.status !== "errored") throw new SearchLedgerIntegrityError(`task ${event.task.taskId} was retried after a measured outcome`);
-			if (previousAttempt && canonicalString({
-				task: previousAttempt.task,
-				identity: previousAttempt.identity
-			}) !== canonicalString({
-				task: event.task,
-				identity: event.identity
-			})) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} task ${event.task.taskId} changed immutable execution identity between attempts`);
-			attemptKeys.add(attemptKey);
-			const declared = candidate.registered.surfaces.map((surface) => surface.surfaceId).sort();
-			const observed = event.surfaceEvidence.map((surface) => surface.surfaceId).sort();
-			assertUnique(observed, "surface evidence", event.eventId);
-			for (const evidence of event.surfaceEvidence) assertUnique(evidence.evidence.map(artifactKey), "surface evidence receipt", event.eventId);
-			if (canonicalString(declared) !== canonicalString(observed)) throw new SearchLedgerIntegrityError(`attempt ${event.eventId} surface evidence does not exactly cover candidate ${event.candidateId}`);
-			candidate.attempts.push(event);
-			attempts.push(event);
-			return;
+		for (const parent of inSearch) if (!parent.children.includes(child.event.nodeId)) parent.children.push(child.event.nodeId);
+		child.updatedSequence = index;
+		this.edges.set(event.edgeId, event);
+		this.edgeOrder.push(event.edgeId);
+		this.audit.edges[attribution] += 1;
+	}
+	allocateCell(event, index) {
+		const expected = searchCellId(this.searchId, event.nodeId, event.taskId, event.split, event.rep);
+		if (event.cellId !== expected) throw integrity(`cell ${event.cellId} does not match its coordinates (expected ${expected})`);
+		if (this.cells.has(event.cellId)) throw integrity(`cell ${event.cellId} was allocated twice`);
+		const node = this.nodes.get(event.nodeId);
+		if (!node) throw integrity(`cell ${event.cellId} names unregistered node ${event.nodeId}`);
+		if (node.edgeIds.length === 0) throw integrity(`cell ${event.cellId}: node ${event.nodeId} has no edge yet`);
+		const task = this.tasks.get(event.taskId);
+		if (!task || task.split !== event.split) throw integrity(`cell ${event.cellId}: task ${event.taskId} is not in the ${event.split} split`);
+		if (task.unitId !== event.unitId) throw integrity(`cell ${event.cellId}: task ${event.taskId} samples unit ${task.unitId}`);
+		assertStageSplit(event.cellId, event.stage, event.split, node.ordinal === 0);
+		if (event.split === "test" && node.ordinal !== 0 && !node.finalist) throw integrity(`cell ${event.cellId}: the test split is sealed; only the root and finalists run on it`);
+		const maxCells = this.header.budget.maxCells;
+		if (maxCells !== null && this.audit.cells.allocated + 1 > maxCells) throw integrity(`cell ${event.cellId} exceeds the search's maxCells ${maxCells}`);
+		this.admit(event.reservation, event.stage === "claim", `cell ${event.cellId}`);
+		this.cells.set(event.cellId, {
+			cellId: event.cellId,
+			nodeId: event.nodeId,
+			taskId: event.taskId,
+			unitId: event.unitId,
+			split: event.split,
+			rep: event.rep,
+			stage: event.stage,
+			lane: event.lane,
+			reservation: event.reservation,
+			attempts: 0,
+			lastRunId: null,
+			outcome: null,
+			score: null,
+			final: false,
+			cancelled: null,
+			spentUsd: 0,
+			costKnown: true,
+			traceId: null,
+			allocatedSequence: index,
+			updatedSequence: index
+		});
+		node.cellIds.push(event.cellId);
+		node.updatedSequence = index;
+		this.audit.cells.allocated += 1;
+		this.audit.cells.open += 1;
+		this.audit.spend.openReservationUsd += event.reservation?.usd ?? 0;
+		if (event.stage === "claim") this.claimUsedUsd += event.reservation?.usd ?? 0;
+	}
+	settleCell(event, index) {
+		const cell = this.cells.get(event.cellId);
+		if (!cell) throw integrity(`attempt ${event.eventId} names unallocated cell ${event.cellId}`);
+		if (cell.cancelled) throw integrity(`cell ${event.cellId} was settled after it was cancelled`);
+		if (cell.final) throw integrity(`cell ${event.cellId} was attempted again after a final ${cell.outcome} outcome; only a retryable error admits another attempt`);
+		if (event.attempt !== cell.attempts + 1) throw integrity(`cell ${event.cellId} attempt ${event.attempt} is not contiguous (expected ${cell.attempts + 1})`);
+		const runId = searchCellRunId({
+			cellId: event.cellId,
+			attempt: event.attempt
+		});
+		if (event.runId !== runId) throw integrity(`cell ${event.cellId} attempt ${event.attempt} must have runId ${runId}`);
+		const node = this.nodes.get(cell.nodeId);
+		const declared = new Set(node.event.surfaces.map((surface) => surface.surfaceId));
+		assertUnique(event.surfaceEvidence.map((evidence) => evidence.surfaceId), "surface evidence", event.eventId);
+		for (const evidence of event.surfaceEvidence) if (!declared.has(evidence.surfaceId)) throw integrity(`attempt ${event.eventId} reports surface ${evidence.surfaceId}, which node ${cell.nodeId} does not declare`);
+		if (event.artifacts.filter((artifact) => artifact.role === "run-record").length > 1) throw integrity(`attempt ${event.eventId} binds more than one RunRecord`);
+		const before = this.reservationParts(cell);
+		const cost = this.book(event.accounting);
+		if (cell.attempts === 0) {
+			this.audit.cells.settled += 1;
+			this.audit.cells.open -= 1;
+			if (cell.reservation === null) this.audit.spend.unreservedCells += 1;
 		}
-		if (event.kind === "search-operation-recorded") {
-			const plannedOperation = plannedOperations.get(event.operationId);
-			if (!plannedOperation) throw new SearchLedgerIntegrityError(`operation ${event.operationId} was not declared in the search plan`);
-			if (plannedOperation.kind !== event.operationKind) throw new SearchLedgerIntegrityError(`operation ${event.operationId} kind ${event.operationKind} does not match planned ${plannedOperation.kind}`);
-			if (operationsById.has(event.operationId)) throw new SearchLedgerIntegrityError(`operation ${event.operationId} was recorded twice`);
-			operationsById.set(event.operationId, event);
-			operationEvents.push(event);
-			return;
+		if (cost.unknown && cell.costKnown) {
+			cell.costKnown = false;
+			this.audit.spend.unknownCostCells += 1;
+			node.spend.unknownCostCells += 1;
 		}
-		if (event.kind === "candidate-slot-closed") {
-			const plannedSlot = plannedSlots.get(event.slotId);
-			if (!plannedSlot) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} references unknown slot ${event.slotId}`);
-			if (event.generationOperationId !== plannedSlot.generationOperationId) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} generation operation ${event.generationOperationId} does not match slot ${event.slotId} plan ${plannedSlot.generationOperationId}`);
-			if (candidateBySlot.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was already bound to a candidate`);
-			if (closedSlots.has(event.slotId)) throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} was closed twice`);
-			const operation = operationsById.get(event.generationOperationId);
-			if (!operation) throw new SearchLedgerIntegrityError(`candidate slot closure ${event.eventId} precedes operation ${event.generationOperationId}`);
-			if (operation.outcome.status === "completed") throw new SearchLedgerIntegrityError(`candidate slot ${event.slotId} cannot close from completed operation ${event.generationOperationId}`);
-			closedSlots.set(event.slotId, event);
-			closedSlotEvents.push(event);
-			return;
+		cell.attempts = event.attempt;
+		cell.lastRunId = runId;
+		cell.outcome = event.outcome.status;
+		cell.spentUsd += cost.usd;
+		cell.updatedSequence = index;
+		if ("traceId" in event.traceRef) cell.traceId = event.traceRef.traceId;
+		if (event.outcome.status === "errored") cell.final = !event.outcome.error.retryable;
+		else {
+			cell.final = true;
+			cell.score = event.outcome.score;
+			node.scoredCells += 1;
 		}
-		if (event.kind === "candidate-decided") {
-			const candidate = candidates.get(event.candidateId);
-			if (!candidate) throw new SearchLedgerIntegrityError(`decision ${event.eventId} references unknown candidate ${event.candidateId}`);
-			if (candidate.decision) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} was decided twice`);
-			if (event.decision.status === "selected") {
-				if (!candidate.attempts.some((attempt) => attempt.outcome.status !== "errored")) throw new SearchLedgerIntegrityError(`candidate ${event.candidateId} cannot be selected without a measured task outcome`);
-				if (decisions.some((decision) => decision.decision.status === "selected")) throw new SearchLedgerIntegrityError("more than one candidate was selected");
-			}
-			candidate.decision = event;
-			decisions.push(event);
-			return;
+		const after = this.reservationParts(cell);
+		this.audit.spend.openReservationUsd += after.open - before.open;
+		this.audit.spend.overspendUsd += after.over - before.over;
+		if (cell.stage === "claim") this.claimUsedUsd += after.used - before.used;
+		if (cost.unknown) node.spend.floorUsd += cost.usd;
+		else node.spend.knownUsd += cost.usd;
+		const boxMinutes = event.boxMinutes ?? 0;
+		node.spend.boxMinutes += boxMinutes;
+		this.audit.spend.boxMinutes += boxMinutes;
+		node.updatedSequence = index;
+		this.audit.attempts += 1;
+		this.audit.outcomes[event.outcome.status] += 1;
+	}
+	cancelCell(event, index) {
+		const cell = this.cells.get(event.cellId);
+		if (!cell) throw integrity(`cancellation ${event.eventId} names unallocated cell ${event.cellId}`);
+		if (cell.cancelled) throw integrity(`cell ${event.cellId} was cancelled twice`);
+		if (cell.final) throw integrity(`cell ${event.cellId} was cancelled after a final outcome`);
+		const before = this.reservationParts(cell);
+		cell.cancelled = event.reason;
+		cell.updatedSequence = index;
+		const after = this.reservationParts(cell);
+		this.audit.spend.openReservationUsd += after.open - before.open;
+		this.audit.spend.overspendUsd += after.over - before.over;
+		if (cell.stage === "claim") this.claimUsedUsd += after.used - before.used;
+		if (cell.attempts === 0) {
+			this.audit.cells.cancelled += 1;
+			this.audit.cells.open -= 1;
 		}
-		const missingCandidateSlots = [...plannedSlots.values()].filter((slot) => !candidateBySlot.has(slot.slotId) && !closedSlots.has(slot.slotId)).map((slot) => slot.slotId);
-		if (missingCandidateSlots.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing candidate slots: ${missingCandidateSlots.join(", ")}`);
-		const missingTaskOutcomes = plannedTaskOutcomeKeys(planEvent, candidates);
-		if (missingTaskOutcomes.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing task outcomes: ${missingTaskOutcomes.join(", ")}`);
-		const missingOperations = [...plannedOperations.values()].filter((operation) => !operationsById.has(operation.operationId)).map((operation) => operation.operationId);
-		if (missingOperations.length > 0) throw new SearchLedgerIntegrityError(`search completed with missing search operations: ${missingOperations.join(", ")}`);
-		for (const operation of plannedOperations.values()) {
-			if (operation.kind !== "candidate-generation") continue;
-			const generationOutcome = operationsById.get(operation.operationId).outcome.status;
-			const slots = [...plannedSlots.values()].filter((slot) => slot.generationOperationId === operation.operationId);
-			if (slots.length === 0) continue;
-			const registeredCount = slots.filter((slot) => candidateBySlot.has(slot.slotId)).length;
-			const closedCount = slots.filter((slot) => closedSlots.has(slot.slotId)).length;
-			if (generationOutcome === "completed" && closedCount > 0) throw new SearchLedgerIntegrityError(`completed generation operation ${operation.operationId} contains ${closedCount} closed slot(s)`);
-			if (generationOutcome === "failed" && registeredCount > 0) throw new SearchLedgerIntegrityError(`failed generation operation ${operation.operationId} contains ${registeredCount} registered candidate(s)`);
-			if (generationOutcome === "partial" && (registeredCount === 0 || closedCount === 0)) throw new SearchLedgerIntegrityError(`partial generation operation ${operation.operationId} must contain both a registered candidate and a closed slot`);
+		this.nodes.get(cell.nodeId).updatedSequence = index;
+	}
+	decideNode(event, index) {
+		const node = this.nodes.get(event.nodeId);
+		if (!node) throw integrity(`decision ${event.eventId} names unregistered node ${event.nodeId}`);
+		if (node.edgeIds.length === 0) throw integrity(`decision ${event.eventId}: node ${event.nodeId} has no edge yet`);
+		const status = event.decision.status;
+		if (status === "selected") {
+			if (this.selectedNodeId !== null && this.selectedNodeId !== event.nodeId) throw integrity(`node ${event.nodeId} was selected while ${this.selectedNodeId} is still selected`);
+			if (node.scoredCells === 0) throw integrity(`node ${event.nodeId} cannot be selected without a scored cell`);
 		}
-		const pending = [...candidates.values()].filter((candidate) => candidate.decision === null);
-		if (pending.length > 0) throw new SearchLedgerIntegrityError(`search completed with ${pending.length} candidate decision(s) missing`);
-		const selected = decisions.filter((decision) => decision.decision.status === "selected");
-		if (event.result.status === "selected") {
-			if (selected.length !== 1 || selected[0].candidateId !== event.result.candidateId) throw new SearchLedgerIntegrityError(`search completion winner ${event.result.candidateId} does not match candidate decisions`);
-		} else if (selected.length !== 0) throw new SearchLedgerIntegrityError("all-rejected completion contains a selected candidate");
-		completion = event;
-	};
-	const finish = (entries) => {
-		const selectedDecisions = decisions.filter((decision) => decision.decision.status === "selected");
-		const rejectedDecisions = decisions.filter((decision) => decision.decision.status === "rejected");
-		const outcomeCounts = {
-			passed: 0,
-			failed: 0,
-			errored: 0
+		const previous = node.decisions.at(-1)?.decision.status ?? null;
+		const wasUndecided = previous === null || previous === "advanced";
+		const isUndecided = status === "advanced";
+		this.audit.undecidedNodes += (isUndecided ? 1 : 0) - (wasUndecided ? 1 : 0);
+		if (previous === "selected" && status !== "selected") this.selectedNodeId = null;
+		if (status === "selected") this.selectedNodeId = event.nodeId;
+		if (status === "finalist") node.finalist = true;
+		node.decisions.push({
+			sequence: index,
+			decision: event.decision,
+			basis: event.basis,
+			rule: event.rule,
+			reason: event.reason
+		});
+		node.updatedSequence = index;
+		this.audit.selectedNodeId = this.selectedNodeId;
+	}
+	close(event) {
+		const reasons = this.incompleteReasons();
+		if (reasons.length > 0) throw integrity(`search-closed while incomplete: ${reasons.join("; ")}`);
+		if (event.claim) this.checkClaim(event.claim);
+		this.closed = event;
+		this.audit.status = "closed";
+		this.audit.closeReason = event.reason;
+		this.audit.spend.openReservationUsd = 0;
+	}
+	checkClaim(claim) {
+		if (claim.finalists.length > 3) throw integrity(`the claim names ${claim.finalists.length} finalists; at most 3 are allowed`);
+		assertUnique(claim.finalists.map((finalist) => finalist.nodeId), "claim finalist", "search-closed");
+		for (const finalist of claim.finalists) if (!this.nodes.get(finalist.nodeId)?.finalist) throw integrity(`claim finalist ${finalist.nodeId} was never decided finalist`);
+		if (claim.selected !== this.selectedNodeId) throw integrity(`the claim selects ${claim.selected ?? "nothing"} but the selected node is ${this.selectedNodeId ?? "none"}`);
+		const root = this.nodeOrder[0] ?? null;
+		if (claim.decision === "ship") {
+			const shipped = claim.finalists.find((finalist) => finalist.nodeId === claim.selected);
+			if (claim.selected === null || claim.selected === root || !shipped?.promote) throw integrity("a ship claim must select a finalist that the paired test promoted");
+			if (!this.header.splits.heldOutUnits) throw integrity("a ship claim needs test units held out from train and selection");
+		} else if (claim.selected !== null && claim.selected !== root) throw integrity(`a ${claim.decision} claim keeps the root; it cannot select another node`);
+		if (claim.decision === "test-cannot-resolve") {
+			for (const cell of this.cells.values()) if (cell.split === "test" && cell.attempts > 0) throw integrity("a test-cannot-resolve claim spends nothing on test cells");
+		}
+	}
+	/** @internal */
+	incompleteReasons() {
+		const reasons = [];
