@tangle-network/agent-eval 0.197.0 → 0.198.0

package/dist/search-kernel-CuvbakC_.d.ts

@@ -0,0 +1,1176 @@
+import { o as CostLedger } from "./cost-ledger-DbQdN3nO.js";
+import { a as RunRecord } from "./run-record-DF-fuu31.js";
+import { A as SearchLedgerHash, C as SearchEdgeOperator, E as SearchExecutionIdentity, G as SearchSplit, H as SearchProposerKind, I as SearchNodeStatus, L as SearchOpenedEvent, N as SearchNodeDecision, O as SearchLedgerEntry, P as SearchNodeRef, Q as SearchTaskOutcome, R as SearchOperationKind, S as SearchEdgeAttribution, U as SearchReservation, V as SearchProposer, W as SearchSourceRef, Y as SearchSurfaceEvidence, Z as SearchTask, _ as SearchClaimPower, a as SearchAttemptAccounting, et as SearchTraceRef, i as SearchArtifactRef, j as SearchModelIdentity, k as SearchLedgerEvent, l as SearchCandidateSurface, m as SearchClaim, nt as EvaluationClaim, o as SearchAudit, p as SearchCellStage, t as NodeEstimate, tt as SearchUnknown, y as SearchCloseReason, z as SearchOperationRecordedEvent } from "./search-ledger-types-p2xKfiDJ.js";
+import { b as LedgerTrustedHeadRemoval, f as LedgerLineContext, h as LedgerTextStore, y as LedgerTrustedHead } from "./index-Bj96W0jZ.js";
+import { $ as SearchNode, at as SearchUnitScore, it as SearchStateView, j as MutableSurface, tt as SearchScoredCell } from "./types-EBUav9Bu.js";
+//#region src/campaign/storage.d.ts
+/**
+ * `CampaignStorage` — the filesystem seam `runCampaign` writes through
+ * (run/cell dirs, the resumability cache, per-cell artifacts, trace spans).
+ *
+ * The default (`fsCampaignStorage`) is the Node filesystem — identical
+ * behavior to the inline `node:fs` calls it replaces, so existing CLI
+ * consumers are unaffected. `inMemoryCampaignStorage` keeps everything in a
+ * `Map`, so the substrate runs in environments WITHOUT a filesystem
+ * (Cloudflare Workers, Deno Deploy, other edge runtimes) — the campaign
+ * still produces its `CampaignResult` (cells + aggregates) in memory;
+ * artifacts/traces simply aren't persisted to disk.
+ *
+ * Paths are opaque keys to the in-memory adapter — it does not parse them,
+ * so the same `join(...)`-built paths work unchanged across both adapters.
+ */
+interface CampaignStorage {
+  /** `filesystem` for the Node filesystem, whose paths durable journals such
+   * as the search ledger may open directly; any other storage keeps those
+   * journals in itself. */
+  readonly kind?: 'filesystem' | 'memory';
+  /** Ensure a directory exists (recursive). No-op for in-memory. */
+  ensureDir(dir: string): void;
+  /** Does this path exist (as a written file or an ensured dir)? */
+  exists(path: string): boolean;
+  /** Read a UTF-8 file; `undefined` when missing or unreadable. */
+  read(path: string): string | undefined;
+  /** Write a file (string or bytes). Parent dir is assumed ensured. */
+  write(path: string, content: string | Uint8Array): void;
+  /** Append only when the current UTF-8 byte length matches `expectedBytes`.
+   * Returns the new length, or undefined when another writer won. */
+  append(path: string, content: string, expectedBytes: number): number | undefined;
+}
+/** Node-filesystem storage — the default. Lazily requires `node:fs` so the
+ *  module imports cleanly in non-Node runtimes (where the caller passes
+ *  `inMemoryCampaignStorage` instead and never constructs this).
+ *
+ *  `createRequire(import.meta.url)` is the ESM-native lazy require — a bare
+ *  `require` is a ReferenceError under `"type": "module"`, which is exactly
+ *  the shape this package publishes. */
+declare function fsCampaignStorage(): CampaignStorage;
+/** In-memory storage for filesystem-less runtimes. Artifacts + trace spans
+ *  live in a `Map` for the duration of the run; the `CampaignResult` is
+ *  fully populated, but nothing is persisted to disk. */
+declare function inMemoryCampaignStorage(): CampaignStorage;
+/** Open the durable spend account stored beside a logical run. */
+declare function createRunCostLedger(input: {
+  storage: CampaignStorage;
+  runDir: string;
+  costCeilingUsd?: number;
+  /** Set false for read-only inspection that must not create the run directory. */
+  ensureRunDir?: boolean;
+}): CostLedger;
+//#endregion
+//#region src/campaign/search-ledger.d.ts
+/** Validate and return a canonical copy. Arrays whose order carries no meaning
+ * are sorted, so retries from different processes produce identical bytes. */
+declare function validateSearchLedgerEvent(input: unknown): SearchLedgerEvent;
+/**
+ * How this ledger uses its trusted head — the `(sequence, entryHash)` pin kept
+ * in the sibling `<path>.head` file that a hash chain needs to prove entries
+ * were not deleted from the end. `ledger-core/trusted-head.ts` holds the threat
+ * model.
+ *
+ * - `pin` (default): every append records the new head, and a pin that is
+ *   present is verified on every read.
+ * - `require`: additionally refuses to read a non-empty ledger whose pin is
+ *   gone, so deleting the sibling file cannot downgrade the guarantee.
+ * - `off`: chain verification only. Truncation to a valid shorter prefix is
+ *   undetectable.
+ */
+type SearchLedgerTrustedHeadMode = 'pin' | 'require' | 'off';
+interface OpenSearchLedgerOptions {
+  path: string;
+  searchId: string;
+  trustedHead?: SearchLedgerTrustedHeadMode;
+  /**
+   * Keep the ledger's text in this in-process store instead of a file, for a
+   * run without a filesystem (an in-memory `CampaignStorage`, keyed by `path`).
+   * The chain, parse and state rules are the file ledger's; there is no lock,
+   * fsync or trusted head, and the ledger lives as long as the store.
+   */
+  store?: LedgerTextStore;
+}
+interface SearchLedgerAppendResult {
+  entry: SearchLedgerEntry;
+  /** False when the exact event was already durably present. */
+  appended: boolean;
+  state: SearchStateView;
+}
+interface SearchLedger {
+  readonly path: string;
+  readonly searchId: string;
+  /** Sibling file holding this ledger's trusted head. */
+  readonly trustedHeadPath: string;
+  append(event: SearchLedgerEvent): Promise<SearchLedgerAppendResult>;
+  /** The verified state at the file's current head. */
+  state(): Promise<SearchStateView>;
+  /** The pinned head, or null when this ledger has never been pinned. */
+  trustedHead(): Promise<LedgerTrustedHead | null>;
+  /** Pin the current verified head without rewriting a byte. */
+  pinTrustedHead(): Promise<LedgerTrustedHead>;
+  /** Discard this ledger's pin, reporting what was discarded. It gives up the
+   * deletion guarantee for every entry the pin covered. */
+  clearTrustedHead(): Promise<LedgerTrustedHeadRemoval>;
+}
+/** Open a durable filesystem search ledger. Construction performs no I/O; the
+ * first `append` or `state` verifies the whole existing file. */
+declare function openSearchLedger(options: OpenSearchLedgerOptions): SearchLedger;
+/** Verify and project immutable search-ledger JSONL through the same codec as
+ * `FileSearchLedger`. */
+declare function replaySearchLedgerText(text: string, searchId: string, source: string): SearchStateView;
+/**
+ * Verify one stored ledger line in isolation: the schema tag, the entry and
+ * event schemas, canonical bytes, the entry's own hash, and its search. The
+ * chain (sequence and previous hash) and the state machine are the caller's,
+ * because they need the lines before this one. An ingest server runs this on
+ * every received line, so it hashes exactly the bytes the producer hashed.
