@tangle-network/agent-eval 0.216.1 → 0.218.1

package/dist/experiment/index.js

@@ -1,104 +1,22 @@
-import { n as CaptureIntegrityError, s as ValidationError } from "../errors-DVZiqS7K.js";
-import { a as hashCanonical, t as LEDGER_HASH_PATTERN } from "../canonical-B2RqLofv.js";
-import { f as evaluateHypothesis, g as verifyManifest, h as signManifest, m as manifestContentDigest, p as hashJson } from "../agent-profile-cell-BK8mlqlq.js";
-import { t as mulberry32 } from "../random-ByUSnV9w.js";
-import { n as bonferroni, r as holm, t as benjaminiHochberg } from "../multiplicity-DQUFcbW4.js";
-import { a as pairedRiskDifferenceExact, c as wilson, i as pairedRiskDifference, n as mcnemar, o as pairedRiskDifferenceScore } from "../paired-binary-CvpFHfKZ.js";
-import { n as studentTQuantile, t as studentTCdf } from "../student-t-DVPW7CdL.js";
-import { i as pairedBootstrap, n as BOOTSTRAP_GATE_MIN_N } from "../mean-DHoMiudD.js";
-import { a as requiredSampleSize, i as requiredPairedSampleSize, n as mcnemarRequiredN, r as pairedMde, t as mcnemarPower } from "../power-and-mde-Hj2ubb4B.js";
-import { n as pairArms, r as pairRunRecords, t as comparePairedArms } from "../paired-arms-CwMGJsrS.js";
-import { t as eProcess } from "../sequential-eprocess-DM_qENCl.js";
-import { a as heldoutSignificance, o as pairHoldout } from "../statistical-heldout-42NlCNDe.js";
-import { D as FinalEvidenceError, E as FinalEvidenceConflictError, O as openFinalEvidenceLedger, T as powerPreflight, a as verifyEvidenceReceipt, i as isIndependentEvidence, n as EVIDENCE_RECEIPT_VERSION, r as createEvidenceReceipt, t as createCampaignEvidenceReceipt } from "../campaign-evidence-Clrn4hBV.js";
+import { n as CaptureIntegrityError, s as ValidationError } from "../errors-BcOs5MKW.js";
+import { a as hashCanonical, t as LEDGER_HASH_PATTERN } from "../canonical-Dq2hOQ8L.js";
+import { d as signManifest, f as verifyManifest, l as hashJson, u as manifestContentDigest } from "../agent-profile-cell-B1V1gUZs.js";
+import { t as mulberry32 } from "../random-DDDcC7YU.js";
+import { n as pairArms, r as pairRunRecords, t as comparePairedArms } from "../paired-arms-Ct4LTKc1.js";
+import { n as bonferroni, r as holm, t as benjaminiHochberg } from "../multiplicity-Sg0U7h8j.js";
+import { a as pairedRiskDifferenceScore, i as pairedRiskDifferenceExact, r as pairedRiskDifference, s as wilson, t as mcnemar } from "../paired-binary-B_nejA44.js";
+import { c as studentTCdf, i as pairedBootstrap, l as studentTQuantile, n as BOOTSTRAP_GATE_MIN_N } from "../mean-BbA_JCzW.js";
+import { a as requiredSampleSize, i as requiredPairedSampleSize, n as mcnemarRequiredN, r as pairedMde, t as mcnemarPower } from "../power-and-mde-N5nU4_Ly.js";
+import { t as eProcess } from "../sequential-eprocess-DodI6RoF.js";
+import { a as heldoutSignificance, o as pairHoldout } from "../statistical-heldout-Bksv92Th.js";
+import { S as openFinalEvidenceLedger, b as FinalEvidenceConflictError, i as verifyEvidenceReceipt, n as createEvidenceReceipt, r as isIndependentEvidence, t as createCampaignEvidenceReceipt, x as FinalEvidenceError, y as powerPreflight } from "../campaign-evidence-DunzcJGv.js";
 import { n as evaluatePredicate, r as readField, t as compareValues } from "../predicate-FdKmElA_.js";
-import { r as summarizeEvaluationUnits, t as defineEvaluationClaim } from "../claim-q4HQhK1G.js";
-import { n as pairedEvalueSequence, r as sequentialCrossingHorizon } from "../sequential-CzK5DarL.js";
-import { n as intervalSpecProblems, r as computeEstimand, t as computeInterval } from "../interval-CELpye1n.js";
-import { n as paretoPolicy, r as paretoSignificanceGate, t as buildEvidenceVector } from "../promotion-policy-KO57gbyV.js";
-import { n as sequentialPairedGate, t as sequentialDecide } from "../sequential-Bf_pbE50.js";
+import { r as summarizeEvaluationUnits, t as defineEvaluationClaim } from "../claim-BPVuyHuy.js";
+import { n as pairedEvalueSequence } from "../sequential-BVv1sjsw.js";
+import { n as intervalSpecProblems, r as computeEstimand, t as computeInterval } from "../interval-Dq9gt7jx.js";
+import { n as paretoPolicy, r as paretoSignificanceGate, t as buildEvidenceVector } from "../promotion-policy-6A8osGr_.js";
+import { n as sequentialPairedGate, t as sequentialDecide } from "../sequential-CimQrbjv.js";
 import { z } from "zod";
-//#region src/experiment/ast/budget.ts
-function evaluateHaltRule(halt, gates) {
-	const seen = new Map(gates.map((g) => [g.id, g]));
-	const missing = halt.when.gates.filter((id) => !seen.has(id));
-	if (missing.length > 0) throw new ValidationError(`evaluateHaltRule: halt references gates that were not evaluated: [${missing.join(", ")}]`);
-	const failed = halt.when.gates.filter((id) => !seen.get(id).passed);
-	return failed.length > 0 ? {
-		fired: true,
-		action: halt.action,
-		failedGates: failed
-	} : {
-		fired: false,
-		action: null,
-		failedGates: []
-	};
-}
-/**
-* Execute the uniform-pass schedule against measured pass costs. Pass 1 always
-* runs; each later pass runs only when the cumulative spend plus the last
-* measured pass cost stays at or under the registered ceiling. The registered
-* ledger is the pre-spend the ceiling counts.