+		if (!this.header) reasons.push("search-opened is missing");
+		if (this.audit.cells.open > 0) reasons.push(count(this.audit.cells.open, "cell", "has no outcome"));
+		if (this.audit.operations.open > 0) reasons.push(count(this.audit.operations.open, "operation", "is unrecorded"));
+		if (this.audit.nodesWithoutEdge > 0) reasons.push(count(this.audit.nodesWithoutEdge, "node", "has no edge"));
+		if (this.audit.undecidedNodes > 0) reasons.push(count(this.audit.undecidedNodes, "node", "has no terminal decision"));
+		return reasons;
+	}
+	/** Book an attempt's or operation's accounting into the running totals. An
+	* unknown cost counts as its proven floor. */
+	book(accounting) {
+		const { tokens, cost } = accounting;
+		if (tokens.status === "known") {
+			this.audit.tokens.inputTokens += tokens.inputTokens;
+			this.audit.tokens.outputTokens += tokens.outputTokens;
+			this.audit.tokens.cachedTokens += tokens.cachedTokens;
+		} else this.audit.tokens.unknownTokenAttempts += 1;
+		const usd = cost.status === "known" ? cost.usd : cost.knownLowerBoundUsd;
+		if (cost.status === "known") this.audit.spend.knownUsd += usd;
+		else this.audit.spend.floorUsd += usd;
+		this.audit.spend.committedUsd += usd;
+		return {
+			usd,
+			unknown: cost.status === "unknown"
 		};
-		const operationOutcomeCounts = {
-			completed: 0,
-			partial: 0,
-			failed: 0
+	}
+	/** A cell's share of the open reservations, its overspend, and what it draws
+	* from the claim reserve: the larger of its hold and its spend. */
+	reservationParts(cell) {
+		const reserved = cell.reservation?.usd ?? 0;
+		const holding = !cell.final && cell.cancelled === null;
+		return {
+			open: holding ? Math.max(0, reserved - cell.spentUsd) : 0,
+			over: cell.reservation ? Math.max(0, cell.spentUsd - reserved) : 0,
+			used: holding ? Math.max(reserved, cell.spentUsd) : cell.spentUsd
 		};
-		let inputTokens = 0;
-		let outputTokens = 0;
-		let cachedTokens = 0;
-		let costUsd = 0;
-		const unknownTokenEventIds = [];
-		const unknownCostEventIds = [];
-		for (const attempt of attempts) outcomeCounts[attempt.outcome.status] += 1;
-		for (const operation of operationEvents) operationOutcomeCounts[operation.outcome.status] += 1;
-		for (const costedEvent of [...attempts, ...operationEvents]) {
-			if (costedEvent.accounting.tokens.status === "known") {
-				inputTokens += costedEvent.accounting.tokens.inputTokens;
-				outputTokens += costedEvent.accounting.tokens.outputTokens;
-				cachedTokens += costedEvent.accounting.tokens.cachedTokens;
-			} else unknownTokenEventIds.push(costedEvent.eventId);
-			if (costedEvent.accounting.cost.status === "known") costUsd += costedEvent.accounting.cost.usd;
-			else {
-				costUsd += costedEvent.accounting.cost.knownLowerBoundUsd;
-				unknownCostEventIds.push(costedEvent.eventId);
-			}
+	}
+	/** The admission rule: committed spend, open holds, the unspent claim
+	* reserve and the new hold stay within the cap. A claim cell draws on the
+	* claim reserve instead of adding to it. */
+	admit(reservation, claim, subject) {
+		const { maxUsd, reservedClaimUsd } = this.header.budget;
+		if (maxUsd === null) return;
+		const hold = reservation?.usd ?? 0;
+		const remainingClaim = Math.max(0, reservedClaimUsd - this.claimUsedUsd);
+		if (this.audit.spend.committedUsd + this.audit.spend.openReservationUsd + (claim ? Math.max(0, remainingClaim - hold) : remainingClaim) + hold > maxUsd + USD_TOLERANCE) throw integrity(`${subject} is not admissible: committed $${round(this.audit.spend.committedUsd)} + open $${round(this.audit.spend.openReservationUsd)} + claim reserve $${round(remainingClaim)} + hold $${round(hold)} exceeds the cap $${maxUsd}`);
+	}
+	/** @internal */
+	readHeader() {
+		return this.header;
+	}
+	/** @internal */
+	readClosed() {
+		return this.closed;
+	}
+	/** @internal */
+	readHead() {
+		return this.head;
+	}
+	/** @internal */
+	readLastOccurredAt() {
+		return this.lastOccurredAtText;
+	}
+	/** @internal */
+	readAudit() {
+		const audit = this.audit;
+		return {
+			...audit,
+			edges: { ...audit.edges },
+			cells: { ...audit.cells },
+			outcomes: { ...audit.outcomes },
+			operations: { ...audit.operations },
+			spend: { ...audit.spend },
+			tokens: { ...audit.tokens }
+		};
+	}
+	/** @internal */
+	readNode(nodeId) {
+		const record = this.nodes.get(nodeId);
+		return record ? nodeView(record) : void 0;
+	}
+	/** @internal */
+	readNodeIds() {
+		return this.nodeOrder;
+	}
+	/** @internal */
+	readHasNode(nodeId) {
+		return this.nodes.has(nodeId);
+	}
+	/** @internal */
+	readNodeIdForDigest(artifactDigest) {
+		return this.nodeByDigest.get(artifactDigest);
+	}
+	/** @internal */
+	readEdge(edgeId) {
+		return this.edges.get(edgeId);
+	}
+	/** @internal */
+	readEdgeIds() {
+		return this.edgeOrder;
+	}
+	/** @internal */
+	readCell(cellId) {
+		const cell = this.cells.get(cellId);
+		return cell ? { ...cell } : void 0;
+	}
+	/** @internal */
+	readCellIds(nodeId) {
+		if (nodeId === void 0) return [...this.cells.keys()];
+		return this.nodes.get(nodeId)?.cellIds ?? [];
+	}
+	/** @internal */
+	readOperation(operationId) {
+		const operation = this.operations.get(operationId);
+		return operation ? { ...operation } : void 0;
+	}
+	/** @internal */
+	readScoredCells(nodeId, split) {
+		const scored = [];
+		for (const cellId of this.nodes.get(nodeId)?.cellIds ?? []) {
+			const cell = this.cells.get(cellId);
+			if (cell.split === split && cell.score !== null) scored.push({
+				cellId,
+				unitId: cell.unitId,
+				attempt: cell.attempts,
+				score: cell.score
+			});
 		}
-		const accounting = unknownTokenEventIds.length === 0 && unknownCostEventIds.length === 0 ? {
-			status: "known",
-			inputTokens,
-			outputTokens,
-			cachedTokens,
-			costUsd
-		} : {
-			status: "partial",
-			knownInputTokens: inputTokens,
-			knownOutputTokens: outputTokens,
-			knownCachedTokens: cachedTokens,
-			knownCostUsd: costUsd,
-			unknownTokenEventIds,
-			unknownCostEventIds
+		return scored;
+	}
+};
+/**
+* A read of `SearchState` at one ledger position. Header, head, audit and
+* claim are values. Node, edge, cell and score reads go to the live indexes and
+* throw once the state has applied a later entry.
+*/
+var SearchStateView = class {
+	searchId;
+	header;
+	closed;
+	head;
+	/** `occurredAt` of the head entry; a writer stamps later events at or after it. */
+	lastOccurredAt;
+	audit;
+	completion;
+	state;
+	version;
+	constructor(state, version) {
+		this.state = state;
+		this.version = version;
+		this.searchId = state.searchId;
+		this.header = state.readHeader();
+		this.closed = state.readClosed();
+		this.head = state.readHead();
+		this.lastOccurredAt = state.readLastOccurredAt();
+		this.audit = state.readAudit();
+		const reasons = state.incompleteReasons();
+		if (!this.closed) reasons.unshift("search is open");
+		this.completion = {
+			complete: this.closed !== null,
+			reasons
 		};
-		const selectedCandidateId = completion?.result.status === "selected" ? completion.result.candidateId : null;
-		const status = completion?.result.status === "selected" ? "selected" : completion?.result.status === "all-rejected" ? "all-rejected" : "in-progress";
-		const missingCandidateSlots = [...plannedSlots.values()].filter((slot) => !candidateBySlot.has(slot.slotId) && !closedSlots.has(slot.slotId)).map((slot) => slot.slotId);
-		const missingTaskOutcomes = planEvent ? plannedTaskOutcomeKeys(planEvent, candidates) : [];
-		const missingOperations = [...plannedOperations.values()].filter((operation) => !operationsById.has(operation.operationId)).map((operation) => operation.operationId);
+	}
+	/** The node the search started from: the first registered. */
+	get rootNodeId() {
+		return this.live().readNodeIds()[0] ?? null;
+	}
+	node(nodeId) {
+		return this.live().readNode(nodeId);
+	}
+	hasNode(nodeId) {
+		return this.live().readHasNode(nodeId);
+	}
+	/** Node ids in registration order. */
+	nodeIds() {
+		return [...this.live().readNodeIds()];
+	}
+	/** Nodes in registration order. */
+	nodes() {
+		const state = this.live();
+		return state.readNodeIds().map((nodeId) => state.readNode(nodeId));
+	}
+	nodeIdForDigest(artifactDigest) {
+		return this.live().readNodeIdForDigest(artifactDigest);
+	}
+	edge(edgeId) {
+		return this.live().readEdge(edgeId);
+	}
+	/** Edges in ledger order. */
+	edges() {
+		const state = this.live();
+		return state.readEdgeIds().map((edgeId) => state.readEdge(edgeId));
+	}
+	cell(cellId) {
+		return this.live().readCell(cellId);
+	}
+	/** Cells in allocation order, optionally of one node. */
+	cells(filter = {}) {
+		const state = this.live();
+		return state.readCellIds(filter.nodeId).map((cellId) => state.readCell(cellId));
+	}
+	operation(operationId) {
+		return this.live().readOperation(operationId);
+	}
+	/** A node's scored cells on one split, in allocation order. Unscored cells
+	* (errored, cancelled or in flight) are absent, never zero. */
+	scoredCells(nodeId, split) {
+		return this.live().readScoredCells(nodeId, split);
+	}
+	/** Per-unit score means of a node on one split, in unitId order. */
+	unitScores(nodeId, split) {
+		return searchUnitScores(this.scoredCells(nodeId, split));
+	}
+	/** The lineage a RunRecord mint needs for one cell attempt. */
+	lineage(coordinates) {
+		const state = this.live();
+		if (coordinates.searchId !== this.searchId) throw new SearchLedgerError(`coordinates name search ${coordinates.searchId}, not ${this.searchId}`);
+		const cell = state.readCell(coordinates.cellId);
+		if (!cell || cell.nodeId !== coordinates.nodeId) throw new SearchLedgerError(`cell ${coordinates.cellId} of node ${coordinates.nodeId} is not in search ${this.searchId}`);
+		if (coordinates.attempt < 1 || coordinates.attempt > cell.attempts) throw new SearchLedgerError(`cell ${coordinates.cellId} has ${cell.attempts} settled attempt(s), not attempt ${coordinates.attempt}`);
+		const node = state.readNode(cell.nodeId);
+		if (node.depth === null) throw new SearchLedgerError(`node ${node.nodeId} has unknown lineage, so its depth is unknown`);
+		const containment = this.header?.containment ?? null;
 		return {
-			entries: [...entries],
-			plan: planEvent,
-			planExtensions,
-			candidates: candidateEvents,
-			closedCandidateSlots: closedSlotEvents,
-			attempts,
-			operations: operationEvents,
-			decisions,
-			completion,
-			audit: {
-				campaignId,
-				eventCount: entries.length,
-				candidateCount: candidates.size,
-				closedCandidateSlotCount: closedSlots.size,
-				attemptCount: attempts.length,
-				operationCount: operationEvents.length,
-				outcomes: outcomeCounts,
-				operationOutcomes: operationOutcomeCounts,
-				decisions: {
-					selected: selectedDecisions.length,
-					rejected: rejectedDecisions.length,
-					pending: candidates.size - decisions.length
-				},
-				expected: {
-					candidateSlots: plannedSlots.size,
-					taskOutcomes: candidates.size * (planEvent?.plan.tasks.length ?? 0),
-					operations: plannedOperations.size,
-					missingCandidateSlots,
-					missingTaskOutcomes,
-					missingOperations
-				},
-				status,
-				selectedCandidateId,
-				accounting,
-				headHash: entries.at(-1)?.entryHash ?? null
-			}
+			depth: node.depth,
+			ordinal: node.ordinal,
+			rep: cell.rep,
+			containingRunId: containment ? searchCellRunId({
+				cellId: containment.cellId,
+				attempt: containment.attempt
+			}) : null
 		};
-	};
+	}
+	live() {
+		if (!this.state.isAt(this.version)) throw new SearchLedgerError(`this SearchStateView is from sequence ${this.head?.sequence ?? -1}, and the ledger has moved on; read the ledger's state again`);
+		return this.state;
+	}
+};
+function nodeView(record) {
+	const latest = record.decisions.at(-1)?.decision ?? null;
 	return {
-		apply,
-		finish
+		nodeId: record.event.nodeId,
+		ordinal: record.ordinal,
+		artifactDigest: record.event.artifactDigest,
+		artifact: record.event.artifact,
+		surfaces: record.event.surfaces,
+		primaryParentId: record.primaryParentId,
+		depth: record.depth,
+		parents: [...record.parents],
+		children: [...record.children],
+		edgeIds: [...record.edgeIds],
+		status: latest?.status ?? null,
+		rung: latest?.status === "advanced" ? latest.rung : null,
+		finalist: record.finalist,
+		decisions: [...record.decisions],
+		cellCount: record.cellIds.length,
+		spend: { ...record.spend },
+		registeredSequence: record.registeredSequence,
+		updatedSequence: record.updatedSequence
 	};
 }
-/** Every candidate slot must name a planned candidate-generation operation,
-* whether it arrives with the plan or with a later extension. */
-function assertSlotGenerationOperation(slot, plannedOperations) {
-	if (plannedOperations.get(slot.generationOperationId)?.kind !== "candidate-generation") throw new SearchLedgerIntegrityError(`candidate slot ${slot.slotId} references unplanned candidate-generation operation ${slot.generationOperationId}`);
-}
-function plannedTaskOutcomeKeys(planEvent, candidates) {
-	const missing = [];
-	const registeredCandidates = [...candidates.values()].sort((a, b) => compareStrings(a.registered.slotId, b.registered.slotId));
-	for (const candidate of registeredCandidates) {
-		const slotId = candidate.registered.slotId;
-		for (const task of planEvent.plan.tasks) if (!candidate.attempts.some((attempt) => attempt.task.taskId === task.taskId && attempt.outcome.status !== "errored")) missing.push(`${slotId}/${task.taskId}`);
-	}
-	return missing;
+function assertStageSplit(cellId, stage, split, isRoot) {
+	if (!{
+		root: ["train", "selection"],
+		train: ["train"],
+		screen: ["selection"],
+		rung: ["selection"],
+		claim: ["test"],
+		external: ["train", "selection"]
+	}[stage].includes(split)) throw integrity(`cell ${cellId}: a ${stage} cell cannot run on the ${split} split`);
+	if (stage === "root" && !isRoot) throw integrity(`cell ${cellId}: only the root node runs root cells`);
 }
 function assertUnique(values, label, eventId) {
-	if (new Set(values).size !== values.length) throw new SearchLedgerIntegrityError(`event ${eventId} contains duplicate ${label} values`);
+	if (new Set(values).size !== values.length) throw integrity(`event ${eventId} contains duplicate ${label} values`);
+}
+function count(value, noun, predicate) {
+	const verb = predicate.replace(/^(has|is) /, (word) => value === 1 ? word : word === "has " ? "have " : "are ");
+	return `${value} ${value === 1 ? noun : `${noun}s`} ${verb}`;
+}
+function round(usd) {
+	return Math.round(usd * 1e6) / 1e6;
+}
+function integrity(message) {
+	return new SearchLedgerIntegrityError(message);
 }
-//#endregion
-//#region src/campaign/search-ledger-types.ts
-const SEARCH_LEDGER_SCHEMA = "tangle.search-ledger.v1";
 //#endregion
 //#region src/campaign/search-ledger.ts
 /**
-* Durable append-only audit log for improvement searches.
+* Durable, append-only event log of one search: nodes (content-addressed
+* artifacts), edges (the proposals that derived them), cells (one run of one
+* node on one task), operations, decisions, and the claim.
 *
-* Existing campaign artifacts keep their own rich records: `RunRecord` owns a
-* measured run and `CostLedger` owns per-call accounting. This ledger does not
-* copy those structures. It binds their immutable ids and receipts into one replayable event stream so a
-* search can answer, after a crash, exactly which candidates and task attempts
-* existed, which surfaces actually fired, what they cost, and why they were
-* selected or rejected.
+* The ledger is the search's only lineage record and its only resume
+* checkpoint. A RunRecord owns one measured run and `CostLedger` owns per-call
+* accounting; this ledger binds them by digest instead of copying them.
 *
 * The file format is canonical JSONL with a SHA-256 hash chain. Every append is
 * serialized across processes, fsynced before acknowledgement, and idempotent
 * by `eventId`. A malformed, non-canonical, truncated, reordered, or conflicting
-* log fails loudly; the implementation never skips a bad row.
+* log fails loudly; a bad row is never skipped. A ledger written under another
+* schema tag is refused with that tag named, never translated.
 *
-* The journal machinery itself (hash chain, locking, fsync, idempotent append)
-* is the generic `ledger-core` journal; this module supplies the campaign
-* codec: event schemas, canonical event ordering, and the search state machine.
+* The journal machinery is the generic `ledger-core` journal. This module is
+* the search codec: event schemas and canonical ordering. `SearchState` is the
+* state machine and read model.