+ */
+declare function parseSearchLedgerLine(line: string, searchId: string, context: LedgerLineContext): SearchLedgerEntry;
+/** Append-only file-backed search ledger with idempotent writes. */
+declare class FileSearchLedger implements SearchLedger {
+  readonly path: string;
+  readonly searchId: string;
+  readonly trustedHeadPath: string;
+  private readonly trustedHeadMode;
+  private readonly journal;
+  constructor(path: string, searchId: string, trustedHead?: SearchLedgerTrustedHeadMode);
+  state(): Promise<SearchStateView>;
+  append(input: SearchLedgerEvent): Promise<SearchLedgerAppendResult>;
+  trustedHead(): Promise<LedgerTrustedHead | null>;
+  pinTrustedHead(): Promise<LedgerTrustedHead>;
+  clearTrustedHead(): Promise<LedgerTrustedHeadRemoval>;
+}
+//#endregion
+//#region src/campaign/search-history-receipt.d.ts
+declare const SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION: '2026-09';
+declare const SEARCH_HISTORY_RECEIPT_DIGEST_ALGORITHM: 'rfc8785-sha256';
+/** Bounded summary of a search's audit. Exact ids stay in the ledger. */
+interface SearchHistoryAuditSummary {
+  readonly searchId: string;
+  readonly headHash: SearchLedgerHash | null;
+  readonly status: SearchAudit['status'];
+  readonly closeReason: SearchAudit['closeReason'];
+  readonly claimDecision: 'ship' | 'hold' | 'test-cannot-resolve' | null;
+  readonly selectedNodeId: string | null;
+  readonly eventCount: number;
+  readonly nodes: number;
+  readonly edges: number;
+  readonly cells: number;
+  readonly openCells: number;
+  readonly openOperations: number;
+  readonly nodesWithoutEdge: number;
+  readonly undecidedNodes: number;
+}
+/**
+ * A bounded proof envelope over one search ledger.
+ *
+ * The content-addressed ledger stays the only rich history. The receipt binds
+ * its producer and run, the exact ledger bytes, the digest of the complete
+ * audit, and a bounded summary. `complete` means the ledger holds
+ * `search-closed`, which the ledger admits only when every allocated cell has
+ * an outcome or was cancelled, every started operation was recorded, and every
+ * node has an edge and a terminal decision.
+ */
+interface SearchHistoryReceipt {
+  readonly schemaVersion: typeof SEARCH_HISTORY_RECEIPT_SCHEMA_VERSION;
+  readonly kind: 'search-history-receipt';
+  readonly digestAlgorithm: typeof SEARCH_HISTORY_RECEIPT_DIGEST_ALGORITHM;
+  readonly receiptDigest: SearchLedgerHash;
+  /** Stable producer identity, for example an OptimizationMethod name. */
+  readonly producerId: string;
+  /** Concrete optimizer or runtime invocation that produced the ledger. */
+  readonly runId: string;
+  /** The ledger file: `sha256` and `byteLength` of its exact bytes. */
+  readonly ledger: SearchArtifactRef;
+  /** `hashCanonical` of the complete `SearchAudit` from replaying those bytes. */
+  readonly auditDigest: SearchLedgerHash;
+  readonly summary: SearchHistoryAuditSummary;
+  readonly complete: boolean;
+  readonly incompleteReasons: readonly string[];
+}
+interface CreateSearchHistoryReceiptInput {
+  readonly producerId: string;
+  readonly runId: string;
+  readonly ledger: {
+    readonly path: string;
+    readonly searchId: string;
+  };
+  readonly storage?: Pick<CampaignStorage, 'read'>;
+}
+type SearchHistoryPolicy = 'allow-missing' | 'require-complete';
+interface SearchHistoryAdmissionOptions {
+  /** Missing history is reported by default; require-complete refuses final
+   * assessment without a closed search ledger. */
+  searchHistoryPolicy?: SearchHistoryPolicy;
+  /** Receipt checks are the default. Ledger checks also resolve and replay the bytes. */
+  searchHistoryVerification?: 'receipt' | 'ledger';
+}
+/** Read the ledger's bytes, replay them through the search codec, and build
+ * the receipt from that replay. */
+declare function createSearchHistoryReceipt(input: CreateSearchHistoryReceiptInput): SearchHistoryReceipt;
+/** Verify the receipt, then resolve its ledger bytes, check them, and replay
+ * them with the canonical codec. Never trusts a caller-supplied projection. */
+declare function verifySearchHistoryArtifact(receipt: SearchHistoryReceipt, storage: Pick<CampaignStorage, 'read'>): void;
+interface SearchHistoryCoverageRow {
+  readonly producerId: string;
+  readonly status: 'complete' | 'incomplete' | 'missing';
+  readonly reasons: readonly string[];
+  readonly stages?: readonly SearchHistoryCoverageRow[];
+  readonly receipt?: SearchHistoryReceipt;
+  /** Present only after the referenced bytes and replay were verified. */
+  readonly ledgerVerified?: true;
+}
+interface SearchHistoryCoverage {
+  readonly policy: SearchHistoryPolicy;
+  readonly allComplete: boolean;
+  readonly producers: readonly SearchHistoryCoverageRow[];
+}
+declare class SearchHistoryRequiredError extends Error {
+  readonly producerId: string;
+  readonly reasons: readonly string[];
+  constructor(producerId: string, reasons: readonly string[]);
+}
+/** Verify a receipt's own consistency and digest. */
+declare function verifySearchHistoryReceipt(receipt: SearchHistoryReceipt): SearchHistoryReceipt;
+/** Prove that a receipt describes exactly the supplied replayed state. */
+declare function assertSearchHistoryMatchesState(receipt: SearchHistoryReceipt, state: SearchStateView): void;
+/** Require a receipt owned by this producer over a closed search. */
+declare function assertCompleteSearchHistory(producerId: string, receipt: SearchHistoryReceipt | undefined): asserts receipt is SearchHistoryReceipt;
+/** Classify one producer's history without treating malformed evidence as absence. */
+declare function searchHistoryCoverageRow(producerId: string, receipt: SearchHistoryReceipt | undefined): SearchHistoryCoverageRow;
+//#endregion
+//#region src/campaign/search-ledger-recording.d.ts
+/** Identities the ledger needs and a loop cannot infer. */
+interface SearchRunIdentity {
+  /** The agent implementation under optimization. */
+  agent: SearchSourceRef;
+  /** The candidate generator: a model call or deterministic code. */
+  proposer: SearchOperationRecordedEvent['execution'];
+  /** The code that runs the search and decides its nodes. */
+  search: SearchSourceRef;
+  /** Model the agent runs; used for a cell that reported none. */
+  model: SearchModelIdentity;
+  /** What the search improves, for example `vb/coder`. Default: the producer's name. */
+  subject?: string;
+  /** The judge's pinned source. Default: unknown, because judges arrive as functions. */
+  judge?: SearchSourceRef;
+  /** The claim the search's numbers may support. Default: a development claim
+   *  over the supplied tasks, one unit per task. */