-*/
-function runUniformPassBudget(rule, measuredPassCosts) {
-	let cumulative = rule.ledger.reduce((sum, entry) => sum + entry.usd, 0);
-	const decisions = [];
-	let uniformN = 0;
-	for (let pass = 1; pass <= rule.maxPasses; pass++) {
-		if (pass === 1) {
-			if (measuredPassCosts[0] === void 0) break;
-			cumulative += measuredPassCosts[0];
-			uniformN = 1;
-			continue;
-		}
-		const projected = measuredPassCosts[pass - 2];
-		if (projected === void 0) break;
-		const go = cumulative + projected <= rule.ceilingUsd;
-		decisions.push({
-			pass,
-			cumulativeBefore: cumulative,
-			projected,
-			go
-		});
-		if (!go || measuredPassCosts[pass - 1] === void 0) break;
-		cumulative += measuredPassCosts[pass - 1];
-		uniformN = pass;
-	}
-	return {
-		decisions,
-		uniformN
-	};
-}
-/**
-* Walk the registered n-ladder and pick the first affordable step. When no
-* step fits the ceiling, the rule refuses and reports the projection instead
-* of shrinking the row set — "never subset rows" is the registered invariant.
-*/
-function projectNLadderBudget(rule, measured) {
-	const projections = rule.steps.map((n) => {
-		const projectedUsd = measured.unitCostUsd * measured.rows * n;
-		return {
-			n,
-			projectedUsd,
-			affordable: projectedUsd <= rule.ceilingUsd
-		};
-	});
-	const first = projections.find((p) => p.affordable);
-	if (first) return {
-		chosenN: first.n,
-		projections,
-		refusal: null
-	};
-	return {
-		chosenN: null,
-		projections,
-		refusal: {
-			onExhaust: rule.onExhaust,
-			reason: `no ladder step fits the ${rule.ceilingUsd} USD ceiling at ${measured.rows} rows x ${measured.unitCostUsd} USD per unit`
-		}
-	};
-}
-//#endregion
 //#region src/experiment/ast/decision.ts
 /** A decision rule's branches did not cover the evidence. */
 var DecisionTableNotTotalError = class extends ValidationError {};
@@ -137,67 +55,6 @@ function executeDecisionRule(rule, evidence) {
 	throw new DecisionTableNotTotalError("executeDecisionRule: decision table is not total — no branch matched the evidence");
 }
 //#endregion
-//#region src/experiment/ast/reissue.ts
-/**
-* Classify one rollout event under the registered reissue policy. A carrier
-* event within the issue budget is reissued; a model outcome always stands;
-* a carrier event past `maxIssues` is exhausted and reported, never retried.
-*/
-function classifyReissue(policy, event, issuesSoFar) {
-	if (!policy.carrierEvents.includes(event)) return "stands";
-	return issuesSoFar < policy.maxIssues ? "reissue" : "exhausted";
-}
-//#endregion
-//#region src/experiment/ast/selection.ts
-/**
-* Execute a selection rule.
-*
-* Round-robin walks groups in lexicographic order and takes ids in
-* within-group order until `take` ids are chosen. Filter-of keeps the ids of
-* `bases[rule.base]` whose record satisfies the predicate, in the registered
-* order. Ids absent from `records` are evaluated on their id alone (fields
-* derived from the id via `idFields`), so a sealed base outlives its source
-* records.