 */
 const NON_EMPTY = z.string().min(1).refine((value) => value.trim() === value, "must not contain surrounding whitespace");
 const HASH = z.string().regex(/^sha256:[a-f0-9]{64}$/);
-const LINEAGE_NODE_ID = z.string().regex(/^[a-f0-9]{16}$/);
 const IMMUTABLE_REVISION = z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|sha256:[a-f0-9]{64}|sha512:[A-Za-z0-9+/=]+)$/);
 const ISO_TIMESTAMP = z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/).refine((value) => Number.isFinite(Date.parse(value)), "invalid timestamp");
 const NON_NEGATIVE_INT = z.number().int().nonnegative().safe();
+const POSITIVE_INT = z.number().int().positive().safe();
 const FINITE_NUMBER = z.number().finite();
+const USD = z.number().finite().nonnegative();
+const NODE_ID = z.string().regex(/^node_[a-f0-9]{32}$/);
+const CELL_ID = z.string().regex(/^cell_[a-f0-9]{32}$/);
 const ArtifactRefSchema = z.object({
 	role: NON_EMPTY,
 	uri: NON_EMPTY,
@@ -2880,14 +3407,47 @@ const SourceRefSchema = z.object({
 	uri: NON_EMPTY,
 	revision: IMMUTABLE_REVISION
 }).strict();
+const UnknownRefSchema = z.object({ unknown: NON_EMPTY }).strict();
 const FailureReasonSchema = z.object({
 	code: NON_EMPTY,
 	message: NON_EMPTY
 }).strict();
+const ModelIdentitySchema = z.union([z.object({
+	provider: NON_EMPTY,
+	snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
+}).strict(), z.object({
+	provider: NON_EMPTY,
+	alias: NON_EMPTY,
+	unknown: NON_EMPTY
+}).strict()]);
+const ExecutionIdentitySchema = z.object({
+	model: ModelIdentitySchema,
+	agent: SourceRefSchema,
+	benchmark: SourceRefSchema
+}).strict();
+const SURFACE_KINDS = [
+	"prompt",
+	"tool-contract",
+	"runtime-config",
+	"memory",
+	"knowledge",
+	"agent-profile",
+	"code",
+	"deployment"
+];
+const SPLIT = z.enum([
+	"train",
+	"selection",
+	"test"
+]);
+const ReservationSchema = z.object({
+	kind: z.enum(["hard", "estimate"]),
+	usd: USD
+}).strict();
 const EventBaseShape = {
 	eventId: NON_EMPTY,
 	occurredAt: ISO_TIMESTAMP,
-	artifacts: z.array(ArtifactRefSchema).min(1)
+	artifacts: z.array(ArtifactRefSchema)
 };
 const OperationKindSchema = z.enum([
 	"candidate-generation",
@@ -2896,89 +3456,19 @@ const OperationKindSchema = z.enum([
 	"judge",
 	"other"
 ]);
-const CandidateSlotSchema = z.object({
-	slotId: NON_EMPTY,
-	generationOperationId: NON_EMPTY
-}).strict();
-const PlannedOperationSchema = z.object({
-	operationId: NON_EMPTY,
-	kind: OperationKindSchema
-}).strict();
-const SearchPlanExtendedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("search-plan-extended"),
-	extension: z.object({
-		candidateSlots: z.array(CandidateSlotSchema),
-		operations: z.array(PlannedOperationSchema)
-	}).strict().superRefine((extension, ctx) => {
-		if (extension.candidateSlots.length === 0 && extension.operations.length === 0) ctx.addIssue({
-			code: "custom",
-			message: "a plan extension must add slots or operations"
-		});
-	})
-}).strict();
-const SearchPlannedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("search-planned"),
-	plan: z.object({
-		candidateSlots: z.array(CandidateSlotSchema).min(1),
-		tasks: z.array(z.object({
-			taskId: NON_EMPTY,
-			source: SourceRefSchema,
-			benchmark: SourceRefSchema,
-			maxAttempts: z.number().int().positive().safe()
-		}).strict()).min(1),
-		operations: z.array(PlannedOperationSchema).min(1)
-	}).strict()
-}).strict();
-const CandidateRegisteredSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("candidate-registered"),
-	slotId: NON_EMPTY,
-	generationOperationId: NON_EMPTY,
-	candidateId: NON_EMPTY,
-	lineage: z.object({
-		lineageNodeId: LINEAGE_NODE_ID,
-		parentCandidateIds: z.array(NON_EMPTY),
-		generation: NON_NEGATIVE_INT,
-		proposer: NON_EMPTY,
-		proposerSource: SourceRefSchema
-	}).strict(),
-	surfaces: z.array(z.object({
-		surfaceId: NON_EMPTY,
-		kind: z.enum([
-			"prompt",
-			"tool-contract",
-			"runtime-config",
-			"memory",
-			"knowledge",
-			"agent-profile",
-			"code",
-			"deployment"
-		]),
-		artifact: ArtifactRefSchema
-	}).strict()).min(1)
-}).strict();
-const CandidateSlotClosedSchema = z.object({
-	...EventBaseShape,
-	kind: z.literal("candidate-slot-closed"),
-	slotId: NON_EMPTY,
-	generationOperationId: NON_EMPTY,
-	reason: FailureReasonSchema
-}).strict();
 const KnownTokensSchema = z.object({
 	status: z.literal("known"),
 	inputTokens: NON_NEGATIVE_INT,
 	outputTokens: NON_NEGATIVE_INT,
 	cachedTokens: NON_NEGATIVE_INT
 }).strict();
-const UnknownSchema = z.object({
+const UnknownTokensSchema = z.object({
 	status: z.literal("unknown"),
 	reason: NON_EMPTY
 }).strict();
 const KnownCostSchema = z.object({
 	status: z.literal("known"),
-	usd: z.number().finite().nonnegative(),
+	usd: USD,
 	source: z.enum([
 		"provider",
 		"pricing-table",
@@ -2992,11 +3482,11 @@ const KnownCostSchema = z.object({
 });
 const UnknownCostSchema = z.object({
 	status: z.literal("unknown"),
-	knownLowerBoundUsd: z.number().finite().nonnegative(),
+	knownLowerBoundUsd: USD,
 	reason: NON_EMPTY
 }).strict();
 const AccountingSchema = z.object({
-	tokens: z.discriminatedUnion("status", [KnownTokensSchema, UnknownSchema]),
+	tokens: z.discriminatedUnion("status", [KnownTokensSchema, UnknownTokensSchema]),
 	cost: z.discriminatedUnion("status", [KnownCostSchema, UnknownCostSchema])
 }).strict();
 const MetricsSchema = z.record(NON_EMPTY, FINITE_NUMBER).superRefine((metrics, ctx) => {
@@ -3047,52 +3537,85 @@ const SurfaceEvidenceSchema = z.object({
 	effect: EffectSchema,
 	evidence: z.array(ArtifactRefSchema).min(1)
 }).strict().superRefine((evidence, ctx) => {
-	if (evidence.fired && evidence.firingCount === 0) ctx.addIssue({
-		code: "custom",
-		message: "a fired surface must have firingCount >= 1"
-	});
-	if (!evidence.fired && evidence.firingCount !== 0) ctx.addIssue({
+	if (evidence.fired !== evidence.firingCount > 0) ctx.addIssue({
 		code: "custom",
-		message: "a surface that did not fire must have firingCount 0"
+		message: "fired must equal firingCount > 0"
 	});
 	if (!evidence.fired && evidence.effect.status === "measured" && evidence.effect.delta !== 0) ctx.addIssue({
 		code: "custom",
-		message: "a surface that did not fire cannot claim non-zero effect"
+		message: "a surface that did not fire has no effect"
 	});
 });
-const TaskAttemptedSchema = z.object({
+const TaskSchema = z.object({
+	taskId: NON_EMPTY,
+	unitId: NON_EMPTY,
+	source: SourceRefSchema
+}).strict();
+const SplitTasksSchema = z.object({
+	taskSetDigest: HASH,
+	tasks: z.array(TaskSchema)
+}).strict();
+const SearchOpenedSchema = z.object({
 	...EventBaseShape,
-	kind: z.literal("task-attempted"),
-	candidateId: NON_EMPTY,
-	runId: NON_EMPTY,
-	attemptIndex: NON_NEGATIVE_INT,
-	task: z.object({
-		taskId: NON_EMPTY,
-		source: SourceRefSchema
+	kind: z.literal("search-opened"),
+	subject: NON_EMPTY,
+	process: z.object({
+		name: NON_EMPTY,
+		executionRef: SourceRefSchema
 	}).strict(),
-	identity: z.object({
-		model: z.object({
-			provider: NON_EMPTY,
-			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
-		}).strict(),
-		agent: SourceRefSchema,
-		benchmark: SourceRefSchema
+	artifactKind: z.enum([...SURFACE_KINDS, "output"]),
+	objective: z.object({
+		metric: NON_EMPTY,
+		direction: z.enum(["maximize", "minimize"]),
+		judge: z.union([SourceRefSchema, UnknownRefSchema]),
+		claim: evaluationClaimSchema
 	}).strict(),
-	outcome: OutcomeSchema,
-	accounting: AccountingSchema,
-	surfaceEvidence: z.array(SurfaceEvidenceSchema).min(1)
+	splits: z.object({
+		train: SplitTasksSchema,
+		selection: SplitTasksSchema,
+		test: SplitTasksSchema,
+		heldOutUnits: z.boolean()
+	}).strict(),
+	policy: z.object({
+		expansion: NON_EMPTY,
+		allocation: NON_EMPTY,
+		seed: z.number().int().safe()
+	}).strict(),
+	budget: z.object({
+		maxUsd: USD.nullable(),
+		maxCells: POSITIVE_INT.nullable(),
+		maxNodes: POSITIVE_INT.nullable(),
+		deadline: ISO_TIMESTAMP.nullable(),
+		maxConcurrency: POSITIVE_INT.nullable(),
+		reservedClaimUsd: USD
+	}).strict(),
+	containment: z.object({
+		searchId: NON_EMPTY,
+		cellId: CELL_ID,
+		attempt: POSITIVE_INT
+	}).strict().nullable(),
+	derivedFrom: z.object({
+		searchId: NON_EMPTY,
+		nodeId: NODE_ID,
+		headHash: HASH
+	}).strict().nullable(),
+	identity: ExecutionIdentitySchema
 }).strict();
-const SearchOperationRecordedSchema = z.object({
+const OperationStartedSchema = z.object({
 	...EventBaseShape,
-	kind: z.literal("search-operation-recorded"),
+	kind: z.literal("operation-started"),
+	operationId: NON_EMPTY,
+	operationKind: OperationKindSchema,
+	reservation: ReservationSchema.nullable()
+}).strict();
+const OperationRecordedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("operation-recorded"),
 	operationId: NON_EMPTY,
 	operationKind: OperationKindSchema,
 	execution: z.discriminatedUnion("kind", [z.object({
 		kind: z.literal("model"),
-		model: z.object({
-			provider: NON_EMPTY,
-			snapshot: NON_EMPTY.refine(modelHasSnapshot, "model must include an immutable snapshot")
-		}).strict(),
+		model: ModelIdentitySchema,
 		source: SourceRefSchema
 	}).strict(), z.object({
 		kind: z.literal("deterministic"),
@@ -3111,95 +3634,257 @@ const SearchOperationRecordedSchema = z.object({
 	]),
 	accounting: AccountingSchema
 }).strict();
-const CandidateDecidedSchema = z.object({
+const NodeRegisteredSchema = z.object({
 	...EventBaseShape,
-	kind: z.literal("candidate-decided"),
-	candidateId: NON_EMPTY,
-	decision: z.discriminatedUnion("status", [z.object({ status: z.literal("selected") }).strict(), z.object({
-		status: z.literal("rejected"),
-		reason: FailureReasonSchema
-	}).strict()])
+	kind: z.literal("node-registered"),
+	nodeId: NODE_ID,
+	artifactDigest: HASH,
+	artifact: ArtifactRefSchema,
+	surfaces: z.array(z.object({
+		surfaceId: NON_EMPTY,
+		kind: z.enum(SURFACE_KINDS),
+		artifact: ArtifactRefSchema
+	}).strict())
+}).strict();
+const NodeRefSchema = z.object({
+	searchId: NON_EMPTY,
+	nodeId: NODE_ID
 }).strict();
-const SearchCompletedSchema = z.object({
+const ArtifactOrUnknownSchema = z.union([ArtifactRefSchema, UnknownRefSchema]);
+const EdgeRecordedSchema = z.object({
 	...EventBaseShape,
-	kind: z.literal("search-completed"),
-	result: z.discriminatedUnion("status", [z.object({
-		status: z.literal("selected"),
-		candidateId: NON_EMPTY
-	}).strict(), z.object({
-		status: z.literal("all-rejected"),
-		reason: FailureReasonSchema
-	}).strict()])
+	kind: z.literal("edge-recorded"),
+	edgeId: z.string().regex(/^edge_[a-f0-9]{32}$/),
+	childNodeId: NODE_ID,
+	parents: z.array(NodeRefSchema),
+	operator: z.enum([
+		"seed",
+		"draft",
+		"improve",
+		"debug",
+		"merge",
+		"derive"
+	]),
+	attribution: z.enum([
+		"explicit",
+		"correlated",
+		"unknown"
+	]),
+	proposer: z.object({
+		kind: z.enum([
+			"trace",
+			"frontier-author",
+			"human",
+			"optimizer",
+			"compound"
+		]),
+		name: NON_EMPTY,
+		operationId: NON_EMPTY.nullable(),
+		source: SourceRefSchema
+	}).strict().nullable(),
+	selection: z.object({
+		rule: NON_EMPTY,
+		evidence: z.record(NON_EMPTY, FINITE_NUMBER)
+	}).strict().nullable(),
+	rationale: ArtifactOrUnknownSchema,
+	diffs: z.array(ArtifactOrUnknownSchema),
+	label: z.string()
+}).strict();
+const CellAllocatedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("cell-allocated"),
+	cellId: CELL_ID,
+	nodeId: NODE_ID,
+	taskId: NON_EMPTY,
+	unitId: NON_EMPTY,
+	split: SPLIT,
+	rep: NON_NEGATIVE_INT,
+	stage: z.enum([
+		"root",
+		"train",
+		"screen",
+		"rung",
+		"claim",
+		"external"
+	]),
+	lane: NON_EMPTY.nullable(),
+	reservation: ReservationSchema.nullable()
+}).strict();
+const TraceRefSchema = z.union([z.object({
+	traceId: NON_EMPTY,
+	execRunId: NON_EMPTY.nullable(),
+	spansWritten: NON_NEGATIVE_INT.nullable(),
+	spansDropped: NON_NEGATIVE_INT.nullable()
+}).strict(), UnknownRefSchema]);
+const NON_NEGATIVE = z.number().finite().nonnegative();
+const CellSettledSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("cell-settled"),
+	cellId: CELL_ID,
+	attempt: POSITIVE_INT,
+	runId: NON_EMPTY,
+	outcome: OutcomeSchema,
+	accounting: AccountingSchema,
+	boxMinutes: NON_NEGATIVE.nullable(),
+	wallMs: NON_NEGATIVE.nullable(),
+	queueMs: NON_NEGATIVE.nullable(),
+	placement: z.object({
+		lane: NON_EMPTY,
+		boxId: NON_EMPTY.nullable()
+	}).strict().nullable(),
+	identity: ExecutionIdentitySchema,
+	surfaceEvidence: z.array(SurfaceEvidenceSchema),
+	traceRef: TraceRefSchema
+}).strict();
+const CellCancelledSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("cell-cancelled"),
+	cellId: CELL_ID,
+	reason: z.enum([
+		"pruned",
+		"budget",
+		"deadline",
+		"aborted"
+	])
+}).strict();
+const NodeEstimateSchema = z.object({
+	against: NODE_ID,
+	split: SPLIT,
+	units: NON_NEGATIVE_INT,
+	pairs: NON_NEGATIVE_INT,
+	delta: FINITE_NUMBER.nullable(),
+	interval: z.tuple([FINITE_NUMBER, FINITE_NUMBER]).nullable(),
+	method: z.enum([
+		"none",
+		"insufficient",
+		"descriptive",
+		"bootstrap"
+	]),
+	exactSignP: z.number().min(0).max(1).nullable(),
+	indeterminate: z.boolean(),
+	cellSetDigest: HASH,
+	estimator: SourceRefSchema
+}).strict();
+const NodeDecidedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("node-decided"),
+	nodeId: NODE_ID,
+	decision: z.discriminatedUnion("status", [
+		z.object({
+			status: z.literal("advanced"),
+			rung: NON_NEGATIVE_INT
+		}).strict(),
+		z.object({ status: z.literal("pruned") }).strict(),
+		z.object({ status: z.literal("invalid") }).strict(),
+		z.object({ status: z.literal("finalist") }).strict(),
+		z.object({ status: z.literal("selected") }).strict(),
+		z.object({ status: z.literal("rejected") }).strict()
+	]),
+	basis: NodeEstimateSchema.nullable(),
+	rule: NON_EMPTY,
+	reason: NON_EMPTY
+}).strict();
+const SearchClosedSchema = z.object({
+	...EventBaseShape,
+	kind: z.literal("search-closed"),
+	reason: z.enum([
+		"budget",
+		"deadline",
+		"max-nodes",
+		"patience",
+		"converged",
+		"aborted"
+	]),
+	claim: z.object({
+		power: z.union([z.object({
+			adequate: z.boolean(),
+			minimumEffect: z.number().finite().positive(),
+			powerAtMinimumEffect: z.number().min(0).max(1),
+			units: NON_NEGATIVE_INT
+		}).strict(), UnknownRefSchema]),
+		finalists: z.array(z.object({
+			nodeId: NODE_ID,
+			estimate: NodeEstimateSchema.nullable(),
+			promote: z.boolean()
+		}).strict()),
+		selected: NODE_ID.nullable(),
+		decision: z.enum([
+			"ship",
+			"hold",
+			"test-cannot-resolve"
+		])
+	}).strict().nullable()
 }).strict();
 const EventSchema = z.discriminatedUnion("kind", [
-	SearchPlannedSchema,
-	SearchPlanExtendedSchema,
-	CandidateRegisteredSchema,
-	CandidateSlotClosedSchema,
-	TaskAttemptedSchema,
-	SearchOperationRecordedSchema,
-	CandidateDecidedSchema,
-	SearchCompletedSchema
+	SearchOpenedSchema,
+	OperationStartedSchema,
+	OperationRecordedSchema,
+	NodeRegisteredSchema,
+	EdgeRecordedSchema,
+	CellAllocatedSchema,
+	CellSettledSchema,
+	CellCancelledSchema,
+	NodeDecidedSchema,
+	SearchClosedSchema
 ]);
 const EntrySchema = z.object({
 	schema: z.literal(SEARCH_LEDGER_SCHEMA),
-	campaignId: NON_EMPTY,
+	searchId: NON_EMPTY,
 	sequence: NON_NEGATIVE_INT,
 	previousHash: z.union([HASH, z.null()]),
 	event: EventSchema,
 	entryHash: HASH
 }).strict();
-/** Validate and return a canonical copy. Arrays whose order is not semantic are
-* sorted so retries from different processes produce byte-identical events. */
+/** Validate and return a canonical copy. Arrays whose order carries no meaning
+* are sorted, so retries from different processes produce identical bytes. */
 function validateSearchLedgerEvent(input) {
 	const parsed = EventSchema.safeParse(input);
 	if (!parsed.success) throw new SearchLedgerError(`invalid search ledger event: ${formatZodError(parsed.error)}`);
 	return normalizeEvent(parsed.data);
 }
 /** Open a durable filesystem search ledger. Construction performs no I/O; the
-* first `append` or `replay` validates the complete existing file. */
+* first `append` or `state` verifies the whole existing file. */
 function openSearchLedger(options) {
-	if (options.path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
-	return new FileSearchLedger(options.path, options.campaignId, options.trustedHead);
+	return new FileSearchLedger(options.path, options.searchId, options.trustedHead);
 }
-/** Replay immutable search-ledger JSONL through the same codec as FileSearchLedger. */
-function replaySearchLedgerText(text, campaignId, source) {
-	return replayLedgerText(text, source, searchLedgerCodec(campaignId)).projection;
+/** Verify and project immutable search-ledger JSONL through the same codec as
+* `FileSearchLedger`. */
+function replaySearchLedgerText(text, searchId, source) {
+	return replayLedgerText(text, source, searchLedgerCodec(searchId));
 }