+  claim?: EvaluationClaim;
+}
+/** A ledger and the identities a loop records into it. */
+interface SearchLedgerBinding {
+  ledger: SearchLedger;
+  identity: SearchRunIdentity;
+}
+/** The default claim: development numbers over exactly the supplied tasks. */
+declare function developmentClaim(populationId: string): EvaluationClaim;
+/** The header of a search, with plain task lists; the recorder digests them. */
+type SearchOpening = Omit<SearchOpenedEvent, 'kind' | 'eventId' | 'occurredAt' | 'artifacts' | 'splits'> & {
+  splits: {
+    train: SearchTask[];
+    selection: SearchTask[];
+    test: SearchTask[];
+    heldOutUnits: boolean;
+  };
+};
+interface SearchRecorderOptions {
+  ledger: SearchLedger;
+  /** Where content-addressed blobs are written. Default: `blobs/` beside the ledger. */
+  blobDir?: string;
+  storage?: CampaignStorage;
+  /** Milliseconds since the epoch. Default: `Date.now`. */
+  now?: () => number;
+}
+interface RegisterSearchNodeInput {
+  artifactDigest: `sha256:${string}`;
+  artifact: SearchArtifactRef;
+  surfaces: SearchCandidateSurface[];
+}
+interface RecordSearchEdgeInput {
+  childNodeId: string;
+  /** Parents in this search, primary first, as node ids; or refs for a derive edge. */
+  parents: Array<string | SearchNodeRef>;
+  operator: SearchEdgeOperator;
+  attribution: SearchEdgeAttribution;
+  proposer: SearchProposer | null;
+  /** Stable id of this proposal within the search, so a resumed search
+   * recognizes the edge; for example `gen-3:candidate-1`. */
+  proposalKey: string;
+  selection?: {
+    rule: string;
+    evidence: Record<string, number>;
+  } | null;
+  /** The proposer's free-text rationale; redacted before it is stored. */
+  rationale: string | SearchUnknown;
+  /** One per parent: a diff blob from `recorder.blob('diff', …)`, or why there is none. */
+  diffs: Array<SearchArtifactRef | SearchUnknown>;
+  label?: string;
+}
+interface AllocateSearchCellInput {
+  nodeId: string;
+  taskId: string;
+  split: SearchSplit;
+  rep: number;
+  stage: SearchCellStage;
+  lane?: string | null;
+  reservation?: SearchReservation | null;
+}
+interface SettleSearchCellInput {
+  cellId: string;
+  /** Default: the next attempt. An attempt already in the ledger is not appended again. */
+  attempt?: number;
+  outcome: SearchTaskOutcome;
+  accounting: SearchAttemptAccounting;
+  identity: SearchExecutionIdentity;
+  boxMinutes?: number | null;
+  wallMs?: number | null;
+  queueMs?: number | null;
+  placement?: {
+    lane: string;
+    boxId: string | null;
+  } | null;
+  surfaceEvidence?: SearchSurfaceEvidence[];
+  traceRef?: SearchTraceRef;
+  /** The attempt's RunRecord; its search coordinates and runId must match. */
+  runRecord?: RunRecord;
+  artifacts?: SearchArtifactRef[];
+}
+/** Deterministic edge id: one proposal of one child within one search. */
+declare function searchEdgeId(searchId: string, childNodeId: string, proposalKey: string): string;
+/** Writes one search's events into its ledger as they happen. */
+declare class SearchRecorder {
+  readonly ledger: SearchLedger;
+  private readonly storage;
+  private readonly blobDir;
+  private readonly now;
+  private readonly tasks;
+  private lastStampMs;
+  private constructor();
+  /**
+   * Open the search: append `search-opened`, or, when the ledger already holds
+   * one, check that it is this search and continue it.
+   */
+  static open(options: SearchRecorderOptions, opening: SearchOpening, artifacts?: SearchArtifactRef[]): Promise<SearchRecorder>;
+  get searchId(): string;
+  /** The ledger's verified state now. */
+  state(): Promise<SearchStateView>;
+  /** Store `body` as a canonical JSON blob and return its content address. */
+  blob(role: string, body: unknown): SearchArtifactRef;
+  /**
+   * Read back a blob this recorder stored, by its content address. The bytes
+   * must hash to the reference's digest and length, so a resumed search reads
+   * exactly what the ledger bound.
+   */
+  readBlob(ref: SearchArtifactRef): unknown;
+  /** Register a node, or return the existing node with the same artifact digest. */
+  registerNode(input: RegisterSearchNodeInput): Promise<{
+    nodeId: string;
+    existed: boolean;
+  }>;
+  /** Record the proposal that derived a node. Returns the edge id. */
+  recordEdge(input: RecordSearchEdgeInput): Promise<string>;
+  startOperation(input: {
+    operationId: string;
+    operationKind: SearchOperationKind;
+    reservation?: SearchReservation | null;
+    /** Bound at the start, so a restart finds them even if the operation
+     * never records a result. */
+    artifacts?: SearchArtifactRef[];
+  }): Promise<void>;
+  recordOperation(input: Omit<SearchOperationRecordedEvent, 'kind' | 'eventId' | 'occurredAt' | 'artifacts'> & {
+    artifacts?: SearchArtifactRef[];
+  }): Promise<void>;
+  /** Plan one cell. Returns the cell id; an allocated cell is not allocated again. */
+  allocateCell(input: AllocateSearchCellInput): Promise<string>;
+  /** Record one finished attempt at a cell. */
+  settleCell(input: SettleSearchCellInput): Promise<void>;
+  cancelCell(input: {
+    cellId: string;
+    reason: 'pruned' | 'budget' | 'deadline' | 'aborted';
+  }): Promise<void>;
+  /** Record a decision about a node. Repeating the node's latest decision appends nothing. */
+  decideNode(input: {
+    nodeId: string;
+    decision: SearchNodeDecision;
+    basis?: NodeEstimate | null;
+    rule: string;
+    reason: string;
+  }): Promise<void>;
+  /** Close the search. The ledger refuses a close while any cell, operation or
+   * node decision is outstanding. */
+  close(input: {
+    reason: SearchCloseReason;
+    claim: SearchClaim | null;
+  }): Promise<void>;
+  /** A bounded receipt over the exact ledger bytes. */
+  receipt(input: {
+    producerId: string;
+    runId: string;
+  }): SearchHistoryReceipt;
+  private append;
+  /** Non-decreasing ISO stamps; the ledger refuses an event that moves back. */
+  private stamp;
+}
+/** A mutable surface as a node: its content digest, stored bytes and declared surfaces. */
+declare function surfaceNode(recorder: SearchRecorder, surface: MutableSurface): RegisterSearchNodeInput;
+/** A parent-to-child diff of two mutable surfaces, stored as a blob. */
+declare function surfaceDiff(recorder: SearchRecorder, parent: MutableSurface, child: MutableSurface): SearchArtifactRef;
+//#endregion
+//#region src/search/lenses/shared.d.ts
+/** The search's own ranking split: selection when the search declares one,
+ * else train. Matches `searchPolicyView` and `agent-eval search show`, so a
+ * lens ranks nodes on exactly the split the search itself ranks them on. */