-*/
-function runSelectionRule(rule, records, options) {
-	if (rule.kind === "round-robin") {
-		const allowed = new Set(rule.reads);
-		for (const field of [rule.groupBy, rule.withinOrder.field]) if (!allowed.has(field)) throw new ValidationError(`runSelectionRule: round-robin reads '${field}' but its closed read set is [${rule.reads.join(", ")}]`);
-		const byGroup = /* @__PURE__ */ new Map();
-		for (const record of records) {
-			const group = String(readField(record, rule.groupBy));
-			const id = String(readField(record, rule.withinOrder.field));
-			const bucket = byGroup.get(group);
-			if (bucket) bucket.push(id);
-			else byGroup.set(group, [id]);
-		}
-		for (const ids of byGroup.values()) {
-			ids.sort();
-			if (rule.withinOrder.dir === "desc") ids.reverse();
-		}
-		const groups = [...byGroup.keys()].sort();
-		const chosen = [];
-		let cursor = 0;
-		while (chosen.length < rule.take && groups.some((g) => byGroup.get(g).length > 0)) {
-			const group = groups[cursor % groups.length];
-			const ids = byGroup.get(group);
-			if (ids.length > 0) chosen.push(ids.shift());
-			cursor += 1;
-		}
-		return chosen;
-	}
-	const base = options.bases?.[rule.base];
-	if (!base) throw new ValidationError(`runSelectionRule: filter-of base '${rule.base}' was not provided`);
-	const index = new Map(records.map((r) => [String(readField(r, options.idField)), r]));
-	const sorted = [...base.filter((id) => {
-		const record = index.get(id) ?? options.idFields?.(id);
-		if (!record) throw new ValidationError(`runSelectionRule: base id '${id}' has no record and no idFields derivation`);
-		return evaluatePredicate(rule.keep, record);
-	})].sort();
-	if (rule.order.dir === "desc") sorted.reverse();
-	return sorted;
-}
-//#endregion
 //#region src/experiment/ast/validity.ts
 /**
 * Replicate-flip counting over graded states. A state whose replicates split
@@ -355,6 +212,137 @@ function assertMatchedBudgets(rule, arms) {
 	return verdict;
 }
 //#endregion
+//#region src/experiment/ast/budget.ts
+function evaluateHaltRule(halt, gates) {
+	const seen = new Map(gates.map((g) => [g.id, g]));
+	const missing = halt.when.gates.filter((id) => !seen.has(id));
+	if (missing.length > 0) throw new ValidationError(`evaluateHaltRule: halt references gates that were not evaluated: [${missing.join(", ")}]`);
+	const failed = halt.when.gates.filter((id) => !seen.get(id).passed);
+	return failed.length > 0 ? {
+		fired: true,
+		action: halt.action,
+		failedGates: failed
+	} : {
+		fired: false,
+		action: null,
+		failedGates: []
+	};
+}
+/**
+* Execute the uniform-pass schedule against measured pass costs. Pass 1 always
+* runs; each later pass runs only when the cumulative spend plus the last
+* measured pass cost stays at or under the registered ceiling. The registered
+* ledger is the pre-spend the ceiling counts.
+*/
+function runUniformPassBudget(rule, measuredPassCosts) {
+	let cumulative = rule.ledger.reduce((sum, entry) => sum + entry.usd, 0);
+	const decisions = [];
+	let uniformN = 0;
+	for (let pass = 1; pass <= rule.maxPasses; pass++) {
+		if (pass === 1) {
+			if (measuredPassCosts[0] === void 0) break;
+			cumulative += measuredPassCosts[0];
+			uniformN = 1;
+			continue;
+		}
+		const projected = measuredPassCosts[pass - 2];
+		if (projected === void 0) break;
+		const go = cumulative + projected <= rule.ceilingUsd;
+		decisions.push({
+			pass,
+			cumulativeBefore: cumulative,
+			projected,
+			go
+		});
+		if (!go || measuredPassCosts[pass - 1] === void 0) break;
+		cumulative += measuredPassCosts[pass - 1];
+		uniformN = pass;
+	}
+	return {
+		decisions,
+		uniformN
+	};
+}
+/**
+* Walk the registered n-ladder and pick the first affordable step. When no
+* step fits the ceiling, the rule refuses and reports the projection instead
+* of shrinking the row set — "never subset rows" is the registered invariant.
+*/
+function projectNLadderBudget(rule, measured) {
+	const projections = rule.steps.map((n) => {
+		const projectedUsd = measured.unitCostUsd * measured.rows * n;
+		return {
+			n,
+			projectedUsd,
+			affordable: projectedUsd <= rule.ceilingUsd
+		};
+	});
+	const first = projections.find((p) => p.affordable);
+	if (first) return {
+		chosenN: first.n,
+		projections,
+		refusal: null
+	};
+	return {
+		chosenN: null,
+		projections,
+		refusal: {
+			onExhaust: rule.onExhaust,
+			reason: `no ladder step fits the ${rule.ceilingUsd} USD ceiling at ${measured.rows} rows x ${measured.unitCostUsd} USD per unit`
+		}
+	};
+}
+//#endregion
+//#region src/experiment/ast/selection.ts
+/**
+* Execute a selection rule.
+*
+* Round-robin walks groups in lexicographic order and takes ids in
+* within-group order until `take` ids are chosen. Filter-of keeps the ids of
+* `bases[rule.base]` whose record satisfies the predicate, in the registered
+* order. Ids absent from `records` are evaluated on their id alone (fields
+* derived from the id via `idFields`), so a sealed base outlives its source
+* records.