-function searchLedgerCodec(campaignId) {
+function searchLedgerCodec(searchId) {
 	return {
 		...SEARCH_LEDGER_FILE_CONTEXT,
 		header: {
 			schema: SEARCH_LEDGER_SCHEMA,
-			campaignId
+			searchId
 		},
 		conflictError: (message) => new SearchLedgerConflictError(message),
 		parseEntry: parseSearchLedgerEntry,
 		checkEntryHeader: (entry, index) => {
-			if (entry.campaignId !== campaignId) throw new SearchLedgerIntegrityError(`entry ${index} belongs to campaign ${entry.campaignId}, expected ${campaignId}`);
+			if (entry.searchId !== searchId) throw new SearchLedgerIntegrityError(`entry ${index} belongs to search ${entry.searchId}, expected ${searchId}`);
 		},
-		createProjector: () => createSearchLedgerProjector(campaignId)
+		createProjector: () => new SearchState(searchId)
 	};
 }
-/** Append-only file-backed search ledger with idempotent writes and replay. */
+/** Append-only file-backed search ledger with idempotent writes. */
 var FileSearchLedger = class {
 	path;
-	campaignId;
+	searchId;
 	trustedHeadPath;
 	trustedHeadMode;
 	journal;
-	constructor(path, campaignId, trustedHead = "pin") {
+	constructor(path, searchId, trustedHead = "pin") {
 		if (path.trim().length === 0) throw new SearchLedgerError("ledger path is empty");
-		if (campaignId.length === 0) throw new SearchLedgerError("campaignId is empty");
-		if (campaignId.trim() !== campaignId) throw new SearchLedgerError("campaignId must not contain surrounding whitespace");
-		this.campaignId = campaignId;
+		if (searchId.length === 0 || searchId.trim() !== searchId) throw new SearchLedgerError("searchId must be non-empty without surrounding whitespace");
+		this.searchId = searchId;
 		this.trustedHeadMode = trustedHead;
-		this.journal = new FileLedgerJournal(path, searchLedgerCodec(campaignId), { requireTrustedHead: trustedHead === "require" });
+		this.journal = new FileLedgerJournal(path, searchLedgerCodec(searchId), { requireTrustedHead: trustedHead === "require" });
 		this.path = this.journal.path;
 		this.trustedHeadPath = this.journal.trustedHeadPath;
 	}
-	async replay() {
-		return (await this.journal.replay()).projection;
+	async state() {
+		return this.journal.replay();
 	}
 	async append(input) {
 		const event = validateSearchLedgerEvent(input);
@@ -3207,7 +3892,7 @@ var FileSearchLedger = class {
 		return {
 			entry,
 			appended,
-			replay: projection
+			state: projection
 		};
 	}
 	async trustedHead() {
@@ -3221,6 +3906,8 @@ var FileSearchLedger = class {
 	}
 };
 function parseSearchLedgerEntry(raw, context) {
+	const schema = raw?.schema;
+	if (schema !== "tangle.search-ledger.2026-09") throw new SearchLedgerIntegrityError(`search ledger ${context.path} line ${context.line} was written under schema ${JSON.stringify(schema)}; this version reads only ${SEARCH_LEDGER_SCHEMA} and does not translate other formats`);
 	const parsed = EntrySchema.safeParse(raw);
 	if (!parsed.success) throw new SearchLedgerIntegrityError(`search ledger ${context.path} has a malformed entry at line ${context.line}: ${formatZodError(parsed.error)}`);
 	const entry = parsed.data;
@@ -3229,74 +3916,82 @@ function parseSearchLedgerEntry(raw, context) {
 }
 function normalizeEvent(event) {
 	const artifacts = sortArtifacts(event.artifacts);
-	if (event.kind === "search-planned") return {
-		...event,
-		artifacts,
-		plan: {
-			candidateSlots: [...event.plan.candidateSlots].sort((a, b) => compareStrings(a.slotId, b.slotId)),
-			tasks: [...event.plan.tasks].sort((a, b) => compareStrings(a.taskId, b.taskId)),
-			operations: [...event.plan.operations].sort((a, b) => compareStrings(a.operationId, b.operationId))
-		}
-	};
-	if (event.kind === "search-plan-extended") return {
-		...event,
-		artifacts,
-		extension: {
-			candidateSlots: [...event.extension.candidateSlots].sort((a, b) => compareStrings(a.slotId, b.slotId)),
-			operations: [...event.extension.operations].sort((a, b) => compareStrings(a.operationId, b.operationId))
-		}
-	};
-	if (event.kind === "candidate-registered") return {
-		...event,
-		artifacts,
-		lineage: {
-			...event.lineage,
-			parentCandidateIds: sortedStrings(event.lineage.parentCandidateIds)
-		},
-		surfaces: [...event.surfaces].map((surface) => ({
-			...surface,
-			artifact: { ...surface.artifact }
-		})).sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
-	};
-	if (event.kind === "task-attempted") return {
-		...event,
-		artifacts,
-		surfaceEvidence: [...event.surfaceEvidence].map((evidence) => ({
-			...evidence,
-			evidence: sortArtifacts(evidence.evidence)
-		})).sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
-	};
-	return {
-		...event,
-		artifacts
-	};
+	switch (event.kind) {
+		case "search-opened": return {
+			...event,
+			artifacts,
+			splits: {
+				...event.splits,
+				train: {
+					...event.splits.train,
+					tasks: sortTasks(event.splits.train.tasks)
+				},
+				selection: {
+					...event.splits.selection,
+					tasks: sortTasks(event.splits.selection.tasks)
+				},
+				test: {
+					...event.splits.test,
+					tasks: sortTasks(event.splits.test.tasks)
+				}
+			}
+		};
+		case "node-registered": return {
+			...event,
+			artifacts,
+			surfaces: [...event.surfaces].sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
+		};
+		case "cell-settled": return {
+			...event,
+			artifacts,
+			surfaceEvidence: [...event.surfaceEvidence].map((evidence) => ({
+				...evidence,
+				evidence: sortArtifacts(evidence.evidence)
+			})).sort((a, b) => compareStrings(a.surfaceId, b.surfaceId))
+		};
+		default: return {
+			...event,
+			artifacts
+		};
+	}
 }
-function sortArtifacts(artifacts) {
-	return [...artifacts].map((artifact) => ({ ...artifact })).sort((a, b) => compareStrings(artifactKey(a), artifactKey(b)));
+function sortTasks(tasks) {
+	return [...tasks].sort((a, b) => compareStrings(a.taskId, b.taskId));
 }
-function sortedStrings(values) {
-	return [...values].sort();
+function sortArtifacts(artifacts) {
+	return [...artifacts].sort((a, b) => compareStrings(artifactKey(a), artifactKey(b)));
 }
 function formatZodError(error) {
 	return error.issues.map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`).join("; ");
 }
 //#endregion
 //#region src/campaign/search-history-receipt.ts
-const SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION = "1.0.0";
+const SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION = "2026-09";
 const SEARCH_HISTORY_RECEIPT_DIGEST_ALGORITHM = "rfc8785-sha256";
 function assertSearchHistoryAdmissionOptions(options) {
 	if (options.searchHistoryPolicy !== void 0 && !["allow-missing", "require-complete"].includes(options.searchHistoryPolicy)) throw new Error(`unknown searchHistoryPolicy '${String(options.searchHistoryPolicy)}'`);
 	if (options.searchHistoryVerification !== void 0 && !["receipt", "ledger"].includes(options.searchHistoryVerification)) throw new Error(`unknown searchHistoryVerification '${String(options.searchHistoryVerification)}'`);
 }
-/** Verify resolved bytes with the canonical codec, never a caller-supplied replay projection. */
+/** Read the ledger's bytes, replay them through the search codec, and build
+* the receipt from that replay. */
+function createSearchHistoryReceipt(input) {
+	const producerId = nonEmpty(input.producerId, "search history producerId");
+	const runId = nonEmpty(input.runId, "search history runId");
+	const text = (input.storage ?? fsCampaignStorage()).read(input.ledger.path) ?? "";
+	const state = replaySearchLedgerText(text, input.ledger.searchId, input.ledger.path);
+	return receiptFor(producerId, runId, ledgerArtifact(input.ledger.path, text), state);
+}
+/** Verify the receipt, then resolve its ledger bytes, check them, and replay
+* them with the canonical codec. Never trusts a caller-supplied projection. */
 function verifySearchHistoryArtifact(receipt, storage) {
 	verifySearchHistoryReceipt(receipt);
 	const path = receipt.ledger.uri.startsWith("file:") ? fileURLToPath(receipt.ledger.uri) : receipt.ledger.uri;
 	const text = storage.read(path);
 	if (text === void 0) throw new Error(`search history ledger is missing or unreadable at '${path}'`);
-	if (new TextEncoder().encode(text).byteLength !== receipt.ledger.byteLength) throw new Error("search history ledger byte length mismatch");
-	if (hashCanonical(text) !== receipt.ledger.sha256) throw new Error("search history ledger digest mismatch");
-	assertSearchHistoryMatchesReplay(receipt, replaySearchLedgerText(text, receipt.summary.campaignId, path));
+	const artifact = ledgerArtifact(path, text);
+	if (artifact.byteLength !== receipt.ledger.byteLength) throw new Error("search history ledger byte length mismatch");
+	if (artifact.sha256 !== receipt.ledger.sha256) throw new Error("search history ledger digest mismatch");
+	assertSearchHistoryMatchesState(receipt, replaySearchLedgerText(text, receipt.summary.searchId, path));
 }
 var SearchHistoryRequiredError = class extends Error {
 	producerId;
@@ -3309,73 +4004,25 @@ var SearchHistoryRequiredError = class extends Error {
 		this.reasons = Object.freeze([...normalized]);
 	}
 };
-/** Build a bounded receipt from the projection returned by canonical ledger replay. */
-function createSearchHistoryReceipt(input) {
-	if (!input || typeof input !== "object") throw new TypeError("search history input is required");
-	const producerId = nonEmpty(input.producerId, "search history producerId");
-	const runId = nonEmpty(input.runId, "search history runId");
-	const ledger = normalizeArtifactRef(input.ledger);
-	const replay = validateReplayProjection(input.replay);
-	const auditDigest = ledgerHash(hashCanonical(replay.audit), "search history auditDigest");
-	const summary = summarizeReplay(replay);
-	const incompleteReasons = Object.freeze(historyIncompleteReasons(summary));
-	const material = Object.freeze({
-		schemaVersion: SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION,
-		kind: "search-history-receipt",
-		digestAlgorithm: SEARCH_HISTORY_RECEIPT_DIGEST_ALGORITHM,
-		producerId,
-		runId,
-		ledger,
-		auditDigest,
-		summary,
-		complete: incompleteReasons.length === 0,
-		incompleteReasons
-	});
-	return Object.freeze({
-		...material,
-		receiptDigest: hashCanonical(material)
-	});
-}
-/** Verify the bounded receipt. Full ledger bytes are verified by SearchLedger. */
+/** Verify a receipt's own consistency and digest. */
 function verifySearchHistoryReceipt(receipt) {
 	if (!receipt || typeof receipt !== "object") throw new TypeError("search history receipt is required");
 	if (receipt.schemaVersion !== SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION) throw new Error(`unsupported search history schemaVersion '${receipt.schemaVersion}'`);
 	if (receipt.kind !== "search-history-receipt") throw new Error(`search history kind must be 'search-history-receipt'`);
 	if (receipt.digestAlgorithm !== SEARCH_HISTORY_RECEIPT_DIGEST_ALGORITHM) throw new Error(`unsupported search history digestAlgorithm '${receipt.digestAlgorithm}'`);
-	const producerId = nonEmpty(receipt.producerId, "search history producerId");
-	const runId = nonEmpty(receipt.runId, "search history runId");
-	const ledger = normalizeArtifactRef(receipt.ledger);
-	const auditDigest = ledgerHash(receipt.auditDigest, "search history auditDigest");
 	const summary = normalizeSummary(receipt.summary);
-	const incompleteReasons = normalizeReasons(receipt.incompleteReasons);
-	const expectedReasons = historyIncompleteReasons(summary);
-	if (!sameStrings(incompleteReasons, expectedReasons)) throw new Error("search history incompleteReasons disagree with its summary");
-	if (receipt.complete !== (expectedReasons.length === 0)) throw new Error("search history complete disagrees with its summary");
-	if (hashCanonical({
-		schemaVersion: receipt.schemaVersion,
-		kind: receipt.kind,
-		digestAlgorithm: receipt.digestAlgorithm,
-		producerId,
-		runId,
-		ledger,
-		auditDigest,
-		summary,
-		complete: receipt.complete,
-		incompleteReasons
-	}) !== receipt.receiptDigest) throw new Error("search history receipt digest mismatch");
+	if (receipt.complete !== (summary.status === "closed")) throw new Error("search history complete disagrees with its summary");
+	if (!Array.isArray(receipt.incompleteReasons) || receipt.complete !== (receipt.incompleteReasons.length === 0)) throw new Error("search history incompleteReasons disagree with complete");
+	const { receiptDigest, ...material } = receipt;
+	if (hashCanonical(material) !== receiptDigest) throw new Error("search history receipt digest mismatch");
 	return receipt;
 }
-/** Prove that a receipt still describes the exact canonical replay supplied. */
-function assertSearchHistoryMatchesReplay(receipt, replay) {
+/** Prove that a receipt describes exactly the supplied replayed state. */
+function assertSearchHistoryMatchesState(receipt, state) {
 	verifySearchHistoryReceipt(receipt);
-	if (createSearchHistoryReceipt({
-		producerId: receipt.producerId,
-		runId: receipt.runId,
-		ledger: receipt.ledger,
-		replay
-	}).receiptDigest !== receipt.receiptDigest) throw new Error("search history receipt does not match the supplied SearchLedger replay");
-}
-/** Require a receipt owned by this producer and a terminal, denominator-complete history. */
+	if (receiptFor(receipt.producerId, receipt.runId, receipt.ledger, state).receiptDigest !== receipt.receiptDigest) throw new Error("search history receipt does not match the supplied search ledger state");
+}
+/** Require a receipt owned by this producer over a closed search. */
 function assertCompleteSearchHistory(producerId, receipt) {
 	if (receipt === void 0) throw new SearchHistoryRequiredError(producerId, []);
 	verifySearchHistoryReceipt(receipt);
@@ -3398,590 +4045,442 @@ function searchHistoryCoverageRow(producerId, receipt) {
 		receipt
 	});
 }
-function validateReplayProjection(replay) {
-	if (!replay || typeof replay !== "object") throw new TypeError("search history replay is required");
-	if (!Array.isArray(replay.entries)) throw new TypeError("search history replay.entries must be an array");
-	if (!replay.audit || typeof replay.audit !== "object") throw new TypeError("search history replay.audit is required");
-	if (replay.plan !== null && (!replay.plan || typeof replay.plan !== "object")) throw new TypeError("search history replay.plan must be an event or null");
-	if (replay.completion !== null && (!replay.completion || typeof replay.completion !== "object")) throw new TypeError("search history replay.completion must be an event or null");
-	if (replay.audit.eventCount !== replay.entries.length) throw new Error(`search history audit eventCount ${replay.audit.eventCount} does not match ${replay.entries.length} entries`);
-	const observedHead = replay.entries.at(-1)?.entryHash ?? null;
-	if (replay.audit.headHash !== observedHead) throw new Error("search history audit headHash does not match the final ledger entry");
-	return replay;
-}
-function summarizeReplay(replay) {
-	const audit = replay.audit;
-	return normalizeSummary({
-		campaignId: audit.campaignId,
+function receiptFor(producerId, runId, ledger, state) {
+	const { audit } = state;
+	const summary = normalizeSummary({
+		searchId: audit.searchId,
 		headHash: audit.headHash,
 		status: audit.status,
-		selectedCandidateId: audit.selectedCandidateId,
+		closeReason: audit.closeReason,
+		claimDecision: state.closed?.claim?.decision ?? null,
+		selectedNodeId: audit.selectedNodeId,
 		eventCount: audit.eventCount,
-		candidateCount: audit.candidateCount,
-		closedCandidateSlotCount: audit.closedCandidateSlotCount,
-		attemptCount: audit.attemptCount,
-		operationCount: audit.operationCount,
-		expectedCandidateSlots: audit.expected.candidateSlots,
-		expectedTaskOutcomes: audit.expected.taskOutcomes,
-		expectedOperations: audit.expected.operations,
-		missingCandidateSlots: audit.expected.missingCandidateSlots.length,
-		missingTaskOutcomes: audit.expected.missingTaskOutcomes.length,
-		missingOperations: audit.expected.missingOperations.length,
-		pendingDecisions: audit.decisions.pending,
-		hasPlan: replay.plan !== null,
-		hasCompletion: replay.completion !== null
+		nodes: audit.nodes,
+		edges: audit.edges.explicit + audit.edges.correlated + audit.edges.unknown,
+		cells: audit.cells.allocated,
+		openCells: audit.cells.open,
+		openOperations: audit.operations.open,
+		nodesWithoutEdge: audit.nodesWithoutEdge,
+		undecidedNodes: audit.undecidedNodes
 	});
-}
-function normalizeSummary(value) {
-	if (!value || typeof value !== "object") throw new TypeError("search history summary is required");
-	const campaignId = nonEmpty(value.campaignId, "search history summary.campaignId");
-	const headHash = nullableLedgerHash(value.headHash, "search history summary.headHash");
-	const status = searchStatus(value.status);