+declare function rankingSplit(state: SearchStateView): 'train' | 'selection';
+/** One named signal a `SearchPolicy` can read: a small, quantitative payload
+ * under one label, so a policy reads `signal.value` without knowing a lens's
+ * full `data` shape. */
+interface LensSignal<T> {
+  name: string;
+  value: T;
+}
+interface LensResult<TData, TSignal> {
+  data: TData;
+  signal: LensSignal<TSignal>;
+}
+/** A descriptive summary of an independent (unpaired) numeric sample, staged
+ * exactly like `NodeEstimate.method`: `none` below 2 observations,
+ * `insufficient` below {@link INSUFFICIENT_FROM}, `descriptive` (bootstrap
+ * interval, spread only) below `BOOTSTRAP_GATE_MIN_N`, `bootstrap`
+ * (decision-grade interval) from there. Unlike `estimateNode`, these samples
+ * are not paired on a shared unit, so this is never a claim — only a
+ * lens's own honest description of what it measured. */
+interface SampleSummary {
+  n: number;
+  mean: number | null;
+  method: 'none' | 'insufficient' | 'descriptive' | 'bootstrap';
+  interval: [number, number] | null;
+}
+declare function summarizeSamples(samples: readonly number[], seed?: number): SampleSummary;
+//#endregion
+//#region src/search/lenses/operator-yield.d.ts
+/** The operators an expansion may choose (`SearchExpansion.operator` in
+ * `search-policy.ts`): every edge operator except `seed` (the search's own
+ * start) and `derive` (a cross-search edge a proposer never chooses). */
+declare const EXPANSION_OPERATORS: readonly ['draft', 'improve', 'debug', 'merge'];
+type ExpansionOperator = (typeof EXPANSION_OPERATORS)[number];
+/** The bandit's own gate: an operator's weight is used only once it has this
+ * many yield-eligible outcomes; below it, the policy falls back to a fixed
+ * weight for that operator. Same threshold `NodeEstimate.method` uses for
+ * `insufficient` (`minimumPairsForPairedDeltaTest(0.95)` = 6). */
+declare const MIN_OUTCOMES_FOR_WEIGHT = 6;
+interface OperatorOutcomeCounts {
+  advanced: number;
+  finalist: number;
+  selected: number;
+  pruned: number;
+  rejected: number;
+  invalid: number;
+  undecided: number;
+}
+interface OperatorYieldRow {
+  operator: SearchEdgeOperator;
+  /** Edges recorded with this operator, regardless of whether their child
+   * yields a usable sample. */
+  proposals: number;
+  outcomes: OperatorOutcomeCounts;
+  /** Children excluded from `yield`: no shared unit with the root (unknown
+   * posterior) or an unknown/zero known cost. Never imputed into `yield`. */
+  excluded: number;
+  yield: SampleSummary;
+}
+interface OperatorYieldData {
+  split: 'train' | 'selection';
+  rows: OperatorYieldRow[];
+}
+interface OperatorYieldOptions {
+  split?: 'train' | 'selection';
+}
+/** One weight per expandable operator: an operator's yield mean once it has
+ * `MIN_OUTCOMES_FOR_WEIGHT` or more samples, else `null` (not yet trusted —
+ * the policy's own fallback decides what an untrusted operator gets). */
+type OperatorYieldSignal = Record<ExpansionOperator, number | null>;
+declare function operatorYield(state: SearchStateView, options?: OperatorYieldOptions): {
+  data: OperatorYieldData;
+  signal: {
+    name: string;
+    value: OperatorYieldSignal;
+  };
+};
+//#endregion
+//#region src/campaign/estimate-node.d.ts
+/** The estimator every `NodeEstimate` names. */
+declare const SEARCH_ESTIMATOR: SearchSourceRef;
+interface EstimateNodeCellsInput {
+  nodeId: string;
+  against: string;
+  split: SearchSplit;
+  direction: 'maximize' | 'minimize';
+  /** Every scored cell of `nodeId` on `split`. */
+  nodeCells: readonly SearchScoredCell[];
+  /** Every scored cell of `against` on `split`. */
+  againstCells: readonly SearchScoredCell[];
+}
+/**
+ * Digest of the cells an estimate reads, with the contrast they serve. Cells
+ * are listed in cellId order, so the digest names the set, not the order it
+ * was read in.
+ */
+declare function searchCellSetDigest(input: Omit<EstimateNodeCellsInput, 'direction'>): SearchLedgerHash;
+/**
+ * The paired contrast of `nodeId` against `against` on the units both scored.
+ *
+ * `delta` is the mean per-unit difference, node minus `against`, in the
+ * metric's own units; for a `minimize` objective an improvement is negative.
+ * The exact sign test is one-sided toward improvement in the objective's
+ * direction. Unscored cells (errored, cancelled or in flight) are absent from
+ * the inputs, never zero.
+ *
+ * - `none` (0 or 1 pair): no delta.
+ * - `insufficient` (2 to 5): the delta only.
+ * - `descriptive` (6 to 19): the bootstrap interval as spread, and the sign-test p.
+ * - `bootstrap` (20 or more): the decision-grade bootstrap interval.
+ *
+ * When every paired delta is equal the interval would have zero width, which
+ * is an absence of evidence; the estimate is then `indeterminate` and carries
+ * neither an interval nor a p-value.
+ */
+declare function estimateNodeFromCells(input: EstimateNodeCellsInput): NodeEstimate;
+/**
+ * `estimateNodeFromCells` over the cells a search state holds: `nodeId`
+ * against `against` on one split, in the direction the search's objective
+ * declares.
+ */
+declare function estimateNode(state: SearchStateView, nodeId: string, options: {
+  against: string;
+  split: SearchSplit;
+}): NodeEstimate;
+/** A node's normal posterior on its improvement over the root. */
+interface NodePosterior {
+  nodeId: string;
+  /** Units the node and the root both scored. */
+  pairs: number;
+  /** Mean per-unit improvement over the root in the objective's direction,
+   * so larger is better for either direction. Null without a shared unit. */
+  mean: number | null;
+  /** The pooled variance divided by `pairs`. Null when either is unknown. */
+  variance: number | null;
+}
+interface SearchPosterior {
+  split: SearchSplit;
+  rootNodeId: string;
+  /**
+   * Between-unit variance of the per-unit improvements over the root, pooled
+   * across every non-root node with at least 2 shared units. Null until some
+   * node has 2.
+   */
+  pooledVariance: number | null;
+  /** Sum over the pooled nodes of their shared units minus one. */
+  degreesOfFreedom: number;
+  /** Every node in registration order; the root first, at exactly 0. */
+  nodes: NodePosterior[];
+}
+/**
+ * The posterior every node's parent-selection draw uses. Each node's mean is
+ * its improvement over the root on shared units; its variance is the search's
+ * pooled between-unit variance divided by its unit count, so a node measured
+ * on one unit has a wide posterior rather than none. The root is the reference
+ * and sits at exactly 0.