+*/
+function runSelectionRule(rule, records, options) {
+	if (rule.kind === "round-robin") {
+		const allowed = new Set(rule.reads);
+		for (const field of [rule.groupBy, rule.withinOrder.field]) if (!allowed.has(field)) throw new ValidationError(`runSelectionRule: round-robin reads '${field}' but its closed read set is [${rule.reads.join(", ")}]`);
+		const byGroup = /* @__PURE__ */ new Map();
+		for (const record of records) {
+			const group = String(readField(record, rule.groupBy));
+			const id = String(readField(record, rule.withinOrder.field));
+			const bucket = byGroup.get(group);
+			if (bucket) bucket.push(id);
+			else byGroup.set(group, [id]);
+		}
+		for (const ids of byGroup.values()) {
+			ids.sort();
+			if (rule.withinOrder.dir === "desc") ids.reverse();
+		}
+		const groups = [...byGroup.keys()].sort();
+		const chosen = [];
+		let cursor = 0;
+		while (chosen.length < rule.take && groups.some((g) => byGroup.get(g).length > 0)) {
+			const group = groups[cursor % groups.length];
+			const ids = byGroup.get(group);
+			if (ids.length > 0) chosen.push(ids.shift());
+			cursor += 1;
+		}
+		return chosen;
+	}
+	const base = options.bases?.[rule.base];
+	if (!base) throw new ValidationError(`runSelectionRule: filter-of base '${rule.base}' was not provided`);
+	const index = new Map(records.map((r) => [String(readField(r, options.idField)), r]));
+	const sorted = [...base.filter((id) => {
+		const record = index.get(id) ?? options.idFields?.(id);
+		if (!record) throw new ValidationError(`runSelectionRule: base id '${id}' has no record and no idFields derivation`);
+		return evaluatePredicate(rule.keep, record);
+	})].sort();
+	if (rule.order.dir === "desc") sorted.reverse();
+	return sorted;
+}
+//#endregion
 //#region src/experiment/funnel.ts
 /**
 * The denominator chain as a first-class object.
@@ -890,86 +878,6 @@ const evidenceRegistryRecordSchema = z.strictObject({
 	supersedes: z.array(z.string().regex(idPattern)).optional(),
 	notes: z.string().min(1).optional()
 });
-/** Parse one record; throws with the zod issue list on any violation. */
-function parseEvidenceRegistryRecord(raw) {
-	return evidenceRegistryRecordSchema.parse(raw);
-}
-var EvidenceRegistryError = class extends Error {};
-/**
-* Validate a set of records as one registry: every record parses, ids are
-* unique, and every `supersedes` target exists. Returns records sorted in
-* the registry's canonical order (trust ladder, then date desc, then id).
-*/
-function validateEvidenceRegistry(raws) {
-	const records = raws.map((raw) => parseEvidenceRegistryRecord(raw));
-	const seen = /* @__PURE__ */ new Set();
-	for (const record of records) {
-		if (seen.has(record.id)) throw new EvidenceRegistryError(`duplicate evidence record id: ${record.id}`);
-		seen.add(record.id);
-	}
-	for (const record of records) for (const target of record.supersedes ?? []) if (!seen.has(target)) throw new EvidenceRegistryError(`record ${record.id} supersedes unknown record: ${target}`);
-	const stateRank = new Map(EVIDENCE_STATES.map((state, index) => [state, index]));
-	return [...records].sort((a, b) => {
-		const byState = (stateRank.get(a.evidenceState) ?? 0) - (stateRank.get(b.evidenceState) ?? 0);
-		if (byState !== 0) return byState;
-		if (a.date !== b.date) return a.date < b.date ? 1 : -1;
-		return a.id < b.id ? -1 : 1;
-	});
-}
-function mdEscape(text) {
-	return text.replace(/\|/g, "\\|").replace(/\n/g, " ");
-}
-function formatCost(costUsd) {
-	if (costUsd === null) return "not captured";
-	return `$${costUsd.toFixed(2)}`;
-}
-function formatN(n) {
-	const base = `${n.value} ${n.unit}`;
-	return n.detail ? `${base} (${n.detail})` : base;
-}
-/**
-* Render the registry's human index from records. Deterministic: identical
-* records always produce identical output, so a byte diff against the
-* committed index is the freshness check. No clocks, no environment.
-*/
-function renderEvidenceIndex(raws) {
-	const records = validateEvidenceRegistry(raws);
-	const lines = [
-		"# Evidence index",
-		"",
-		"<!-- GENERATED by scripts/render-evidence-index.ts from evidence/records/*.json.",
-		"     Edit the records, run `pnpm run evidence:render`, and commit both.",
-		"     `pnpm run evidence:check` (inside verify:package) fails when this file drifts. -->",
-		"",
-		`${records.length} records. States: ${EVIDENCE_STATES.join(" > ")}.`,
-		"",
-		"| state | date | id | claim | result |",
-		"| --- | --- | --- | --- | --- |"
-	];
-	for (const r of records) lines.push(`| ${r.evidenceState} | ${r.date} | [\`${r.id}\`](#${r.id}) | ${mdEscape(r.claim)} | ${mdEscape(r.result)} |`);
-	for (const r of records) {
-		lines.push("", `## ${r.id}`, "");
-		lines.push(`**${r.evidenceState}** · ${r.date} · ${r.domain} · source repo \`${r.sourceRepo}\``);
-		lines.push("", `**Claim.** ${r.claim}`, "", `**Result.** ${r.result}`, "");
-		lines.push(`- **Instrument**: ${r.instrument}`);
-		lines.push(`- **Command**: ${r.command === null ? "not preserved" : `\`${r.command}\``}`);