-	const selectedCandidateId = optionalNullableText(value.selectedCandidateId, "search history summary.selectedCandidateId");
-	const eventCount = nonNegativeSafeInteger(value.eventCount, "search history summary.eventCount");
-	const candidateCount = nonNegativeSafeInteger(value.candidateCount, "search history summary.candidateCount");
-	const closedCandidateSlotCount = nonNegativeSafeInteger(value.closedCandidateSlotCount, "search history summary.closedCandidateSlotCount");
-	const attemptCount = nonNegativeSafeInteger(value.attemptCount, "search history summary.attemptCount");
-	const operationCount = nonNegativeSafeInteger(value.operationCount, "search history summary.operationCount");
-	const expectedCandidateSlots = nonNegativeSafeInteger(value.expectedCandidateSlots, "search history summary.expectedCandidateSlots");
-	const expectedTaskOutcomes = nonNegativeSafeInteger(value.expectedTaskOutcomes, "search history summary.expectedTaskOutcomes");
-	const expectedOperations = nonNegativeSafeInteger(value.expectedOperations, "search history summary.expectedOperations");
-	const missingCandidateSlots = nonNegativeSafeInteger(value.missingCandidateSlots, "search history summary.missingCandidateSlots");
-	const missingTaskOutcomes = nonNegativeSafeInteger(value.missingTaskOutcomes, "search history summary.missingTaskOutcomes");
-	const missingOperations = nonNegativeSafeInteger(value.missingOperations, "search history summary.missingOperations");
-	const pendingDecisions = nonNegativeSafeInteger(value.pendingDecisions, "search history summary.pendingDecisions");
-	const hasPlan = boolean(value.hasPlan, "search history summary.hasPlan");
-	const hasCompletion = boolean(value.hasCompletion, "search history summary.hasCompletion");
-	if (missingCandidateSlots > expectedCandidateSlots) throw new Error("search history missingCandidateSlots exceeds expectedCandidateSlots");
-	if (missingTaskOutcomes > expectedTaskOutcomes) throw new Error("search history missingTaskOutcomes exceeds expectedTaskOutcomes");
-	if (missingOperations > expectedOperations) throw new Error("search history missingOperations exceeds expectedOperations");
-	if (pendingDecisions > candidateCount) throw new Error("search history pendingDecisions exceeds candidateCount");
-	if (eventCount === 0 !== (headHash === null)) throw new Error("search history eventCount and headHash disagree");
-	if (status === "in-progress" === hasCompletion) throw new Error("search history status and hasCompletion disagree");
-	if (status === "selected" && selectedCandidateId === null) throw new Error("selected search history requires selectedCandidateId");
-	if (status !== "selected" && selectedCandidateId !== null) throw new Error("non-selected search history cannot name selectedCandidateId");
+	const material = {
+		schemaVersion: SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION,
+		kind: "search-history-receipt",
+		digestAlgorithm: SEARCH_HISTORY_RECEIPT_DIGEST_ALGORITHM,
+		producerId,
+		runId,
+		ledger: Object.freeze({ ...ledger }),
+		auditDigest: hashCanonical(audit),
+		summary,
+		complete: state.completion.complete,
+		incompleteReasons: Object.freeze([...state.completion.reasons])
+	};
 	return Object.freeze({
-		campaignId,
-		headHash,
-		status,
-		selectedCandidateId,
-		eventCount,
-		candidateCount,
-		closedCandidateSlotCount,
-		attemptCount,
-		operationCount,
-		expectedCandidateSlots,
-		expectedTaskOutcomes,
-		expectedOperations,
-		missingCandidateSlots,
-		missingTaskOutcomes,
-		missingOperations,
-		pendingDecisions,
-		hasPlan,
-		hasCompletion
+		...material,
+		receiptDigest: hashCanonical(material)
 	});
 }
-function historyIncompleteReasons(summary) {
-	const reasons = [];
-	if (!summary.hasPlan) reasons.push("search plan is missing");
-	if (!summary.hasCompletion) reasons.push("terminal search-completed event is missing");
-	if (summary.status === "in-progress") reasons.push("search status is in-progress");
-	if (summary.missingCandidateSlots > 0) reasons.push(countReason(summary.missingCandidateSlots, "candidate slot", "candidate slots"));
-	if (summary.missingTaskOutcomes > 0) reasons.push(countReason(summary.missingTaskOutcomes, "task outcome", "task outcomes"));
-	if (summary.missingOperations > 0) reasons.push(countReason(summary.missingOperations, "operation", "operations"));
-	if (summary.pendingDecisions > 0) reasons.push(countReason(summary.pendingDecisions, "candidate decision", "candidate decisions", "pending"));
-	return reasons;
-}
-function countReason(count, singular, plural, adjective = "unresolved") {
-	return `${count} ${count === 1 ? singular : plural} ${count === 1 ? "is" : "are"} ${adjective}`;
-}
-function normalizeArtifactRef(value) {
-	if (!value || typeof value !== "object") throw new TypeError("search history ledger artifact is required");
+function ledgerArtifact(path, text) {
+	const bytes = Buffer.from(text, "utf8");
+	return {
+		role: "search-ledger",
+		uri: pathToFileURL(path).href,
+		sha256: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
+		byteLength: bytes.byteLength
+	};
+}
+function normalizeSummary(value) {
+	if (!value || typeof value !== "object") throw new TypeError("search history summary is required");
+	for (const key of [
+		"eventCount",
+		"nodes",
+		"edges",
+		"cells",
+		"openCells",
+		"openOperations",
+		"nodesWithoutEdge",
+		"undecidedNodes"
+	]) {
+		const count = value[key];
+		if (!Number.isSafeInteger(count) || count < 0) throw new TypeError(`search history summary.${key} must be a non-negative safe integer`);
+	}
+	if (value.status !== "open" && value.status !== "closed") throw new TypeError(`search history summary.status is invalid: ${String(value.status)}`);
+	if (value.eventCount === 0 !== (value.headHash === null)) throw new Error("search history eventCount and headHash disagree");
+	if (value.status === "closed" !== (value.closeReason !== null)) throw new Error("search history status and closeReason disagree");
+	if (value.status === "closed" && value.openCells + value.openOperations + value.nodesWithoutEdge + value.undecidedNodes > 0) throw new Error("a closed search history cannot have open work");
 	return Object.freeze({
-		role: nonEmpty(value.role, "search history ledger role"),
-		uri: nonEmpty(value.uri, "search history ledger uri"),
-		sha256: ledgerHash(value.sha256, "search history ledger sha256"),
-		byteLength: nonNegativeSafeInteger(value.byteLength, "search history ledger byteLength")
+		searchId: nonEmpty(value.searchId, "search history summary.searchId"),
+		headHash: value.headHash,
+		status: value.status,
+		closeReason: value.closeReason,
+		claimDecision: value.claimDecision,
+		selectedNodeId: value.selectedNodeId,
+		eventCount: value.eventCount,
+		nodes: value.nodes,
+		edges: value.edges,
+		cells: value.cells,
+		openCells: value.openCells,
+		openOperations: value.openOperations,
+		nodesWithoutEdge: value.nodesWithoutEdge,
+		undecidedNodes: value.undecidedNodes
 	});
 }
-function normalizeReasons(value) {
-	if (!Array.isArray(value)) throw new TypeError("search history incompleteReasons must be an array");
-	return Object.freeze(value.map((reason, index) => nonEmpty(reason, `search history incompleteReasons[${index}]`)));
-}
-function sameStrings(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function searchStatus(value) {
-	if (value !== "in-progress" && value !== "selected" && value !== "all-rejected") throw new TypeError(`search history summary.status is invalid: ${String(value)}`);
-	return value;
-}
-function nullableLedgerHash(value, label) {
-	return value === null ? null : ledgerHash(value, label);
-}
-function optionalNullableText(value, label) {
-	return value === null ? null : nonEmpty(value, label);
-}
-function ledgerHash(value, label) {
-	if (typeof value !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value)) throw new TypeError(`${label} must be a lowercase sha256 digest`);
-	return value;
-}
 function nonEmpty(value, label) {
 	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new TypeError(`${label} must be a trimmed non-empty string`);
 	return value;
 }
-function nonNegativeSafeInteger(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new TypeError(`${label} must be a non-negative safe integer`);
-	return value;
-}
-function boolean(value, label) {
-	if (typeof value !== "boolean") throw new TypeError(`${label} must be a boolean`);
-	return value;
-}
 //#endregion
 //#region src/campaign/search-ledger-recording.ts
-const SEARCH_LEDGER_DIR = "search-ledger";
 /**
-* Recorder for one `runOptimization` run: `open()`, then `recordGeneration()`
-* and `recordResults()` per generation, then `finish()`.
+* `SearchRecorder`: writes a search into its ledger as it happens.
+*
+* Every loop that scores artifacts against an objective and keeps the better
+* ones records through this one writer: the kernel, `runOptimization`, and the
+* GEPA importer. Each call appends one event the moment the fact exists, so an
+* interrupted search leaves an exact, replayable account of what ran.
 *
-* Every event id is derived from the run, and an id already durable is not
-* appended again, so a resumed run continues one ledger instead of conflicting
-* with its own history.
+* Content (surfaces, rationales, diffs, RunRecords) goes to content-addressed
+* blobs beside the ledger; the ledger holds their digests. Free text a proposer
+* wrote (rationales, labels) is redacted with the `share` profile before it is
+* hashed, so the chain never covers a secret. Surfaces are stored as they ran:
+* a redacted surface is not what ran.
+*
+* Every write is idempotent against the ledger's state. Ids are deterministic,
+* and a fact already in the ledger is not appended again, so a resumed search
+* continues its ledger instead of conflicting with its own history.
 */
+const MAX_LABEL_CHARS = 200;
+/** The default claim: development numbers over exactly the supplied tasks. */
+function developmentClaim(populationId) {
+	return {
+		use: "development",
+		population: {
+			id: populationId,
+			description: "the tasks this search was given"
+		},
+		samplingFrame: "the caller-supplied task list",
+		independentUnit: "taskId",
+		generalization: "fixed-roster"
+	};
+}
+/** Deterministic edge id: one proposal of one child within one search. */
+function searchEdgeId(searchId, childNodeId, proposalKey) {
+	return `edge_${createHash("sha256").update(canonicalString([
+		searchId,
+		childNodeId,
+		proposalKey
+	])).digest("hex").slice(0, 32)}`;
+}
+/** Writes one search's events into its ledger as they happen. */
 var SearchRecorder = class SearchRecorder {
-	opts;
+	ledger;
+	storage;
+	blobDir;
+	now;
 	tasks;
-	registered = /* @__PURE__ */ new Map();
-	order = [];
-	coverage = /* @__PURE__ */ new Map();
-	openSlots = /* @__PURE__ */ new Set();
-	durableEventIds = /* @__PURE__ */ new Set();
-	lastStampMs = 0;
-	proposalReceiptCount = 0;
-	constructor(opts) {
-		this.opts = opts;
-		this.tasks = plannedTasks(opts.scenarios, opts.reps, opts.runDir, opts.splitDigest);
-	}
-	/** Open the recorder and append the plan. An existing ledger for the same
-	*  run is re-read first, so a resumed run keeps one plan and one lineage. */
-	static async open(opts) {
-		const recorder = new SearchRecorder(opts);
-		await recorder.hydrate();
-		await recorder.plan();
-		return recorder;
-	}
-	/**
-	* Record one generation's candidate-generation call and the candidates it
-	* produced. A proposal larger than the planned population extends the plan
-	* with the extra slots; a proposal that fills fewer closes the rest.
-	*/
-	async recordGeneration(input) {
-		const { generation, candidates } = input;
-		const planned = this.opts.populationSize;
-		if (candidates.length > planned) {
-			const extra = [];
-			for (let index = planned; index < candidates.length; index++) {
-				const slot = {
-					slotId: slotId(generation, index),
-					generationOperationId: generationOperationId(generation)
-				};
-				extra.push(slot);
-				this.openSlots.add(slot.slotId);
-			}
-			await this.append({
-				kind: "search-plan-extended",
-				eventId: `search:plan-extended:gen-${generation}`,
-				occurredAt: this.stamp(),
-				artifacts: [this.proposalArtifact(generation, candidates)],
-				extension: {
-					candidateSlots: extra,
-					operations: []
-				}
-			});
-		}
-		await this.recordGenerationOperation(generation, candidates, planned - candidates.length);
-		const parent = this.registered.get(input.parentSurfaceHash);
-		for (const [index, candidate] of candidates.entries()) {
-			const candidateId = candidate.surfaceHash;
-			const slot = slotId(generation, index);
-			const surfaceArtifact = this.writeArtifact("candidate-surface", `candidate-${candidateId}.json`, {
-				surfaceHash: candidateId,
-				surface: candidate.surface,
-				label: candidate.label ?? ""
-			});
-			const ledgerGeneration = parent ? parent.generation + 1 : 0;
-			await this.append({
-				kind: "candidate-registered",
-				eventId: `candidate:${candidateId}`,
-				occurredAt: this.stamp(),
-				artifacts: [surfaceArtifact],
-				slotId: slot,
-				generationOperationId: generationOperationId(generation),
-				candidateId,
-				lineage: {
-					lineageNodeId: candidateId,
-					parentCandidateIds: parent ? [parent.candidateId] : [],
-					generation: ledgerGeneration,
-					proposer: this.opts.proposerLabel,
-					proposerSource: this.opts.binding.identity.proposer.source
-				},
-				surfaces: candidateSurfaces(candidate.surface, surfaceArtifact)
-			});
-			this.remember({
-				candidateId,
-				slotId: slot,
-				generation: ledgerGeneration
-			});
-		}
-		for (let index = candidates.length; index < planned; index++) await this.closeSlot(slotId(generation, index), generationOperationId(generation), {
-			code: "proposal-short",
-			message: `generation ${generation} proposed ${candidates.length} of ${planned} planned candidates`
-		});
-	}
-	/** Append one task attempt per designed cell of each candidate campaign. */
-	async recordResults(candidates) {
-		for (const candidate of candidates) {
-			const registered = this.registered.get(candidate.surfaceHash);
-			if (!registered) throw new Error(`search ledger: candidate ${candidate.surfaceHash} produced results without a registration`);
-			this.coverage.set(registered.candidateId, candidate.coverageComplete);
-			const evidence = this.writeArtifact("candidate-cells", `cells-${registered.candidateId}.json`, {
-				surfaceHash: candidate.surfaceHash,
-				runDir: candidate.runDir,
-				cells: candidate.cells.map((cell) => ({
-					cellId: cell.cellId,
-					scenarioId: cell.scenarioId,
-					rep: cell.rep,
-					judgeScores: cell.judgeScores,
-					costUsd: cell.costUsd,
-					costProvenance: cell.costProvenance,
-					tokenUsage: cell.tokenUsage,
-					...cell.error === void 0 ? {} : {
-						error: cell.error,
-						errorStage: cell.errorStage
-					}
-				}))
-			});
-			const surfaceIds = candidateSurfaces(candidate.surface, evidence).map((surface) => surface.surfaceId);
-			for (const cell of candidate.cells) {
-				const taskId = taskIdFor(cell.scenarioId, cell.rep);
-				const task = this.tasks.find((planned) => planned.taskId === taskId);
-				if (!task) throw new Error(`search ledger: cell ${cell.cellId} is outside the planned task set`);
-				await this.append({
-					kind: "task-attempted",
-					eventId: `attempt:${registered.candidateId}:${taskId}`,
-					occurredAt: this.stamp(),
-					artifacts: [evidence],
-					candidateId: registered.candidateId,
-					runId: `${registered.candidateId}:${cell.cellId}`,
-					attemptIndex: 0,
-					task: {
-						taskId,
-						source: task.source
-					},
-					identity: {
-						model: this.cellModel(cell),
-						agent: this.opts.binding.identity.agent,
-						benchmark: task.benchmark
-					},
-					outcome: cellOutcome(cell),
-					accounting: cellAccounting(cell),
-					surfaceEvidence: surfaceIds.map((surfaceId) => surfaceEvidenceFor(surfaceId, evidence))
-				});
-			}
-		}
+	lastStampMs;
+	constructor(options, header, lastOccurredAt) {
+		this.ledger = options.ledger;
+		this.storage = options.storage ?? fsCampaignStorage();
+		this.blobDir = options.blobDir ?? join(dirname(options.ledger.path), "blobs");
+		this.now = options.now ?? Date.now;
+		this.lastStampMs = lastOccurredAt === null ? 0 : Date.parse(lastOccurredAt);
+		const tasks = /* @__PURE__ */ new Map();
+		for (const split of [
+			"train",
+			"selection",
+			"test"
+		]) for (const task of header.splits[split].tasks) tasks.set(task.taskId, {
+			split,
+			unitId: task.unitId
+		});
+		this.tasks = tasks;
 	}
 	/**
-	* Close the search: unreached generations, the selection operation, one
-	* decision per candidate, then the terminal event.