+ */
+declare function searchPosterior(state: SearchStateView, options?: {
+  split?: SearchSplit;
+}): SearchPosterior;
+//#endregion
+//#region src/campaign/search-policy.d.ts
+/** What a policy may read about a search. */
+interface SearchPolicyView {
+  readonly searchId: string;
+  readonly seed: number;
+  readonly direction: 'maximize' | 'minimize';
+  /** The split nodes are ranked on: selection, or train when the search
+   * declares no selection split (the proposer's own feedback then ranks). */
+  readonly split: 'selection' | 'train';
+  readonly rootNodeId: string;
+  /** Proposals completed so far. One an interrupted process lost does not count. */
+  readonly expansions: number;
+  /** Admitted nodes whose screen finished, in registration order, root first. */
+  readonly screened: readonly string[];
+  /** Admitted nodes still being screened. */
+  readonly screening: number;
+  /** True when the node has a scored cell on `split` and none of its cells
+   * there ran and ended unscored. A node that dodged a unit cannot lead; cells
+   * still to run, such as a rung the allocator just opened, do not count. */
+  complete(nodeId: string): boolean;
+  /** Per-unit means on `split`, in unitId order. */
+  unitScores(nodeId: string): readonly SearchUnitScore[];
+  /** The paired contrast of `nodeId` against `against` on `split`. */
+  estimate(nodeId: string, against: string): NodeEstimate;
+  /** Every node whose edge is recorded, in registration order, root first:
+   * nodes still being screened and nodes decided invalid included. */
+  nodes(): readonly SearchPolicyNode[];
+  /** Each node's normal posterior on its improvement over the root on
+   * `split` (`searchPosterior`), computed once per ledger state. */
+  readonly posterior: SearchPosterior;
+  /** The `operatorYield` lens's signal (search-tree-design §12) on `split`:
+   * an expandable operator's yield mean once it has enough measured
+   * outcomes, else null. Computed from the view's ledger state when first
+   * read. */
+  readonly operatorWeights: OperatorYieldSignal;
+}
+/** What a policy may read about one node. */
+interface SearchPolicyNode {
+  readonly nodeId: string;
+  readonly ordinal: number;
+  /** The primary parent; null for the root. */
+  readonly parent: string | null;
+  /** The operator of the edge that placed the node: `seed` for the root. */
+  readonly operator: SearchEdgeOperator;
+  /** The rule that chose the node's parent (that edge's `selection.rule`);
+   * null when the edge records none. */
+  readonly rule: string | null;
+  /** Nodes placed from this one, in registration order. */
+  readonly children: readonly string[];
+  /** The node's latest decision; null while undecided. */
+  readonly status: SearchNodeStatus | null;
+  /** Its cells outside the test split whose outcome is final: passed or failed. */
+  readonly outcomes: number;
+  /** Of those, the cells that failed: the agent's defect, such as a crash, a
+   * broken build or a judge integrity flag. An `errored` cell is the
+   * environment's fault and never counts. */
+  readonly defects: number;
+}
+/** One expansion: the parents a proposer derives a child from, and how. */
+interface SearchExpansion {
+  parents: string[];
+  operator: Exclude<SearchEdgeOperator, 'seed' | 'derive'>;
+  /** Why these parents: recorded on every edge the expansion produces. */
+  selection: {
+    rule: string;
+    evidence: Record<string, number>;
+  };
+}
+interface SearchPolicy {
+  /** Recorded as the search's `policy.expansion`. */
+  readonly name: string;
+  /** Stop after this many expansions without a new leader. */
+  readonly patience?: number;
+  /** The next expansion, or null to wait for more evidence. */
+  expand(view: SearchPolicyView): SearchExpansion | null;
+  /** The node the search keeps if it stopped now. */
+  leader(view: SearchPolicyView): string;
+}
+/**
+ * The hill climb. The leader starts at the root; a screened node that dodged no
+ * unit takes the lead when it scored every unit the leader scored and its mean
+ * on them beats the leader's. A node measured on fewer units than the leader,
+ * such as one an allocator has only screened, cannot take the lead on less
+ * evidence than the leader holds. Nodes are taken in registration order, so
+ * the leader is a pure function of the ledger. The policy expands the leader,
+ * and only once every earlier child is screened, so each proposal sees every
+ * result before it.
+ */
+declare function incumbent(options?: {
+  patience?: number;
+}): SearchPolicy;
+/**
+ * The hill climb (as `incumbent`), with its operator drawn from the
+ * `operatorYield` lens instead of fixed at `improve` (search-tree-design
+ * §12): a weighted draw, seeded from `seed` and the expansion index like
+ * `crowdedFrontierParent`, over the lens's per-operator yield. The fallback
+ * is per operator, not all-or-nothing: an operator the lens has not yet
+ * measured `MIN_OUTCOMES_FOR_WEIGHT` outcomes for draws on `fixedWeights`
+ * (uniform by default) instead, so it is never starved while unmeasured, and
+ * an operator that does have enough outcomes draws on its own measured
+ * yield right away rather than waiting for every other operator to catch
+ * up — proved against real search-sim ledgers where a hill climb had only
+ * ever proposed `improve`: an all-or-nothing gate would keep every draw
+ * uniform forever, because `draft`/`debug`/`merge` are never measured by a
+ * policy that never chooses them. A measured operator's weight is its own
+ * `fixedWeights` prior plus its yield, not the yield alone: the two are on
+ * different scales (yield is improvement per known dollar; the prior is an
+ * arbitrary share), so using the yield by itself would let a small positive
+ * yield draw LESS than an untested operator sitting on the default prior of
+ * 1 — the same real ledgers caught exactly that before this was fixed. The
+ * sum is floored just above zero, so a so-far-bad operator can still be
+ * re-measured rather than excluded outright.
+ */
+declare function incumbentWithOperatorBandit(options?: {
+  patience?: number;
+  seed: number;
+  fixedWeights?: Partial<Record<ExpansionOperator, number>>;
+}): SearchPolicy;
+/**
+ * The hill climb with a different parent: each expansion draws two distinct
+ * members of the Pareto frontier (per-unit means on the policy split) with a
+ * PRNG seeded from `seed` and the expansion index, and keeps the one with the
+ * larger crowding distance, the more isolated. Boundary members carry infinite
+ * distance. Ties fall to the higher mean, then to the earlier node. The leader
+ * rule is the incumbent's: a frontier parent explores, and only a node that
+ * beats the leader leads.
+ */
+declare function crowdedFrontierParent(options: {
+  seed: number;
+}): SearchPolicy;
+interface AideOptions {
+  /** Children of the root drafted as whole alternatives before the policy
+   * debugs or improves. Default 5. */
+  drafts?: number;
+  /** The chance an expansion debugs a buggy leaf when one exists. Default 0.5. */
+  debugProbability?: number;
+  /** Debug edges in a row that one chain may hold. Default 3. */
+  maxDebugDepth?: number;
+  /** Improve children in a row that leave their lineage's best posterior mean
+   * unraised before the lineage counts as stalled. Default 4. */
+  stallAfter?: number;
+}
+/**
+ * AIDE's search policy (`aide/agent.py`, `search_policy`) with three changes
+ * for noisy scores.
+ *
+ * 1. **Draft** while fewer than `drafts` nodes were drafted: the root is the
+ *    parent, and the proposer writes a whole alternative, not an edit.
+ * 2. **Debug**, with probability `debugProbability`: a buggy leaf, drawn
+ *    uniformly, whose chain holds fewer than `maxDebugDepth` debug edges. A
+ *    node is buggy when at least half of its final cells outside the test
+ *    split failed: defects, not a low score. An `errored` cell is the
+ *    environment's fault; it is retried and never makes a node buggy.
+ * 3. **Improve** otherwise. The parent is drawn by Thompson sampling, not
+ *    AIDE's argmax, from every screened node that is not buggy and has a
+ *    posterior (`searchPosterior`): the root sits at 0, and every other node
+ *    at its mean improvement over the root with the search's pooled
+ *    between-unit variance divided by its shared units, so a node measured on
+ *    few units draws from a wide posterior. Until some node shares 2 units
+ *    with the root the pooled variance is unknown, every posterior is as wide
+ *    as it can be, and the draw is uniform. With no such node, the policy
+ *    drafts.