-		lines.push(`- **Arms**: ${r.arms.length === 0 ? "single-arm" : r.arms.join(" vs ")}`);
-		lines.push(`- **n**: ${formatN(r.n)}`);
-		lines.push(`- **Cost**: ${formatCost(r.costUsd)}`);
-		if (r.experimentDigest) lines.push(`- **Experiment seal**: \`${r.experimentDigest}\``);
-		lines.push(`- **Artifacts**:`);
-		for (const artifact of r.artifacts) lines.push(`  - ${artifact}`);
-		if (r.confounds.length === 0) lines.push("- **Confounds**: none recorded");
-		else {
-			lines.push("- **Confounds**:");
-			for (const confound of r.confounds) lines.push(`  - ${confound}`);
-		}
-		if (r.supersedes && r.supersedes.length > 0) lines.push(`- **Supersedes**: ${r.supersedes.map((s) => `\`${s}\``).join(", ")}`);
-		if (r.notes) lines.push(`- **Notes**: ${r.notes}`);
-	}
-	lines.push("");
-	return lines.join("\n");
-}
 //#endregion
 //#region src/experiment/power.ts
 /**
@@ -1353,8 +1261,8 @@ function sealRandomizedCanaryRule(rule) {
 		algo: "sha256-rfc8785"
 	};
 }
-/** Apply one registered analysis to the entire frozen assignment roster. */
-function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
+/** Check the registration seal, the cohort receipt, the frozen roster and the independent verifier. */
+function verifyCohortEvidence(sealed, cohort, rows, verifyCohort) {
 	if (sealed.algo !== "sha256-rfc8785") throw new ValidationError("randomized canary: unsupported registration digest scheme");
 	validateRule(sealed.rule);
 	if (hashCanonical(sealed.rule) !== sealed.digest) throw new ValidationError("randomized canary: registration digest mismatch");
@@ -1379,57 +1287,83 @@ function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
 	if (!Number.isSafeInteger(cohort.assignmentCount) || cohort.assignmentCount < 1 || rows.length !== cohort.assignmentCount) throw new ValidationError("randomized canary: assignment count differs from complete ledger receipt");
 	if (randomizedCanaryRosterDigest(rows) !== cohort.assignmentRosterDigest) throw new ValidationError("randomized canary: assignment roster digest mismatch");
 	if (randomizedCanaryObservationDigest(rows) !== cohort.observationSnapshotDigest) throw new ValidationError("randomized canary: frozen observation snapshot digest mismatch");
+	verifyCohortTimes(sealed, cohort);
+	if (typeof verifyCohort !== "function") throw new ValidationError("randomized canary: independent cohort verifier is required");
+	const verification = verifyCohort(cohort, sealed);
+	if (verification?.verified !== true || verification.authorityId !== cohort.authorityId || verification.protocolWitnessedBeforeTraffic !== true || verification.familySlotReservedBeforeTraffic !== true || verification.eligibilityAndDispositionVerified !== true || verification.randomizationVerified !== true || verification.rosterCompleteAtCutoff !== true || verification.outcomeAndBillingSnapshotFrozen !== true || verification.sourceJoinsVerified !== true || verification.armIsolationVerified !== true) throw new ValidationError(`randomized canary: cohort attestation or completeness unverified${verification?.verified === false ? `: ${verification.reason}` : ""}`);
+}
+/** Require the ledger closure, observation freeze and attestation times to match the registered cutoff. */
+function verifyCohortTimes(sealed, cohort) {
 	const cutoff = Date.parse(sealed.rule.analysisCutoff);
 	const closedAt = Date.parse(cohort.closedAt);
 	const frozenAt = Date.parse(cohort.observationFrozenAt);
 	const attestedAt = Date.parse(cohort.attestedAt);
 	const expectedFreezeAt = cutoff + sealed.rule.outcomeMaturityMs;
 	if (!Number.isFinite(closedAt) || closedAt < cutoff || !cohort.closedAt.endsWith("Z") || !Number.isFinite(frozenAt) || frozenAt !== expectedFreezeAt || closedAt > frozenAt || !cohort.observationFrozenAt.endsWith("Z") || !Number.isFinite(attestedAt) || attestedAt < frozenAt || !cohort.attestedAt.endsWith("Z")) throw new ValidationError("randomized canary: ledger closure or frozen observation time differs from registered cutoffs");
-	if (typeof verifyCohort !== "function") throw new ValidationError("randomized canary: independent cohort verifier is required");
-	const verification = verifyCohort(cohort, sealed);
-	if (verification?.verified !== true || verification.authorityId !== cohort.authorityId || verification.protocolWitnessedBeforeTraffic !== true || verification.familySlotReservedBeforeTraffic !== true || verification.eligibilityAndDispositionVerified !== true || verification.randomizationVerified !== true || verification.rosterCompleteAtCutoff !== true || verification.outcomeAndBillingSnapshotFrozen !== true || verification.sourceJoinsVerified !== true || verification.armIsolationVerified !== true) throw new ValidationError(`randomized canary: cohort attestation or completeness unverified${verification?.verified === false ? `: ${verification.reason}` : ""}`);
-	const clusters = /* @__PURE__ */ new Map();
-	const arms = {
-		control: [],
-		candidate: []