-	*
-	* The terminal event is appended only when canonical replay accounts for the
-	* whole planned denominator. An interrupted or partly unscored search stays
-	* `in-progress` and its receipt reports the exact gap, instead of claiming a
-	* closed search.
+	* Open the search: append `search-opened`, or, when the ledger already holds
+	* one, check that it is this search and continue it.
 	*/
-	async finish(input) {
-		const stopped = {
-			code: "generation-not-reached",
-			message: `the search stopped after ${input.generationsRun} generation(s)`
+	static async open(options, opening, artifacts = []) {
+		const state = await options.ledger.state();
+		const event = {
+			...opening,
+			kind: "search-opened",
+			eventId: "search-opened",
+			occurredAt: "",
+			artifacts,
+			splits: {
+				train: {
+					taskSetDigest: searchTaskSetDigest(opening.splits.train),
+					tasks: opening.splits.train
+				},
+				selection: {
+					taskSetDigest: searchTaskSetDigest(opening.splits.selection),
+					tasks: opening.splits.selection
+				},
+				test: {
+					taskSetDigest: searchTaskSetDigest(opening.splits.test),
+					tasks: opening.splits.test
+				},
+				heldOutUnits: opening.splits.heldOutUnits
+			}
 		};
-		for (let generation = input.generationsRun; generation < this.opts.maxGenerations; generation++) {
-			await this.recordGenerationOperation(generation, [], this.opts.populationSize, stopped);
-			for (let index = 0; index < this.opts.populationSize; index++) await this.closeSlot(slotId(generation, index), generationOperationId(generation), stopped);
+		if (state.header) {
+			if (headerMaterial(state.header) !== headerMaterial(canonicalHeader(event))) throw new Error(`search ledger ${options.ledger.path} already holds a different search-opened header for ${state.searchId}; a changed search is a derived search`);
+			return new SearchRecorder(options, state.header, state.lastOccurredAt);
 		}
-		const decisions = this.writeArtifact("search-decisions", "decisions.json", {
-			winnerSurfaceHash: input.winnerSurfaceHash,
-			candidates: this.order.map((entry) => entry.candidateId)
+		const recorder = new SearchRecorder(options, event, state.lastOccurredAt);
+		await recorder.append({
+			...event,
+			occurredAt: recorder.stamp()
 		});
+		return recorder;
+	}
+	get searchId() {
+		return this.ledger.searchId;
+	}
+	/** The ledger's verified state now. */
+	state() {
+		return this.ledger.state();
+	}
+	/** Store `body` as a canonical JSON blob and return its content address. */
+	blob(role, body) {
+		const text = canonicalString(body);
+		const bytes = Buffer.from(text, "utf8");
+		const hex = createHash("sha256").update(bytes).digest("hex");
+		const path = join(this.blobDir, `${hex}.json`);
+		if (!this.storage.exists(path)) {
+			this.storage.ensureDir(this.blobDir);
+			this.storage.write(path, text);
+		}
+		return {
+			role,
+			uri: `file://${path}`,
+			sha256: `sha256:${hex}`,
+			byteLength: bytes.byteLength
+		};
+	}
+	/** Register a node, or return the existing node with the same artifact digest. */
+	async registerNode(input) {
+		const existing = (await this.ledger.state()).nodeIdForDigest(input.artifactDigest);
+		if (existing !== void 0) return {
+			nodeId: existing,
+			existed: true
+		};
+		const nodeId = searchNodeId(this.searchId, input.artifactDigest);
 		await this.append({
-			kind: "search-operation-recorded",
-			eventId: "operation:selection",
+			kind: "node-registered",
+			eventId: `node:${nodeId}`,
 			occurredAt: this.stamp(),
-			artifacts: [decisions],
-			operationId: "selection",
-			operationKind: "selection",
-			execution: {
-				kind: "deterministic",
-				source: this.opts.binding.identity.search
-			},
-			outcome: { status: "completed" },
-			accounting: {
-				tokens: {
-					status: "known",
-					inputTokens: 0,
-					outputTokens: 0,
-					cachedTokens: 0
-				},
-				cost: {
-					status: "known",
-					usd: 0,
-					source: "free"
-				}
-			}
+			artifacts: [],
+			nodeId,
+			artifactDigest: input.artifactDigest,
+			artifact: input.artifact,
+			surfaces: input.surfaces
 		});
-		const winner = this.registered.get(input.winnerSurfaceHash);
-		for (const entry of this.order) await this.append({
-			kind: "candidate-decided",
-			eventId: `decision:${entry.candidateId}`,
-			occurredAt: this.stamp(),
-			artifacts: [decisions],
-			candidateId: entry.candidateId,
-			decision: winner?.candidateId === entry.candidateId ? { status: "selected" } : {
-				status: "rejected",
-				reason: this.coverage.get(entry.candidateId) === false ? {
-					code: "coverage-incomplete",
-					message: "the candidate missed a designed cell and could not be ranked"
-				} : {
-					code: "not-promoted",
-					message: "the candidate did not beat the incumbent"
-				}
+		return {
+			nodeId,
+			existed: false
+		};
+	}
+	/** Record the proposal that derived a node. Returns the edge id. */
+	async recordEdge(input) {
+		const edgeId = searchEdgeId(this.searchId, input.childNodeId, input.proposalKey);
+		if ((await this.ledger.state()).edge(edgeId)) return edgeId;
+		const rationale = typeof input.rationale === "string" ? input.rationale.trim().length === 0 ? { unknown: "the proposer returned no rationale" } : this.blob("rationale", {
+			kind: "rationale",
+			text: redactText(input.rationale, { profile: "share" }),
+			redaction: {
+				profile: "share",
+				version: REDACTION_VERSION
 			}
+		}) : input.rationale;
+		await this.append({
+			kind: "edge-recorded",
+			eventId: `edge:${edgeId}`,
+			occurredAt: this.stamp(),
+			artifacts: [],
+			edgeId,
+			childNodeId: input.childNodeId,
+			parents: input.parents.map((parent) => typeof parent === "string" ? {
+				searchId: this.searchId,
+				nodeId: parent
+			} : parent),
+			operator: input.operator,
+			attribution: input.attribution,
+			proposer: input.proposer,
+			selection: input.selection ?? null,
+			rationale,
+			diffs: input.diffs,
+			label: boundedLabel(input.label ?? "")
 		});
-		const replay = await this.opts.binding.ledger.replay();
-		const { missingCandidateSlots, missingTaskOutcomes, missingOperations } = replay.audit.expected;
-		if (missingCandidateSlots.length === 0 && missingTaskOutcomes.length === 0 && missingOperations.length === 0 && replay.audit.decisions.pending === 0) await this.append({
-			kind: "search-completed",
-			eventId: "search:completed",
+		return edgeId;
+	}
+	async startOperation(input) {
+		if ((await this.ledger.state()).operation(input.operationId)) return;
+		await this.append({
+			kind: "operation-started",
+			eventId: `operation-started:${input.operationId}`,
 			occurredAt: this.stamp(),
-			artifacts: [decisions],
-			result: winner ? {
-				status: "selected",
-				candidateId: winner.candidateId
-			} : {
-				status: "all-rejected",
-				reason: {
-					code: "no-promoted-candidate",
-					message: "no candidate beat the incumbent on the designed denominator"
-				}
-			}
+			artifacts: [],
+			operationId: input.operationId,
+			operationKind: input.operationKind,
+			reservation: input.reservation ?? null
 		});
-		return this.receipt(input.runId);
 	}
-	/** Bounded receipt over the exact ledger bytes this run produced. */
-	async receipt(runId) {
-		const { ledger } = this.opts.binding;
-		const replay = await ledger.replay();
-		const bytes = replay.entries.map((entry) => `${canonicalString(entry)}\n`).join("");
-		return createSearchHistoryReceipt({
-			producerId: this.opts.proposerLabel,
-			runId,
-			ledger: {
-				role: "search-ledger",
-				uri: `file://${ledger.path}`,
-				sha256: hashCanonical(bytes),
-				byteLength: new TextEncoder().encode(bytes).byteLength
-			},
-			replay
+	async recordOperation(input) {
+		if ((await this.ledger.state()).operation(input.operationId)?.recorded) return;
+		await this.append({
+			...input,
+			kind: "operation-recorded",
+			eventId: `operation-recorded:${input.operationId}`,
+			occurredAt: this.stamp(),
+			artifacts: input.artifacts ?? []
 		});
 	}
-	/** Read an existing ledger for this run so a resume continues it. */
-	async hydrate() {
-		const replay = await this.opts.binding.ledger.replay();
-		for (const entry of replay.entries) {
-			this.durableEventIds.add(entry.event.eventId);
-			const stamped = Date.parse(entry.event.occurredAt);
-			if (stamped > this.lastStampMs) this.lastStampMs = stamped;
-		}
-		for (const slot of replay.plan?.plan.candidateSlots ?? []) this.openSlots.add(slot.slotId);
-		for (const extension of replay.planExtensions) for (const slot of extension.extension.candidateSlots) this.openSlots.add(slot.slotId);
-		for (const closed of replay.closedCandidateSlots) this.openSlots.delete(closed.slotId);
-		for (const candidate of replay.candidates) {
-			this.remember({
-				candidateId: candidate.candidateId,
-				slotId: candidate.slotId,
-				generation: candidate.lineage.generation
-			});
-			this.openSlots.delete(candidate.slotId);
-		}
+	/** Plan one cell. Returns the cell id; an allocated cell is not allocated again. */
+	async allocateCell(input) {
+		const task = this.tasks.get(input.taskId);
+		if (!task) throw new Error(`search ${this.searchId} declares no task ${input.taskId}`);
+		const cellId = searchCellId(this.searchId, input.nodeId, input.taskId, input.split, input.rep);
+		if ((await this.ledger.state()).cell(cellId)) return cellId;
+		await this.append({
+			kind: "cell-allocated",
+			eventId: `cell:${cellId}`,
+			occurredAt: this.stamp(),
+			artifacts: [],
+			cellId,
+			nodeId: input.nodeId,
+			taskId: input.taskId,
+			unitId: task.unitId,
+			split: input.split,
+			rep: input.rep,
+			stage: input.stage,
+			lane: input.lane ?? null,
+			reservation: input.reservation ?? null
+		});
+		return cellId;
 	}
-	async plan() {
-		const candidateSlots = [];
-		const operations = [{
-			operationId: "selection",
-			kind: "selection"
-		}];
-		for (let generation = 0; generation < this.opts.maxGenerations; generation++) {
-			operations.push({
-				operationId: generationOperationId(generation),
-				kind: "candidate-generation"
-			});
-			for (let index = 0; index < this.opts.populationSize; index++) {
-				const slot = {
-					slotId: slotId(generation, index),
-					generationOperationId: generationOperationId(generation)
-				};
-				candidateSlots.push(slot);
-				if (!this.registeredSlot(slot.slotId)) this.openSlots.add(slot.slotId);
-			}
+	/** Record one finished attempt at a cell. */
+	async settleCell(input) {
+		const cell = (await this.ledger.state()).cell(input.cellId);
+		if (!cell) throw new Error(`cell ${input.cellId} was never allocated in ${this.searchId}`);
+		const attempt = input.attempt ?? cell.attempts + 1;
+		if (attempt <= cell.attempts) return;
+		const runId = searchCellRunId({
+			cellId: input.cellId,
+			attempt
+		});
+		const artifacts = [...input.artifacts ?? []];
+		if (input.runRecord) {
+			const { search } = input.runRecord;
+			if (input.runRecord.runId !== runId || search?.searchId !== this.searchId || search.nodeId !== cell.nodeId || search.cellId !== input.cellId || search.attempt !== attempt) throw new Error(`RunRecord ${input.runRecord.runId} does not carry the coordinates of ${runId}`);
+			artifacts.push(this.blob("run-record", input.runRecord));
 		}
 		await this.append({
-			kind: "search-planned",
-			eventId: "search:plan",
+			kind: "cell-settled",
+			eventId: `settled:${input.cellId}:${attempt}`,
 			occurredAt: this.stamp(),
-			artifacts: [this.writeArtifact("search-plan", "plan.json", {
-				runDir: this.opts.runDir,
-				splitDigest: this.opts.splitDigest,
-				maxGenerations: this.opts.maxGenerations,
-				populationSize: this.opts.populationSize,
-				tasks: this.tasks
-			})],
-			plan: {
-				candidateSlots,
-				tasks: this.tasks,
-				operations
-			}
+			artifacts,
+			cellId: input.cellId,
+			attempt,
+			runId,
+			outcome: input.outcome,
+			accounting: input.accounting,
+			boxMinutes: input.boxMinutes ?? null,
+			wallMs: input.wallMs ?? null,
+			queueMs: input.queueMs ?? null,
+			placement: input.placement ?? null,
+			identity: input.identity,
+			surfaceEvidence: input.surfaceEvidence ?? [],
+			traceRef: input.traceRef ?? { unknown: "the producer recorded no trace for this attempt" }
 		});
 	}
-	registeredSlot(slot) {
-		return this.order.some((entry) => entry.slotId === slot);
-	}
-	remember(entry) {
-		if (this.registered.has(entry.candidateId)) return;
-		this.registered.set(entry.candidateId, entry);
-		this.order.push(entry);
-	}
-	async recordGenerationOperation(generation, candidates, unfilled, failure) {
-		const shortfall = {
-			code: "proposal-short",
-			message: `generation ${generation} left ${unfilled} planned candidate slot(s) unfilled`
-		};
-		const outcome = failure ? {
-			status: "failed",
-			failure
-		} : unfilled <= 0 ? { status: "completed" } : candidates.length === 0 ? {
-			status: "failed",
-			failure: shortfall
-		} : {
-			status: "partial",
-			failure: shortfall
-		};
+	async cancelCell(input) {
+		const cell = (await this.ledger.state()).cell(input.cellId);
+		if (!cell) throw new Error(`cell ${input.cellId} was never allocated in ${this.searchId}`);
+		if (cell.cancelled || cell.final) return;
 		await this.append({
-			kind: "search-operation-recorded",
-			eventId: `operation:${generationOperationId(generation)}`,
+			kind: "cell-cancelled",
+			eventId: `cancelled:${input.cellId}`,
 			occurredAt: this.stamp(),
-			artifacts: [this.proposalArtifact(generation, candidates)],
-			operationId: generationOperationId(generation),
-			operationKind: "candidate-generation",
-			execution: this.opts.binding.identity.proposer,
-			outcome,
-			accounting: this.proposalAccounting()
+			artifacts: [],
+			cellId: input.cellId,
+			reason: input.reason
 		});
 	}
-	async closeSlot(slot, generationOperation, reason) {
-		if (!this.openSlots.has(slot)) return;
-		this.openSlots.delete(slot);
+	/** Record a decision about a node. Repeating the node's latest decision appends nothing. */
+	async decideNode(input) {
+		const node = (await this.ledger.state()).node(input.nodeId);
+		if (!node) throw new Error(`node ${input.nodeId} is not in ${this.searchId}`);
+		const latest = node.decisions.at(-1);
+		if (latest && canonicalString(latest.decision) === canonicalString(input.decision)) return;
 		await this.append({
-			kind: "candidate-slot-closed",
-			eventId: `slot-closed:${slot}`,
+			kind: "node-decided",
+			eventId: `decided:${input.nodeId}:${node.decisions.length}`,
 			occurredAt: this.stamp(),
-			artifacts: [this.writeArtifact("closed-slot", `slot-${slot}.json`, {
-				slot,
-				reason
-			})],
-			slotId: slot,
-			generationOperationId: generationOperation,