+ * 4. **Stall:** when the drawn parent's lineage (the nodes under its nearest
+ *    draft, or under the root) has had `stallAfter` improve children in a row
+ *    that did not raise the lineage's best posterior mean, the improve forks
+ *    from the node with the best posterior mean instead. This is AIDE²'s
+ *    inner policy. A fork's children restart the run of the lineage they
+ *    join, so a stalled lineage that holds the global best forks once, not
+ *    on every later expansion.
+ *
+ * A parent is always a node whose screen finished; a node refused at
+ * admission or decided invalid never is. Draws come from a PRNG seeded by the
+ * search seed and the count of completed expansions, so the policy is a pure
+ * function of the ledger. The leader is the incumbent's.
+ */
+declare function aide(options?: AideOptions): SearchPolicy;
+/**
+ * Beam search: the beam is the top `width` nodes by posterior mean
+ * (`searchPosterior`), and the member with the fewest children is expanded,
+ * so each member is expanded in turn, as in a generation of `width`. A member
+ * is the root, a node an allocator advanced, or a node that scored every unit
+ * the root scored: a node an allocator has only screened waits for its rank
+ * before it enters. Ties go to the higher mean, then to the earlier node. The
+ * leader is the incumbent's. Strategy evolution is `beam` with its population
+ * as the width.
+ */
+declare function beam(options: {
+  width: number;
+}): SearchPolicy;
+//#endregion
+//#region src/campaign/allocation.d.ts
+/** One cell an allocator wants for a node. */
+interface SearchCellPlan {
+  taskId: string;
+  split: SearchSplit;
+  rep: number;
+  stage: SearchCellStage;
+}
+/** What an allocator reads when it decides. */
+interface SearchAllocationView {
+  readonly state: SearchStateView;
+  /** True when no cell allocated to the node can still run: each one ended
+   * scored, failed, cancelled or out of attempts. */
+  idle(nodeId: string): boolean;
+}
+/** A rank decision an allocator asks the kernel to record. */
+interface SearchRungDecision {
+  nodeId: string;
+  decision: {
+    status: 'advanced';
+    rung: number;
+  } | {
+    status: 'pruned';
+  };
+  /** The node against the root on the ranked split, as it stood at the decision. */
+  basis: NodeEstimate | null;
+  rule: string;
+  reason: string;
+}
+interface SearchAllocator {
+  /** Recorded as the search's `policy.allocation`. */
+  readonly name: string;
+  /** Repeats of each task. The claim runs its test cells at the same repeats. */
+  readonly reps: number;
+  /** Every cell the node needs through `rung`. The kernel allocates the ones
+   * missing; a node that was never advanced is at rung 0. */
+  plan(state: SearchStateView, nodeId: string, rung: number): SearchCellPlan[];
+  /** Cells a newly admitted node's screen allocates, so the kernel can price an
+   * expansion against the budget before the proposer runs. */
+  screenSize(state: SearchStateView): number;
+  /** Nodes the evidence now moves to a further rung, deepest rung first. The
+   * kernel records each one the budget admits and allocates its rung. */
+  advance(view: SearchAllocationView): SearchRungDecision[];
+  /** At close: nodes left waiting below the top rung, decided `pruned` with
+   * their rank. `keep`, the node the search keeps, is never pruned. */
+  prune(view: SearchAllocationView, keep: string): SearchRungDecision[];
+}
+/**
+ * Every node gets every train and selection task at every repeat: the root as
+ * `root` cells, every other node as `train` cells (the proposer's feedback) and
+ * `screen` cells (the policy's private evidence). This is the fixed plan the
+ * generation loop ran and GEPA runs. It has one rung, so it never advances or
+ * prunes a node.
+ */
+declare function uniform(options?: {
+  reps?: number;
+}): SearchAllocator;
+interface AshaOptions {
+  /** Units of the first rung. Default 6, `minimumPairsForPairedDeltaTest(0.95)`:
+   * the fewest shared units a paired contrast needs, so every screened edge
+   * gets one. */
+  units?: number;
+  /** Reduction factor: a node advances when it ranks in the top 1/eta of the
+   * nodes that finished its rung. Default 3. */
+  eta?: number;
+  /** Train units every non-root node also runs, as the proposer's feedback.
+   * They never enter a rank. Default 2. */
+  trainUnits?: number;
+  /** Repeats per task. Default 1. */
+  reps?: number;
+  /** How a rung beyond the first chooses the units it adds. Default: the
+   * next units of the seeded permutation. */
+  extend?: SearchUnitExtension;
+}
+/**
+ * How `asha` chooses the units a rung adds beyond the rung below it, for
+ * example the units that best separate the current leaders
+ * (`nextUnitExtension` in `search/lenses`). A rung's units are chosen once,
+ * when the first `advanced` decision opens the rung, and read back from that
+ * point of the ledger afterwards, so every node at the rung runs the same
+ * units and a replayed or resumed search derives the same plan.
+ */
+interface SearchUnitExtension {
+  /** Recorded inside the allocator's name, so the ledger names it. */
+  readonly name: string;
+  /**
+   * Up to `count` units of `remaining`, best first. The chooser must read
+   * only evidence the ledger held at `asOfSequence` (the decision that opened
+   * the rung). Units it does not name are filled from the seeded order.
+   */
+  choose(input: {
+    state: SearchStateView;
+    asOfSequence: number;
+    split: 'selection' | 'train';
+    rung: number;
+    /** Units of the rungs below, in rung order. */
+    measured: readonly string[];
+    remaining: readonly string[];
+    count: number;
+  }): readonly string[];
+}
+/**
+ * Asynchronous successive halving (Li et al., 2020) over one seeded
+ * permutation of the ranked split's units, fixed by the search's seed.
+ *
+ * Rung k is the first `units × 2^k` units of the permutation; the top rung is
+ * every unit. The root runs every unit before anything else, so every rung
+ * pairs against it. A new node screens on rung 0 plus `trainUnits` train
+ * units. Every node at a rung runs the same units as its parent, the root and
+ * its siblings, so every contrast pairs.
+ *
+ * A node that finished rung k advances once it ranks in the top
+ * floor(n / eta) of the n nodes that finished rung k, the root included, by
+ * mean over the rung's units; a node with an unscored unit ranks last and
+ * never advances. There is no barrier: a node outside the top waits, because
+ * the set grows as more nodes finish. At close a waiting node is pruned with
+ * its rank. The ranked split is selection, or train when a search declares no
+ * selection split, as the policy's.
+ */
+declare function asha(options?: AshaOptions): SearchAllocator;
+//#endregion
+//#region src/campaign/search-claim.d.ts
+/** The claim procedure every `SearchClaim` and claim plan names. */
+declare const SEARCH_CLAIM_RULE: SearchSourceRef;
+/**
+ * The claim reserve a search needs: the root and 3 finalists on every test
+ * task at `reps` repeats, each held at `cellUsd`. Declare at least this as
+ * `budget.reservedClaimUsd`; `runSearch` refuses to start a capped search
+ * with less.
+ */
+declare function searchClaimReserveUsd(input: {
+  testTasks: number;
+  reps: number;
+  cellUsd: number;
+}): number;
+/**
+ * The claim's design, fixed before any test cell runs, and stored as the
+ * `claim-plan` artifact of the ledger's `claim` operation.