+}
+/** Validate one row's evidence fields and count its gaps; returns whether it is a recorded no-execution. */
+function checkObservationRow(row, index, tally) {
+	if (row.checkedOutcome !== 0 && row.checkedOutcome !== 1 && row.checkedOutcome !== null) throw new ValidationError(`randomized canary: assignment ${index} outcome must be 0, 1, or null`);
+	if (row.checkedOutcome === null) tally.missingOutcomes++;
+	if (row.outcomeSourceId === null) {
+		if (row.checkedOutcome !== null) throw new ValidationError(`randomized canary: assignment ${index} has an outcome without its source`);
+	} else nonEmpty(row.outcomeSourceId, `assignment ${index} outcome source id`);
+	if (row.billedCostUsd === null) tally.missingBilling++;
+	else if (!Number.isFinite(row.billedCostUsd) || row.billedCostUsd < 0) throw new ValidationError(`randomized canary: assignment ${index} billed cost must be nonnegative`);
+	if (row.billingSourceId === null) {
+		if (row.billedCostUsd !== null) throw new ValidationError(`randomized canary: assignment ${index} has billed cost without its source`);
+	} else nonEmpty(row.billingSourceId, `assignment ${index} billing source id`);
+	if (row.turns === null) tally.missingTurns++;
+	else if (!Number.isSafeInteger(row.turns) || row.turns < 0) throw new ValidationError(`randomized canary: assignment ${index} turns must be a nonnegative integer`);
+	if (row.traceSourceId !== null) nonEmpty(row.traceSourceId, `assignment ${index} trace source id`);
+	if (row.noExecutionSourceId !== null) nonEmpty(row.noExecutionSourceId, `assignment ${index} no-execution source id`);
+	if (row.traceSourceId !== null && row.noExecutionSourceId !== null) throw new ValidationError(`randomized canary: assignment ${index} has conflicting trace and no-execution receipts`);
+	const noExecution = row.noExecutionSourceId !== null && row.turns === 0 && row.billedCostUsd === 0 && row.checkedOutcome === 0;
+	if (row.traceSourceId === null && !noExecution) tally.missingTraces++;
+	for (const field of [
+		"servedProfileDigest",
+		"servedCodeRevisionDigest",
+		"outcomeCheckerDigest"
+	]) if (row[field] !== null) nonEmpty(row[field], `assignment ${index} ${field}`);
+	return noExecution;
+}
+/** Whether a row was served by, or checked with, anything other than the registered profile, code and checker. */
+function drifted(row, noExecution, rule) {
+	const expectedProfile = row.arm === "control" ? rule.controlProfileDigest : rule.candidateProfileDigest;
+	return row.traceSourceId !== null && (row.servedProfileDigest !== expectedProfile || row.servedCodeRevisionDigest !== rule.servedCodeRevisionDigest) || row.checkedOutcome !== null && row.outcomeCheckerDigest !== rule.outcomeCheckerDigest || noExecution && (row.servedProfileDigest !== null || row.servedCodeRevisionDigest !== null);
+}
+/** Validate every row against the registered rule, then group by arm and cluster. */
+function tallyObservations(rule, rows) {
+	const tally = {
+		clusters: /* @__PURE__ */ new Map(),
+		arms: {
+			control: [],
+			candidate: []
+		},
+		missingOutcomes: 0,
+		missingBilling: 0,
+		missingTurns: 0,
+		missingTraces: 0,
+		executionDrift: 0
 	};
-	let missingOutcomes = 0;
-	let missingBilling = 0;
-	let missingTurns = 0;
-	let missingTraces = 0;
-	let executionDrift = 0;
 	for (const [index, row] of rows.entries()) {
-		if (row.checkedOutcome !== 0 && row.checkedOutcome !== 1 && row.checkedOutcome !== null) throw new ValidationError(`randomized canary: assignment ${index} outcome must be 0, 1, or null`);
-		if (row.checkedOutcome === null) missingOutcomes++;
-		if (row.outcomeSourceId === null) {
-			if (row.checkedOutcome !== null) throw new ValidationError(`randomized canary: assignment ${index} has an outcome without its source`);
-		} else nonEmpty(row.outcomeSourceId, `assignment ${index} outcome source id`);
-		if (row.billedCostUsd === null) missingBilling++;
-		else if (!Number.isFinite(row.billedCostUsd) || row.billedCostUsd < 0) throw new ValidationError(`randomized canary: assignment ${index} billed cost must be nonnegative`);
-		if (row.billingSourceId === null) {
-			if (row.billedCostUsd !== null) throw new ValidationError(`randomized canary: assignment ${index} has billed cost without its source`);
-		} else nonEmpty(row.billingSourceId, `assignment ${index} billing source id`);
-		if (row.turns === null) missingTurns++;
-		else if (!Number.isSafeInteger(row.turns) || row.turns < 0) throw new ValidationError(`randomized canary: assignment ${index} turns must be a nonnegative integer`);
-		if (row.traceSourceId !== null) nonEmpty(row.traceSourceId, `assignment ${index} trace source id`);
-		if (row.noExecutionSourceId !== null) nonEmpty(row.noExecutionSourceId, `assignment ${index} no-execution source id`);
-		if (row.traceSourceId !== null && row.noExecutionSourceId !== null) throw new ValidationError(`randomized canary: assignment ${index} has conflicting trace and no-execution receipts`);