-			reason
+			artifacts: [],
+			nodeId: input.nodeId,
+			decision: input.decision,
+			basis: input.basis ?? null,
+			rule: input.rule,
+			reason: input.reason
 		});
 	}
-	/** Spend booked to candidate generation since the previous generation. */
-	proposalAccounting() {
-		const receipts = this.opts.costLedger.list({ phase: "search.proposal" });
-		const fresh = receipts.slice(this.proposalReceiptCount);
-		this.proposalReceiptCount = receipts.length;
-		return receiptAccounting(fresh);
-	}
-	cellModel(cell) {
-		const resolved = cell.resolvedModel;
-		if (resolved === void 0) return this.opts.binding.identity.model;
-		if (!modelHasSnapshot(resolved)) throw new Error(`search ledger: cell ${cell.cellId} ran model '${resolved}', which carries no immutable snapshot; the ledger cannot record a moving alias as execution identity`);
-		return {
-			provider: this.opts.binding.identity.model.provider,
-			snapshot: resolved
-		};
-	}
-	proposalArtifact(generation, candidates) {
-		return this.writeArtifact("candidate-proposal", `proposal-gen-${generation}.json`, {
-			generation,
-			candidates: candidates.map((candidate) => ({
-				surfaceHash: candidate.surfaceHash,
-				label: candidate.label ?? ""
-			}))
+	/** Close the search. The ledger refuses a close while any cell, operation or
+	* node decision is outstanding. */
+	async close(input) {
+		if ((await this.ledger.state()).closed) return;
+		await this.append({
+			kind: "search-closed",
+			eventId: "search-closed",
+			occurredAt: this.stamp(),
+			artifacts: [],
+			reason: input.reason,
+			claim: input.claim
 		});
 	}
-	/** Write one canonical evidence document and return its content address. */
-	writeArtifact(role, name, body) {
-		const directory = `${this.opts.runDir}/${SEARCH_LEDGER_DIR}`;
-		const path = `${directory}/${name}`;
-		const contents = canonicalString(body);
-		this.opts.storage.ensureDir(directory);
-		this.opts.storage.write(path, contents);
-		return {
-			role,
-			uri: `file://${path}`,
-			sha256: hashCanonical(contents),
-			byteLength: new TextEncoder().encode(contents).byteLength
-		};
+	/** A bounded receipt over the exact ledger bytes. */
+	receipt(input) {
+		return createSearchHistoryReceipt({
+			...input,
+			ledger: this.ledger,
+			storage: this.storage
+		});
 	}
 	async append(event) {
-		if (this.durableEventIds.has(event.eventId)) return;
-		await this.opts.binding.ledger.append(event);
-		this.durableEventIds.add(event.eventId);
+		await this.ledger.append(event);
 	}
 	/** Non-decreasing ISO stamps; the ledger refuses an event that moves back. */
 	stamp() {
-		const now = Date.now();
+		const now = this.now();
 		this.lastStampMs = now > this.lastStampMs ? now : this.lastStampMs + 1;
 		return new Date(this.lastStampMs).toISOString();
 	}
 };
-/** One task per designed (scenario, replicate) cell. */
-function plannedTasks(scenarios, reps, runDir, splitDigest) {
-	const tasks = [];
-	for (const scenario of scenarios) for (let rep = 0; rep < reps; rep++) tasks.push({
-		taskId: taskIdFor(scenario.id, rep),
-		source: {
-			uri: `scenario://${scenario.id}`,
-			revision: hashCanonical(scenario)
-		},
-		benchmark: {
-			uri: `campaign://${runDir}`,
-			revision: splitDigest
-		},
-		maxAttempts: 1
+/** A mutable surface as a node: its content digest, stored bytes and declared surfaces. */
+function surfaceNode(recorder, surface) {
+	const artifact = recorder.blob("surface", {
+		kind: "mutable-surface",
+		surface
 	});
-	return tasks;
-}
-function taskIdFor(scenarioId, rep) {
-	return `${scenarioId}#rep-${rep}`;
-}
-function slotId(generation, index) {
-	return `gen-${generation}-slot-${index}`;
+	return {
+		artifactDigest: surfaceContentHash(surface),
+		artifact,
+		surfaces: declaredSurfaces(surface, artifact)
+	};
 }
-function generationOperationId(generation) {
-	return `candidate-generation:gen-${generation}`;
+/** A parent-to-child diff of two mutable surfaces, stored as a blob. */
+function surfaceDiff(recorder, parent, child) {
+	return recorder.blob("diff", {
+		kind: "surface-diff",
+		from: surfaceContentHash(parent),
+		to: surfaceContentHash(child),
+		text: renderSurfaceDiff(child, parent)
+	});
 }
-/** Declared surfaces of one candidate. A component surface declares one
-*  surface per named component, so per-component evidence stays addressable. */
-function candidateSurfaces(surface, artifact) {
+/** Declared surfaces of one node. A component surface declares one surface per
+* named component, so per-component evidence stays addressable. */
+function declaredSurfaces(surface, artifact) {
 	if (typeof surface === "string") return [{
 		surfaceId: "prompt",
 		kind: "prompt",
@@ -3998,19 +4497,269 @@ function candidateSurfaces(surface, artifact) {
 		artifact
 	}));
 }
-/** The campaign measures a candidate surface as a whole, so per-surface
-*  attribution stays unmeasured instead of inventing a per-component delta. */
-function surfaceEvidenceFor(surfaceId, evidence) {
-	return {
-		surfaceId,
-		fired: true,
-		firingCount: 1,
-		effect: {
-			status: "not-measured",
-			reason: "the campaign measures the candidate surface as a whole, not per surface"
-		},
-		evidence: [evidence]
-	};
+function boundedLabel(label) {
+	const redacted = redactText(label.trim(), { profile: "share" });
+	return redacted.length <= MAX_LABEL_CHARS ? redacted : `${redacted.slice(0, MAX_LABEL_CHARS - 1)}…`;
+}
+/** The header without its stamp, for comparing a resumed opening to the stored one. */
+function headerMaterial(header) {
+	const { occurredAt: _occurredAt, ...material } = header;
+	return canonicalString(material);
+}
+/** The header as the ledger would store it, so the comparison ignores ordering. */
+function canonicalHeader(header) {
+	return validateSearchLedgerEvent({
+		...header,
+		occurredAt: "2000-01-01T00:00:00.000Z"
+	});
+}
+//#endregion
+//#region src/campaign/presets/run-optimization-recording.ts
+var OptimizationSearch = class OptimizationSearch {
+	recorder;
+	binding;
+	costLedger;
+	scenarioIds;
+	reps;
+	identity;
+	proposerName;
+	proposalReceiptCount = 0;
+	constructor(args) {
+		this.recorder = args.recorder;
+		this.binding = args.binding;
+		this.costLedger = args.costLedger;
+		this.scenarioIds = args.scenarioIds;
+		this.reps = args.reps;
+		this.identity = args.identity;
+		this.proposerName = args.proposerName;
+	}
+	/** Open the search and record the measured baseline as its seeded root. */
+	static async open(args) {
+		const { binding } = args;
+		const identity = {
+			model: binding.identity.model,
+			agent: binding.identity.agent,
+			benchmark: {
+				uri: "campaign://scenarios",
+				revision: args.splitDigest
+			}
+		};
+		const train = args.scenarios.map((scenario) => ({
+			taskId: scenario.id,
+			unitId: scenario.id,
+			source: {
+				uri: `scenario://${scenario.id}`,
+				revision: hashCanonical(scenario)
+			}
+		}));
+		const recorder = await SearchRecorder.open({
+			ledger: binding.ledger,
+			storage: args.storage
+		}, {
+			subject: binding.identity.subject ?? args.proposerName,
+			process: {
+				name: "runOptimization",
+				executionRef: binding.identity.search
+			},
+			artifactKind: "prompt",
+			objective: {
+				metric: "composite",
+				direction: "maximize",
+				judge: binding.identity.judge ?? { unknown: "runOptimization receives its judges as functions without a pinned source" },
+				claim: binding.identity.claim ?? developmentClaim(args.splitDigest)
+			},
+			splits: {
+				train,
+				selection: [],
+				test: [],
+				heldOutUnits: true
+			},
+			policy: {
+				expansion: args.expansion,
+				allocation: "uniform",
+				seed: args.seed
+			},
+			budget: {
+				maxUsd: args.maxUsd,
+				maxCells: null,
+				maxNodes: null,
+				deadline: null,
+				maxConcurrency: null,
+				reservedClaimUsd: 0
+			},
+			containment: null,
+			derivedFrom: null,
+			identity
+		});
+		const search = new OptimizationSearch({
+			recorder,
+			binding,
+			costLedger: args.costLedger,
+			scenarioIds: args.scenarios.map((scenario) => scenario.id),
+			reps: args.reps,
+			identity,
+			proposerName: args.proposerName
+		});
+		const root = await recorder.registerNode(surfaceNode(recorder, args.baselineSurface));
+		await recorder.recordEdge({
+			childNodeId: root.nodeId,
+			parents: [],
+			operator: "seed",
+			attribution: "explicit",
+			proposer: null,
+			proposalKey: "baseline",
+			rationale: { unknown: "the baseline is the caller-supplied starting surface" },
+			diffs: [],
+			label: "baseline"
+		});
+		await search.recordCells(root.nodeId, "root", args.baselineCells);
+		return {
+			search,
+			rootNodeId: root.nodeId
+		};
+	}
+	/** Start one generation's candidate-generation operation, before `propose()`. */
+	async startGeneration(generation) {
+		await this.recorder.startOperation({
+			operationId: generationOperationId(generation),
+			operationKind: "candidate-generation"
+		});
+	}
+	/** Record the generation's proposal: its operation, then one node and edge per candidate. */
+	async recordProposal(input) {
+		const operationId = generationOperationId(input.generation);
+		await this.recorder.recordOperation({
+			operationId,
+			operationKind: "candidate-generation",
+			execution: this.binding.identity.proposer,
+			outcome: { status: "completed" },
+			accounting: this.proposalAccounting()
+		});
+		const nodeIds = [];
+		for (const [index, candidate] of input.candidates.entries()) {
+			const { nodeId } = await this.recorder.registerNode(surfaceNode(this.recorder, candidate.surface));
+			await this.recorder.recordEdge({
+				childNodeId: nodeId,
+				parents: [input.parent.nodeId],
+				operator: "improve",
+				attribution: "explicit",
+				proposer: {
+					kind: "optimizer",
+					name: this.proposerName,
+					operationId,
+					source: this.binding.identity.proposer.source
+				},
+				proposalKey: `gen-${input.generation}:candidate-${index}`,
+				selection: {
+					rule: input.selectionRule,
+					evidence: input.parent.composite === null ? {} : { parentComposite: input.parent.composite }
+				},
+				rationale: candidate.rationale,
+				diffs: [surfaceDiff(this.recorder, input.parent.surface, candidate.surface)],
+				label: candidate.label
+			});
+			nodeIds.push(nodeId);
+		}
+		return nodeIds;
+	}
+	/** Close a generation whose proposer produced nothing or failed. */
+	async failGeneration(generation, message) {
+		await this.recorder.recordOperation({
+			operationId: generationOperationId(generation),
+			operationKind: "candidate-generation",
+			execution: this.binding.identity.proposer,
+			outcome: {
+				status: "failed",
+				failure: {
+					code: "no-candidates",
+					message
+				}
+			},
+			accounting: this.proposalAccounting()
+		});
+	}
+	/** Allocate every designed cell of a node before its campaign runs. */
+	async allocate(nodeId) {
+		for (const taskId of this.scenarioIds) for (let rep = 0; rep < this.reps; rep++) await this.recorder.allocateCell({
+			nodeId,
+			taskId,
+			split: "train",
+			rep,
+			stage: "train"
+		});
+	}
+	/** Settle a node's campaign cells; allocates any the campaign ran beyond the design. */
+	async recordCells(nodeId, stage, cells) {
+		for (const cell of cells) {
+			const cellId = await this.recorder.allocateCell({
+				nodeId,
+				taskId: cell.scenarioId,
+				split: "train",
+				rep: cell.rep,
+				stage
+			});
+			await this.recorder.settleCell({
+				cellId,
+				attempt: 1,
+				outcome: cellOutcome(cell),
+				accounting: cellAccounting(cell),
+				identity: {
+					...this.identity,
+					model: this.cellModel(cell)
+				},
+				wallMs: cell.durationMs,
+				traceRef: { unknown: "runCampaign reports no trace id per cell" }
+			});
+		}
+	}
+	/**
+	* Decide every node and close. The winner is selected; every other node is
+	* rejected. Allocated cells a campaign never returned are cancelled.
+	*/
+	async finish(input) {
+		const openCells = (await this.recorder.state()).cells().filter((cell) => cell.attempts === 0 && !cell.cancelled);
+		for (const cell of openCells) await this.recorder.cancelCell({
+			cellId: cell.cellId,
+			reason: "aborted"
+		});
+		for (const node of (await this.recorder.state()).nodes()) await this.recorder.decideNode({
+			nodeId: node.nodeId,
+			decision: node.nodeId === input.winnerNodeId ? { status: "selected" } : { status: "rejected" },
+			rule: "incumbent",
+			reason: node.nodeId === input.winnerNodeId ? "the incumbent when the loop stopped" : node.ordinal === 0 || input.promotedNodeIds.has(node.nodeId) ? "a later candidate replaced it as the incumbent" : input.incompleteNodeIds.has(node.nodeId) ? "the candidate missed a designed cell and could not be ranked" : "the candidate did not beat the incumbent"
+		});
+		await this.recorder.close({
+			reason: input.reason,
+			claim: null
+		});
+		return this.recorder.receipt({
+			producerId: this.proposerName,
+			runId: input.runId
+		});
+	}
+	/** Spend booked to candidate generation since the previous generation. */
+	proposalAccounting() {
+		const receipts = this.costLedger.list({ phase: "search.proposal" });
+		const fresh = receipts.slice(this.proposalReceiptCount);
+		this.proposalReceiptCount = receipts.length;
+		return receiptAccounting(fresh);
+	}
+	cellModel(cell) {
+		const resolved = cell.resolvedModel;
+		if (resolved === void 0) return this.identity.model;
+		const provider = this.identity.model.provider;
+		return modelHasSnapshot(resolved) ? {
+			provider,
+			snapshot: resolved
+		} : {
+			provider,
+			alias: resolved,
+			unknown: "the provider reported a moving alias, not a snapshot"
+		};
+	}
+};
+function generationOperationId(generation) {
+	return `candidate-generation:gen-${generation}`;
 }
 function cellOutcome(cell) {
 	const scores = Object.entries(cell.judgeScores).filter(([, score]) => score.failed !== true && Number.isFinite(score.composite));
@@ -4091,264 +4840,6 @@ function receiptAccounting(receipts) {
 		}
 	};
 }
-/**
-* Record an optimizer's own candidate graph into the same ledger.
-*
-* A complete optimization method searches inside its own process and reports
-* one artifact when it finishes: the candidate population, with each
-* candidate's parents and its score per selection scenario. This turns that
-* artifact into the canonical event stream, so a first-party method returns
-* the same `SearchHistoryReceipt` the in-process loop returns, and
-* `compareOptimizationMethods({ searchHistoryPolicy: 'require-complete' })`
-* accepts it.
-*
-* A candidate the optimizer left unscored on a planned scenario leaves the
-* planned denominator open, so the receipt reports the gap instead of closing
-* the search.