+ */
+interface SearchClaimPlan {
+  kind: 'search-claim-plan';
+  rule: SearchSourceRef;
+  /** Why expansion stopped; the search closes with this reason. */
+  stopReason: SearchCloseReason;
+  /** Best first. Every one is decided `finalist` and named by the claim. */
+  finalists: Array<{
+    nodeId: string;
+    selectionMean: number;
+  }>;
+  power: SearchClaimPower;
+  /** `run`: the root and the finalists run every test task. Otherwise the
+   * claim closes with this decision and spends nothing on test cells. */
+  test: 'run' | 'hold' | 'test-cannot-resolve';
+  reason: string;
+}
+interface PlanSearchClaimInput {
+  stopReason: SearchCloseReason;
+  /** Repeats per test task. */
+  reps: number;
+  /** Whether the budget admits the test cells of the root and `finalists`. */
+  affordable(finalists: number): boolean;
+}
+/** Fix the claim's design from a search that stopped expanding. */
+declare function planSearchClaim(state: SearchStateView, input: PlanSearchClaimInput): SearchClaimPlan;
+/** A node decision the claim makes, ready for `recorder.decideNode`. */
+interface SearchClaimDecision {
+  nodeId: string;
+  decision: SearchNodeDecision;
+  basis: NodeEstimate | null;
+  rule: string;
+  reason: string;
+}
+/**
+ * Decide the claim from the test cells of the root and the finalists. Call it
+ * once every claim cell is settled or cancelled. It returns the claim and the
+ * terminal decisions of the root and every finalist.
+ */
+declare function decideSearchClaim(state: SearchStateView, plan: SearchClaimPlan): {
+  claim: SearchClaim;
+  decisions: SearchClaimDecision[];
+};
+/** Whether a closed search's claim is the one its own ledger supports. */
+type SearchClaimVerification = {
+  status: 'verified';
+} |
+/** The claim differs from the one the claim rule makes from the ledger. */
+{
+  status: 'mismatch';
+  differences: string[];
+} |
+/** The claim names a rule revision this code does not implement, so this
+ * code can neither confirm nor refute it. */
+{
+  status: 'unknown';
+  reason: string;
+};
+/**
+ * Make a closed search's claim again from its ledger alone and compare it with
+ * the recorded one, byte for byte: the power check, the finalists, each
+ * finalist's test estimate and deciding interval, the selection, the decision
+ * and the reason. A producer's claim is not evidence until this holds; a store
+ * keeps what this function derives, not what the producer wrote.
+ *
+ * It needs no blob, so it works on a store that keeps digests only. The
+ * finalists are the nodes the ledger decided `finalist`, in decision order.
+ * The one input the ledger cannot replay is whether the budget covered k
+ * finalists' test cells; the claim cells that ran answer it (none ran: the
+ * budget covered none). Test repeats come from the claim cells too; without
+ * test cells, the recorded estimator stands for them (binary needs one repeat,
+ * so any other count reproduces continuous).
+ *
+ * Returns null for a search that made no claim.
+ */
+declare function verifySearchClaim(state: SearchStateView): SearchClaimVerification | null;
+//#endregion
+//#region src/campaign/search-kernel.d.ts
+/** The kernel every `runSearch` ledger names as its search implementation. */
+declare const SEARCH_KERNEL_SOURCE: SearchSourceRef;
+/** An execution lane: a pool of slots whose cells share a cost rule. */
+interface SearchLane {
+  name: string;
+  /** Cells the lane runs at once. */
+  capacity: number;
+  /** `hard`: the lane enforces `cellUsd` as each cell's maximum. `estimate`:
+   * it cannot, and the kernel holds an estimate, recording any overshoot. */
+  costCap: 'hard' | 'estimate';
+  /** The enforced per-cell maximum of a hard lane; the prior estimate of an
+   * estimate lane until it has settled enough cells to estimate its own. */
+  cellUsd: number;
+}
+/** One attempt at one cell, as the kernel hands it to an executor. */
+interface SearchCellWork<TArtifact> {
+  searchId: string;
+  cellId: string;
+  nodeId: string;
+  taskId: string;
+  unitId: string;
+  split: SearchSplit;
+  rep: number;
+  stage: SearchCellStage;
+  lane: string;
+  attempt: number;
+  /** `cellId:attempt`: the id an executor keys the attempt's run by. */
+  runId: string;
+  artifact: TArtifact;
+  signal: AbortSignal;
+}
+/** What an attempt produced: everything `cell-settled` records except the
+ * coordinates the kernel owns. An environment fault is an `errored` outcome,
+ * not a rejection; a rejection stops the search. */
+type SearchCellResult = Omit<SettleSearchCellInput, 'cellId' | 'attempt'>;
+/** The executor port: lanes, placement, running a cell, and adopting an
+ * attempt an earlier kernel process started. */
+interface SearchExecutor<TArtifact> {
+  lanes(): readonly SearchLane[];
+  /** The lane a planned cell runs on. */
+  place(cell: SearchCellPlan & {
+    nodeId: string;
+  }): string;
+  run(work: SearchCellWork<TArtifact>): Promise<SearchCellResult>;
+  /** The result of `work.runId` if the executor already has it, else null.
+   * Called before the first dispatch of a cell the ledger shows unsettled when
+   * the kernel starts, so a restart does not run an attempt twice. */
+  adopt(work: SearchCellWork<TArtifact>): Promise<SearchCellResult | null>;
+}
+/** How a search stores, compares and restores its artifacts. */
+interface SearchArtifactCodec<TArtifact> {
+  /** The artifact as a content-addressed node; stores its bytes. */
+  node(recorder: SearchRecorder, artifact: TArtifact): RegisterSearchNodeInput;
+  /** The parent-to-child diff, stored as a blob, or why there is none. */
+  diff(recorder: SearchRecorder, parent: TArtifact, child: TArtifact): SearchArtifactRef | SearchUnknown;
+  /** The artifact a node holds, read back from its stored bytes. */
+  load(recorder: SearchRecorder, node: SearchNode): TArtifact;
+}
+interface SearchProposalRequest<TArtifact> {
+  expansion: number;
+  operationId: string;
+  operator: Exclude<SearchEdgeOperator, 'seed' | 'derive'>;
+  /** The parents the policy chose, primary first. */
+  parents: ReadonlyArray<{
+    nodeId: string;
+    artifact: TArtifact;
+  }>;
+  /** The node the search keeps now. */
+  leader: string;
+  signal: AbortSignal;
+}
+/** One child a proposal returned. */
+interface SearchProposedChild<TArtifact> {
+  artifact: TArtifact;
+  label: string;
+  /** The proposer's reason; redacted with the share profile before it is stored. */
+  rationale: string;
+  /** Typed JSON the proposer attaches to the child, stored with the proposal
+   * and never interpreted by the kernel. */
+  attribution?: Readonly<Record<string, unknown>>;
+}
+interface SearchProposalResult<TArtifact> {
+  children: ReadonlyArray<SearchProposedChild<TArtifact>>;
+  /** Set when the proposer judges the search converged; expansion stops. */
+  stop?: string;
+  /** What generated the children; default the port's `execution`. */
+  execution?: SearchOperationRecordedEvent['execution'];
+  accounting: SearchAttemptAccounting;
+}
+/** The proposer port: derives children from the parents the policy chose. */