-		const noExecution = row.noExecutionSourceId !== null && row.turns === 0 && row.billedCostUsd === 0 && row.checkedOutcome === 0;
-		if (row.traceSourceId === null && !noExecution) missingTraces++;
-		for (const field of [
-			"servedProfileDigest",
-			"servedCodeRevisionDigest",
-			"outcomeCheckerDigest"
-		]) if (row[field] !== null) nonEmpty(row[field], `assignment ${index} ${field}`);
-		const expectedProfile = row.arm === "control" ? sealed.rule.controlProfileDigest : sealed.rule.candidateProfileDigest;
-		if (row.traceSourceId !== null && (row.servedProfileDigest !== expectedProfile || row.servedCodeRevisionDigest !== sealed.rule.servedCodeRevisionDigest) || row.checkedOutcome !== null && row.outcomeCheckerDigest !== sealed.rule.outcomeCheckerDigest || noExecution && (row.servedProfileDigest !== null || row.servedCodeRevisionDigest !== null)) executionDrift++;
-		arms[row.arm].push(row);
-		const bucket = clusters.get(row.clusterId) ?? [];
+		if (drifted(row, checkObservationRow(row, index, tally), rule)) tally.executionDrift++;
+		tally.arms[row.arm].push(row);
+		const bucket = tally.clusters.get(row.clusterId) ?? [];
 		bucket.push(row);
-		clusters.set(row.clusterId, bucket);
+		tally.clusters.set(row.clusterId, bucket);
 	}
-	const controlClusters = [...clusters.values()].filter((bucket) => bucket.some((r) => r.arm === "control")).length;
-	const candidateClusters = [...clusters.values()].filter((bucket) => bucket.some((r) => r.arm === "candidate")).length;
+	return tally;
+}
+/** Count the clusters that hold at least one row of the arm. */
+function clustersWithArm(tally, arm) {
+	return [...tally.clusters.values()].filter((bucket) => bucket.some((r) => r.arm === arm)).length;
+}
+/** The decision with every count and total filled in and no interval or pass yet. */
+function baseDecision(sealed, cohort, rowCount, tally) {
+	const { clusters, arms, missingOutcomes, missingBilling, missingTurns } = tally;
+	const controlClusters = clustersWithArm(tally, "control");
+	const candidateClusters = clustersWithArm(tally, "candidate");
 	if (sealed.rule.assignmentUnit === sealed.rule.clusterUnit) {
 		for (const [clusterId, bucket] of clusters) if (bucket.length !== 1) throw new ValidationError(`randomized canary: ${sealed.rule.assignmentUnit} cluster '${clusterId}' has multiple assignments`);
 	}
@@ -1450,7 +1384,7 @@ function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
 	const p0 = outcomesComplete ? sum("control", "checkedOutcome") / n0 : null;
 	const p1 = outcomesComplete ? sum("candidate", "checkedOutcome") / n1 : null;
 	const delta = p0 === null || p1 === null ? null : p1 - p0;
-	const result = {
+	return {
 		registrationDigest: sealed.digest,
 		cohortReceiptSourceId: cohort.attestationSourceId,
 		assignmentRosterDigest: cohort.assignmentRosterDigest,
@@ -1458,7 +1392,7 @@ function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
 		method: "cluster-robust-t",
 		confidence: .95,
 		familyAdjustedConfidence: 1 - .05 / sealed.rule.confirmatoryFamilySize,
-		assignments: rows.length,
+		assignments: rowCount,
 		controlAssignments: n0,
 		candidateAssignments: n1,
 		clusters: clusters.size,
@@ -1468,8 +1402,8 @@ function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
 		missingOutcomes,
 		missingBilling,
 		missingTurns,
-		missingTraces,
-		executionDrift,
+		missingTraces: tally.missingTraces,
+		executionDrift: tally.executionDrift,
 		controlSuccessRate: p0,
 		candidateSuccessRate: p1,
 		delta,
@@ -1485,32 +1419,33 @@ function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
 		refusal: null,
 		successCriterionMet: false
 	};
-	if (missingOutcomes > 0 || missingBilling > 0 || missingTurns > 0 || n0 === 0 || n1 === 0) {
-		result.refusal = "missing-evidence";
-		return result;
-	}
-	if (missingTraces > 0) {
-		result.refusal = "missing-trace";
-		return result;
-	}
-	if (executionDrift > 0) {
-		result.refusal = "execution-drift";
-		return result;
-	}
-	if (clusters.size < sealed.rule.minimumClusters || controlClusters < 20 || candidateClusters < 20) {
-		result.refusal = "insufficient-clusters";
-		return result;
-	}
-	for (const bucket of clusters.values()) if (bucket.filter((r) => r.arm === "control").length / n0 > .1 || bucket.filter((r) => r.arm === "candidate").length / n1 > .1) {
-		result.refusal = "dominant-cluster";
-		return result;
-	}
+}
+/** The first reason the evidence cannot support an estimate, or null when it can. */
+function refusalReason(rule, tally, result) {
+	const { clusters } = tally;
+	const n0 = result.controlAssignments;
+	const n1 = result.candidateAssignments;
+	if (tally.missingOutcomes > 0 || tally.missingBilling > 0 || tally.missingTurns > 0 || n0 === 0 || n1 === 0) return "missing-evidence";
+	if (tally.missingTraces > 0) return "missing-trace";
+	if (tally.executionDrift > 0) return "execution-drift";
+	if (clusters.size < rule.minimumClusters || result.controlClusters < 20 || result.candidateClusters < 20) return "insufficient-clusters";