-*/
-async function recordCandidatePopulationSearch(input) {
-	const { population, ledger, identity } = input;
-	const stamps = monotonicStamps();
-	const writeArtifact = artifactWriter(input.storage, input.runDir);
-	const populationArtifact = {
-		role: "candidate-population",
-		uri: `file://${population.summary.path}`,
-		sha256: population.summary.sha256,
-		byteLength: population.summary.bytes
-	};
-	const tasks = input.scenarios.filter((scenario) => population.summary.scenarioIds.includes(scenario.id)).map((scenario) => ({
-		taskId: taskIdFor(scenario.id, 0),
-		source: {
-			uri: `scenario://${scenario.id}`,
-			revision: hashCanonical(scenario)
-		},
-		benchmark: {
-			uri: `optimizer://${input.producerId}`,
-			revision: population.summary.sha256
-		},
-		maxAttempts: 1
-	}));
-	if (tasks.length !== population.summary.scenarioIds.length) throw new Error(`search ledger: the candidate population scored ${population.summary.scenarioIds.length} scenarios, but ${tasks.length} were supplied`);
-	const generationOperation = "candidate-generation:population";
-	await ledger.append({
-		kind: "search-planned",
-		eventId: "search:plan",
-		occurredAt: stamps(),
-		artifacts: [populationArtifact],
-		plan: {
-			candidateSlots: population.candidates.map((candidate) => ({
-				slotId: `candidate-${candidate.index}`,
-				generationOperationId: generationOperation
-			})),
-			tasks,
-			operations: [{
-				operationId: generationOperation,
-				kind: "candidate-generation"
-			}, {
-				operationId: "selection",
-				kind: "selection"
-			}]
-		}
-	});
-	await ledger.append({
-		kind: "search-operation-recorded",
-		eventId: `operation:${generationOperation}`,
-		occurredAt: stamps(),
-		artifacts: [populationArtifact],
-		operationId: generationOperation,
-		operationKind: "candidate-generation",
-		execution: identity.proposer,
-		outcome: { status: "completed" },
-		accounting: input.generationAccounting
-	});
-	const candidateIds = /* @__PURE__ */ new Map();
-	const depths = /* @__PURE__ */ new Map();
-	for (const candidate of population.candidates) {
-		const parents = candidate.parentIndices.filter((index) => index !== null);
-		const candidateId = candidate.candidateHash;
-		candidateIds.set(candidate.index, candidateId);
-		const depth = parents.length === 0 ? 0 : Math.max(...parents.map((index) => depths.get(index) ?? 0)) + 1;
-		depths.set(candidate.index, depth);
-		const surfaceArtifact = writeArtifact("candidate-surface", `candidate-${candidate.index}.json`, {
-			index: candidate.index,
-			candidateDigest: candidate.candidateDigest,
-			candidate: candidate.candidate
-		});
-		await ledger.append({
-			kind: "candidate-registered",
-			eventId: `candidate:${candidate.index}`,
-			occurredAt: stamps(),
-			artifacts: [surfaceArtifact],
-			slotId: `candidate-${candidate.index}`,
-			generationOperationId: generationOperation,
-			candidateId,
-			lineage: {
-				lineageNodeId: candidateId.slice(0, 16),
-				parentCandidateIds: parents.map((index) => {
-					const parentId = candidateIds.get(index);
-					if (!parentId) throw new Error(`search ledger: candidate ${candidate.index} names parent ${index}, which precedes no registered candidate`);
-					return parentId;
-				}),
-				generation: depth,
-				proposer: input.producerId,
-				proposerSource: identity.proposer.source
-			},
-			surfaces: candidateSurfaces(externalSurface(candidate.candidate), surfaceArtifact)
-		});
-		const surfaceIds = candidateSurfaces(externalSurface(candidate.candidate), surfaceArtifact).map((surface) => surface.surfaceId);
-		for (const score of candidate.selectionScores) {
-			const task = tasks.find((planned) => planned.taskId === taskIdFor(score.scenarioId, 0));
-			if (!task) throw new Error(`search ledger: candidate ${candidate.index} scored unplanned scenario ${score.scenarioId}`);
-			await ledger.append({
-				kind: "task-attempted",
-				eventId: `attempt:${candidate.index}:${task.taskId}`,
-				occurredAt: stamps(),
-				artifacts: [populationArtifact],
-				candidateId,
-				runId: `${input.runId}:${candidate.index}:${task.taskId}`,
-				attemptIndex: 0,
-				task: {
-					taskId: task.taskId,
-					source: task.source
-				},
-				identity: {
-					model: identity.model,
-					agent: identity.agent,
-					benchmark: task.benchmark
-				},
-				outcome: {
-					status: "passed",
-					score: score.score,
-					metrics: { composite: score.score }
-				},
-				accounting: {
-					tokens: {
-						status: "unknown",
-						reason: "the optimizer reports no token usage per candidate evaluation"
-					},
-					cost: {
-						status: "unknown",
-						knownLowerBoundUsd: 0,
-						reason: "the optimizer reports no cost per candidate evaluation"
-					}
-				},
-				surfaceEvidence: surfaceIds.map((surfaceId) => surfaceEvidenceFor(surfaceId, populationArtifact))
-			});
-		}
-	}
-	await ledger.append({
-		kind: "search-operation-recorded",
-		eventId: "operation:selection",
-		occurredAt: stamps(),
-		artifacts: [populationArtifact],
-		operationId: "selection",
-		operationKind: "selection",
-		execution: {
-			kind: "deterministic",
-			source: identity.search
-		},
-		outcome: { status: "completed" },
-		accounting: {
-			tokens: {
-				status: "known",
-				inputTokens: 0,
-				outputTokens: 0,
-				cachedTokens: 0
-			},
-			cost: {
-				status: "known",
-				usd: 0,
-				source: "free"
-			}
-		}
-	});
-	const winnerId = candidateIds.get(population.bestIndex);
-	for (const candidate of population.candidates) await ledger.append({
-		kind: "candidate-decided",
-		eventId: `decision:${candidate.index}`,
-		occurredAt: stamps(),
-		artifacts: [populationArtifact],
-		candidateId: candidateIds.get(candidate.index),
-		decision: candidate.index === population.bestIndex ? { status: "selected" } : {
-			status: "rejected",
-			reason: {
-				code: "not-selected",
-				message: "the optimizer selected another candidate"
-			}
-		}
-	});
-	const replay = await ledger.replay();
-	const { missingCandidateSlots, missingTaskOutcomes, missingOperations } = replay.audit.expected;
-	if (winnerId && missingCandidateSlots.length === 0 && missingTaskOutcomes.length === 0 && missingOperations.length === 0 && replay.audit.decisions.pending === 0) await ledger.append({
-		kind: "search-completed",
-		eventId: "search:completed",
-		occurredAt: stamps(),
-		artifacts: [populationArtifact],
-		result: {
-			status: "selected",
-			candidateId: winnerId
-		}
-	});
-	const final = await ledger.replay();
-	const bytes = final.entries.map((entry) => `${canonicalString(entry)}\n`).join("");
-	return createSearchHistoryReceipt({
-		producerId: input.producerId,
-		runId: input.runId,
-		ledger: {
-			role: "search-ledger",
-			uri: `file://${ledger.path}`,
-			sha256: hashCanonical(bytes),
-			byteLength: new TextEncoder().encode(bytes).byteLength
-		},
-		replay: final
-	});
-}
-/** An optimizer candidate as the canonical mutable surface it represents. */
-function externalSurface(candidate) {
-	return typeof candidate === "string" ? candidate : {
-		kind: "components",
-		components: candidate
-	};
-}
-function artifactWriter(storage, runDir) {
-	const directory = `${runDir}/${SEARCH_LEDGER_DIR}`;
-	return (role, name, body) => {
-		const contents = canonicalString(body);
-		storage.ensureDir(directory);
-		storage.write(`${directory}/${name}`, contents);
-		return {
-			role,
-			uri: `file://${directory}/${name}`,
-			sha256: hashCanonical(contents),
-			byteLength: new TextEncoder().encode(contents).byteLength
-		};
-	};
-}
-/** Non-decreasing ISO stamps; the ledger refuses an event that moves back. */
-function monotonicStamps() {
-	let last = 0;
-	return () => {
-		const now = Date.now();
-		last = now > last ? now : last + 1;
-		return new Date(last).toISOString();
-	};
-}
-//#endregion
-//#region src/campaign/types.ts
-/** Type guard: a proposal carrying its rationale vs a bare
-*  surface. The loop branches on this to populate `GenerationCandidate`. */
-function isProposedCandidate(value) {
-	return typeof value === "object" && value !== null && "surface" in value && "label" in value && "rationale" in value;
-}
-const LABEL_TRUST_RANK = {
-	unverified: 0,
-	"verified-signal": 1,
-	"human-rated": 2
-};
-/** Ordinal rank for a label-trust tier; absent ⇒ `unverified` (rank 0). */
-function labelTrustRank(trust) {
-	return LABEL_TRUST_RANK[trust ?? "unverified"];
-}
 //#endregion
 //#region src/campaign/presets/run-optimization.ts
 /**
@@ -4404,18 +4895,26 @@ async function runOptimization(opts) {
 		const label = opts.premeasuredBaseline ? "premeasured baseline" : "baseline";
 		throw new Error(`runOptimization: ${label} is incomplete (${baselineCoverage.scorableCellIds.length}/${baselineCoverage.expectedCellIds.length} designed cells scorable) — ${formatCoverageFailures(baselineCoverage)}. Refusing to optimize against an incomplete incumbent.`);
 	}
-	const recorder = opts.searchLedger ? await SearchRecorder.open({
+	const opened = opts.searchLedger ? await OptimizationSearch.open({
 		binding: opts.searchLedger,
 		storage,
-		runDir: opts.runDir,
+		costLedger,
 		scenarios: opts.scenarios,
 		reps,
-		maxGenerations: opts.maxGenerations,
-		populationSize: opts.populationSize,
+		seed: opts.seed ?? 42,
 		splitDigest: baselineCampaign.splitDigest,
-		proposerLabel: proposer.kind,
-		costLedger
+		proposerName: proposer.kind,
+		expansion: opts.selectParent ? "select-parent" : "incumbent",
+		maxUsd: opts.costCeiling ?? null,
+		baselineSurface,
+		baselineCells: baselineCampaign.cells
 	}) : void 0;
+	const search = opened?.search;
+	const nodeIdByHash = /* @__PURE__ */ new Map();
+	if (opened) nodeIdByHash.set(surfaceHash(baselineSurface), opened.rootNodeId);
+	const incompleteNodeIds = /* @__PURE__ */ new Set();
+	const promotedNodeIds = /* @__PURE__ */ new Set();
+	let stopReason = "max-nodes";
 	const generations = [];
 	const history = [];
 	let currentFindings = initialFindings;
@@ -4453,7 +4952,10 @@ async function runOptimization(opts) {
 	}
 	for (let gen = 0; gen < opts.maxGenerations; gen++) {
 		const proposalHistory = immutableProposalSnapshot(history, "history");
-		if (proposer.decide?.({ history: proposalHistory }).stop) break;
+		if (proposer.decide?.({ history: proposalHistory }).stop) {
+			stopReason = "converged";
+			break;
+		}
 		const paretoParents = immutableProposalSnapshot(computeParetoFrontier(scored), "Pareto parents");
 		const incumbentOutcome = immutableProposalSnapshot(winnerOutcome, "incumbent outcome");
 		const selected = opts.selectParent ? resolveSelectedParent(opts.selectParent(Object.freeze({
@@ -4481,10 +4983,15 @@ async function runOptimization(opts) {
 			costLedger,
 			costPhase: "search.proposal"
 		});
+		await search?.startGeneration(gen);
 		const proposed = await proposer.propose(proposalContext);
 		if (!Array.isArray(proposed)) throw new TypeError("runOptimization: proposer must return an array");
 		const proposalSnapshot = immutableProposalSnapshot(proposed, "candidate outputs");
-		if (proposalSnapshot.length === 0) break;
+		if (proposalSnapshot.length === 0) {
+			await search?.failGeneration(gen, "the proposer returned no candidates");
+			stopReason = "converged";
+			break;
+		}
 		const candidates = proposalSnapshot.map((p) => isProposedCandidate(p) ? p : {
 			surface: p,
 			label: "",
@@ -4497,15 +5004,22 @@ async function runOptimization(opts) {
 			generationHashes.add(hash);
 		}
 		for (const hash of generationHashes) admittedCandidateHashes.add(hash);
-		await recorder?.recordGeneration({
-			generation: gen,
-			parentSurfaceHash,
-			candidates: candidates.map(({ surface, label }) => ({
-				surface,
-				surfaceHash: surfaceHash(surface),
-				...label ? { label } : {}
-			}))
-		});
+		if (search) {
+			const nodeIds = await search.recordProposal({
+				generation: gen,
+				parent: {
+					nodeId: nodeIdByHash.get(parentSurfaceHash),
+					surface: parentSurface,
+					composite: parentComposite
+				},
+				selectionRule: opts.selectParent ? "select-parent" : "incumbent",
+				candidates
+			});
+			for (const [index, nodeId] of nodeIds.entries()) {
+				nodeIdByHash.set(surfaceHash(candidates[index].surface), nodeId);
+				await search.allocate(nodeId);
+			}
+		}
 		const surfaceResults = await mapConcurrent(candidates, candidateConcurrency, async ({ surface, label, rationale, attribution }, i, signal) => {
 			const hash = surfaceHash(surface);
 			const campaign = await runCampaign({
@@ -4544,13 +5058,11 @@ async function runOptimization(opts) {
 				});
 			}
 		}
-		await recorder?.recordResults(surfaceResults.map((result) => ({
-			surface: result.surface,
-			surfaceHash: result.surfaceHash,
-			cells: result.campaign.cells,
-			runDir: result.campaign.runDir,
-			coverageComplete: result.coverage.complete
-		})));
+		if (search) for (const result of surfaceResults) {
+			const nodeId = nodeIdByHash.get(result.surfaceHash);
+			await search.recordCells(nodeId, "train", result.campaign.cells);
+			if (!result.coverage.complete) incompleteNodeIds.add(nodeId);
+		}
 		surfaceResults.sort((a, b) => {
 			if (a.coverage.complete !== b.coverage.complete) return a.coverage.complete ? -1 : 1;
 			if (a.rankKey && b.rankKey) return compareRankKeys(b.rankKey, a.rankKey);
@@ -4560,6 +5072,8 @@ async function runOptimization(opts) {
 		const promoted = top && compareRankKeys(top.rankKey, winnerRankKey) > 0 ? [top] : [];
 		if (promoted[0]) {
 			const top = promoted[0];
+			const promotedNodeId = nodeIdByHash.get(top.surfaceHash);
+			if (promotedNodeId) promotedNodeIds.add(promotedNodeId);
 			winnerSurface = top.surface;
 			winnerSurfaceHash = top.surfaceHash;
 			winnerComposite = top.composite;
@@ -4621,9 +5135,11 @@ async function runOptimization(opts) {
 			currentFindings = immutableProposalSnapshot(assertProposalFindings(fresh, "runOptimization generation analysis findings"), "generation analysis findings");
 		}
 	}
-	const searchHistory = await recorder?.finish({
-		winnerSurfaceHash,
-		generationsRun: generations.length,
+	const searchHistory = await search?.finish({
+		winnerNodeId: nodeIdByHash.get(winnerSurfaceHash),
+		promotedNodeIds,
+		incompleteNodeIds,
+		reason: stopReason,
 		runId: opts.runDir
 	});
 	return {
@@ -6154,6 +6670,6 @@ function firstString(value) {
 	return typeof value === "string" && value.trim() ? value : void 0;
 }
 //#endregion
-export { tangleTracesRoot as $, openSearchLedger as A, DEFAULT_RED_TEAM_CORPUS as B, assertSearchHistoryAdmissionOptions as C, verifySearchHistoryArtifact as D, searchHistoryCoverageRow as E, paretoFrontierWithCrowding as F, assertIndependentEvaluationSplit as G, redTeamReport as H, runFinalComparison as I, reserveFinalEvidence as J, captureFinalEvidencePolicy as K, openAutoPr as L, validateSearchLedgerEvent as M, dominates as N, verifySearchHistoryReceipt as O, paretoFrontier as P, resolveRunDir as Q, captureJudge as R, assertCompleteSearchHistory as S, createSearchHistoryReceipt as T, scoreRedTeamOutput as U, redTeamDataset as V, runCanaries as W, runCampaign as X, runEval as Y, planCampaignRun as Z, isProposedCandidate as _, transientDispatchFailure as a, recordCandidatePopulationSearch as b, compareOptimizationMethods as c, combineComparisonCosts as d, readCachedCell as et, costFromLedgerSummary as f, runOptimization as g, runImprovementLoop as h, quotaExhaustedUntil as i, replaySearchLedgerText as j, FileSearchLedger as k, optimizationTokenUsageFromSummary as l, readGepaCandidatePopulationArtifact as m, JudgeParseError as n, cellCachePath as nt, aggregateRunScore as o, assertGepaCandidatePopulationSummary as p, evaluationUnitMap as q, isTransientTransportFailure as r, computeManifestHash as rt, clamp01 as s, llmJudge as t, buildCellSchedule as tt, executeOptimizationMethod as u, labelTrustRank as v, assertSearchHistoryMatchesReplay as w, SearchHistoryRequiredError as x, SearchRecorder as y, defaultProductionGate as z };
+export { scoreRedTeamOutput as $, FileSearchLedger as A, SEARCH_LEDGER_SCHEMA as B, assertCompleteSearchHistory as C, searchHistoryCoverageRow as D, createSearchHistoryReceipt as E, SearchStateView as F, paretoFrontierWithCrowding as G, labelTrustRank as H, searchCellId as I, captureJudge as J, runFinalComparison as K, searchNodeId as L, replaySearchLedgerText as M, validateSearchLedgerEvent as N, verifySearchHistoryArtifact as O, SearchState as P, redTeamReport as Q, searchTaskSetDigest as R, SearchHistoryRequiredError as S, assertSearchHistoryMatchesState as T, dominates as U, isProposedCandidate as V, paretoFrontier as W, DEFAULT_RED_TEAM_CORPUS as X, defaultProductionGate as Y, redTeamDataset as Z, SearchRecorder as _, transientDispatchFailure as a, runEval as at, surfaceDiff as b, compareOptimizationMethods as c, resolveRunDir as ct, combineComparisonCosts as d, buildCellSchedule as dt, runCanaries as et, costFromLedgerSummary as f, cellCachePath as ft, runOptimization as g, runImprovementLoop as h, quotaExhaustedUntil as i, reserveFinalEvidence as it, openSearchLedger as j, verifySearchHistoryReceipt as k, optimizationTokenUsageFromSummary as l, tangleTracesRoot as lt, readGepaCandidatePopulationArtifact as m, JudgeParseError as n, captureFinalEvidencePolicy as nt, aggregateRunScore as o, runCampaign as ot, assertGepaCandidatePopulationSummary as p, computeManifestHash as pt, openAutoPr as q, isTransientTransportFailure as r, evaluationUnitMap as rt, clamp01 as s, planCampaignRun as st, llmJudge as t, assertIndependentEvaluationSplit as tt, executeOptimizationMethod as u, readCachedCell as ut, developmentClaim as v, assertSearchHistoryAdmissionOptions as w, surfaceNode as x, searchEdgeId as y, searchUnitScores as z };
 
-//# sourceMappingURL=llm-judge-DF18J3CR.js.map
+//# sourceMappingURL=llm-judge-bwbgDMP0.js.map