+interface SearchProposerPort<TArtifact> {
+  readonly name: string;
+  readonly kind: SearchProposerKind;
+  readonly source: SearchSourceRef;
+  readonly execution: SearchOperationRecordedEvent['execution'];
+  /** Prior hold for one proposal until 20 proposals have settled. Default 0. */
+  readonly reservationUsd?: number;
+  /** Children one proposal usually returns, to price an expansion's screens
+   * before it runs. Default 1. */
+  readonly childrenPerProposal?: number;
+  propose(request: SearchProposalRequest<TArtifact>): Promise<SearchProposalResult<TArtifact>>;
+}
+interface RunSearchOptions<TArtifact> {
+  /** An opened recorder; its header names this policy and allocator. */
+  recorder: SearchRecorder;
+  /** The starting artifact: the seeded root. */
+  root: TArtifact;
+  codec: SearchArtifactCodec<TArtifact>;
+  policy: SearchPolicy;
+  allocation: SearchAllocator;
+  proposer: SearchProposerPort<TArtifact>;
+  executor: SearchExecutor<TArtifact>;
+  /** Refuse a child before it runs: the reason, or null to admit it. A
+   * refused child is recorded, decided `invalid`, and never becomes a parent. */
+  admit?: (artifact: TArtifact) => string | null;
+  /** Stop expanding after this many proposals. */
+  maxExpansions?: number;
+  /** Attempts per cell for retryable environment errors. Default 3. */
+  maxAttempts?: number;
+  /** Aborting pauses the search: in-flight cells are aborted, what settled is
+   * recorded, the ledger stays open, and the call rejects. Run the kernel on
+   * the same ledger again to continue. */
+  signal?: AbortSignal;
+  /** Milliseconds since the epoch, for the deadline. Default `Date.now`. */
+  now?: () => number;
+}
+interface SearchRunResult {
+  /** The closed search. */
+  state: SearchStateView;
+  /** The node the search keeps: the claim's selection, or without a claim the
+   * policy leader; the root when nothing was selected. */
+  leader: string;
+  reason: SearchCloseReason;
+  /** The claim on the sealed test split; null for a search without one. */
+  claim: SearchClaim | null;
+  /** The claim made again from the ledger alone (`verifySearchClaim`): never
+   * `mismatch`, which `runSearch` throws; `unknown` for a claim another rule
+   * revision made; null without a claim. */
+  claimVerification: SearchClaimVerification | null;
+}
+/** Run a search to its close, or continue one from its ledger. */
+declare function runSearch<TArtifact>(options: RunSearchOptions<TArtifact>): Promise<SearchRunResult>;
+/** The expansion index a kernel operation id encodes, or null. */
+declare function searchExpansionIndex(operationId: string): number | null;
+/** The stored output of one proposal: enough to register its children again. */
+interface SearchProposalBlob {
+  kind: 'search-proposal';
+  operator: SearchProposalRequest<unknown>['operator'];
+  parents: string[];
+  selection: {
+    rule: string;
+    evidence: Record<string, number>;
+  };
+  children: Array<{
+    node: RegisterSearchNodeInput;
+    diffs: Array<SearchArtifactRef | SearchUnknown>;
+    label: string;
+    rationale: string;
+    attribution: Readonly<Record<string, unknown>> | null;
+    invalid: string | null;
+  }>;
+}
+/**
+ * A policy's read of a search: `screened` lists the admitted nodes whose screen
+ * finished, in registration order; `screening` counts the admitted nodes still
+ * being screened. Nodes are ranked on the selection split, or on train when
+ * the search declares no selection split. The view reads no test cell.
+ * `maxAttempts` (default 3, the kernel's) says when an errored cell has no
+ * attempt left, which makes its unit a dodge.
+ */
+declare function searchPolicyView(state: SearchStateView, input: {
+  screened: readonly string[];
+  screening: number;
+  expansions: number;
+  maxAttempts?: number;
+}): SearchPolicyView;
+/**
+ * The divergence rule: a node whose train mean rose over its parent's on the
+ * train units they share while its selection interval against the parent (6
+ * or more units, not indeterminate) lies wholly on the worse side. Train is
+ * what the proposer reads; a gain there that selection contradicts is the
+ * signature of fitting the feedback instead of the task.
+ */
+declare function searchDivergence(state: SearchStateView, nodeId: string): {
+  basis: NodeEstimate;
+  reason: string;
+} | null;
+//#endregion
+export { EXPANSION_OPERATORS as $, SearchCellPlan as A, SearchHistoryCoverageRow as At, aide as B, FileSearchLedger as Bt, decideSearchClaim as C, searchEdgeId as Ct, AshaOptions as D, SearchHistoryAdmissionOptions as Dt, verifySearchClaim as E, CreateSearchHistoryReceiptInput as Et, AideOptions as F, assertSearchHistoryMatchesState as Ft, EstimateNodeCellsInput as G, openSearchLedger as Gt, crowdedFrontierParent as H, SearchLedger as Ht, SearchExpansion as I, createSearchHistoryReceipt as It, SearchPosterior as J, validateSearchLedgerEvent as Jt, NodePosterior as K, parseSearchLedgerLine as Kt, SearchPolicy as L, searchHistoryCoverageRow as Lt, SearchUnitExtension as M, SearchHistoryReceipt as Mt, asha as N, SearchHistoryRequiredError as Nt, SearchAllocationView as O, SearchHistoryAuditSummary as Ot, uniform as P, assertCompleteSearchHistory as Pt, searchPosterior as Q, inMemoryCampaignStorage as Qt, SearchPolicyNode as R, verifySearchHistoryArtifact as Rt, SearchClaimVerification as S, developmentClaim as St, searchClaimReserveUsd as T, surfaceNode as Tt, incumbent as U, SearchLedgerAppendResult as Ut, beam as V, OpenSearchLedgerOptions as Vt, incumbentWithOperatorBandit as W, SearchLedgerTrustedHeadMode as Wt, estimateNodeFromCells as X, createRunCostLedger as Xt, estimateNode as Y, CampaignStorage as Yt, searchCellSetDigest as Z, fsCampaignStorage as Zt, searchPolicyView as _, SearchOpening as _t, SearchCellWork as a, OperatorYieldRow as at, SearchClaimDecision as b, SearchRunIdentity as bt, SearchProposalBlob as c, LensResult as ct, SearchProposedChild as d, rankingSplit as dt, ExpansionOperator as et, SearchProposerPort as f, summarizeSamples as ft, searchExpansionIndex as g, SearchLedgerBinding as gt, searchDivergence as h, RegisterSearchNodeInput as ht, SearchCellResult as i, OperatorYieldOptions as it, SearchRungDecision as j, SearchHistoryPolicy as jt, SearchAllocator as k, SearchHistoryCoverage as kt, SearchProposalRequest as l, LensSignal as lt, runSearch as m, RecordSearchEdgeInput as mt, SEARCH_KERNEL_SOURCE as n, OperatorOutcomeCounts as nt, SearchExecutor as o, OperatorYieldSignal as ot, SearchRunResult as p, AllocateSearchCellInput as pt, SEARCH_ESTIMATOR as q, replaySearchLedgerText as qt, SearchArtifactCodec as r, OperatorYieldData as rt, SearchLane as s, operatorYield as st, RunSearchOptions as t, MIN_OUTCOMES_FOR_WEIGHT as tt, SearchProposalResult as u, SampleSummary as ut, PlanSearchClaimInput as v, SearchRecorder as vt, planSearchClaim as w, surfaceDiff as wt, SearchClaimPlan as x, SettleSearchCellInput as xt, SEARCH_CLAIM_RULE as y, SearchRecorderOptions as yt, SearchPolicyView as z, verifySearchHistoryReceipt as zt };
+//# sourceMappingURL=search-kernel-CuvbakC_.d.ts.map