+	for (const bucket of clusters.values()) if (bucket.filter((r) => r.arm === "control").length / n0 > .1 || bucket.filter((r) => r.arm === "candidate").length / n1 > .1) return "dominant-cluster";
+	return null;
+}
+/** Fill the intervals, p-value and passes, or refuse on zero variance. */
+function estimateRiskDifference(rule, tally, result) {
+	const { clusters } = tally;
+	const p0 = result.controlSuccessRate;
+	const p1 = result.candidateSuccessRate;
+	const delta = result.delta;
+	const n0 = result.controlAssignments;
+	const n1 = result.candidateAssignments;
 	const scores = [...clusters.values()].map((bucket) => bucket.reduce((score, row) => score + (row.arm === "candidate" ? (row.checkedOutcome - p1) / n1 : -(row.checkedOutcome - p0) / n0), 0));
 	const G = clusters.size;
-	const variance = G / (G - 1) * (rows.length - 1) / (rows.length - 2) * scores.reduce((total, score) => total + score * score, 0);
+	const variance = G / (G - 1) * (result.assignments - 1) / (result.assignments - 2) * scores.reduce((total, score) => total + score * score, 0);
 	if (!Number.isFinite(variance) || variance <= 0) {
 		result.refusal = "zero-variance";
-		return result;
+		return;
 	}
 	const se = Math.sqrt(variance);
 	const t = delta / se;
@@ -1526,11 +1461,23 @@ function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
 	};
 	result.unadjustedPValue = Math.min(1, 2 * (1 - studentTCdf(Math.abs(t), G - 1)));
 	result.headline95Pass = result.nominal95Interval.low > 0;
-	result.familywisePass = result.familyAdjustedInterval.low > sealed.rule.minimumLift;
+	result.familywisePass = result.familyAdjustedInterval.low > rule.minimumLift;
 	result.successCriterionMet = result.headline95Pass && result.familywisePass;
+}
+/** Apply one registered analysis to the entire frozen assignment roster. */
+function decideRandomizedCanary(sealed, cohort, rows, verifyCohort) {
+	verifyCohortEvidence(sealed, cohort, rows, verifyCohort);
+	const tally = tallyObservations(sealed.rule, rows);
+	const result = baseDecision(sealed, cohort, rows.length, tally);
+	const refusal = refusalReason(sealed.rule, tally, result);
+	if (refusal !== null) {
+		result.refusal = refusal;
+		return result;
+	}
+	estimateRiskDifference(sealed.rule, tally, result);
 	return result;
 }
 //#endregion
-export { BOOTSTRAP_GATE_MIN_N, DesignRefusalError, EVIDENCE_RECEIPT_VERSION, EVIDENCE_STATES, FinalEvidenceConflictError, FinalEvidenceError, FunnelIntegrityError, MatchedBudgetError, SealIntegrityError, amendExperiment, assertDesignAdequate, assertFunnelReconciles, assertMatchedBudgets, benjaminiHochberg, bonferroni, buildEvidenceVector, buildFunnel, classifyReissue, clusteredPower, comparePairedArms, composeFunnels, computeEstimand, computeInterval, createCampaignEvidenceReceipt, createEvidenceReceipt, decideRandomizedCanary, defineEvaluationClaim, defineExperiment, eProcess, evaluateCondition, evaluateHaltRule, evaluateHypothesis, evaluateIdentityGate, evaluateOracleDeterminismGate, evaluatePopulationReproducibilityGate, evaluatePowerFloorGate, evaluatePredicate, evaluateProvenanceGate, evidenceRegistryRecordSchema, executeAdmissionRule, executeDecisionRule, hashJson, heldoutSignificance, holm, isIndependentEvidence, joinProspectiveCanaryReceipts, manifestContentDigest, mcnemar, mcnemarPower, mcnemarRequiredN, mulberry32, openFinalEvidenceLedger, openSealedExperiment, pairArms, pairHoldout, pairRunRecords, pairedBootstrap, pairedEvalueSequence, pairedMde, pairedRiskDifference, pairedRiskDifferenceExact, pairedRiskDifferenceScore, paretoPolicy, paretoSignificanceGate, parseEvidenceRegistryRecord, powerPreflight, projectNLadderBudget, randomizedCanaryObservationDigest, randomizedCanaryRosterDigest, readField, renderEvidenceIndex, renderFunnelTable, requiredPairedSampleSize, requiredSampleSize, runSelectionRule, runUniformPassBudget, sealExperiment, sealRandomizedCanaryRule, sequentialCrossingHorizon, sequentialDecide, sequentialPairedGate, signManifest, summarizeEvaluationUnits, validateEvidenceRegistry, verifyEvidenceReceipt, verifyManifest, verifyMatchedBudgets, verifySealedExperiment, wilson };
+export { BOOTSTRAP_GATE_MIN_N, EVIDENCE_STATES, FinalEvidenceConflictError, FinalEvidenceError, amendExperiment, assertDesignAdequate, assertMatchedBudgets, benjaminiHochberg, bonferroni, buildEvidenceVector, buildFunnel, clusteredPower, comparePairedArms, composeFunnels, computeInterval, createCampaignEvidenceReceipt, createEvidenceReceipt, decideRandomizedCanary, defineEvaluationClaim, defineExperiment, eProcess, evaluateCondition, evaluatePowerFloorGate, evidenceRegistryRecordSchema, executeAdmissionRule, executeDecisionRule, hashJson, heldoutSignificance, holm, isIndependentEvidence, joinProspectiveCanaryReceipts, manifestContentDigest, mcnemar, mcnemarPower, mcnemarRequiredN, mulberry32, openFinalEvidenceLedger, openSealedExperiment, pairArms, pairHoldout, pairRunRecords, pairedBootstrap, pairedEvalueSequence, pairedMde, pairedRiskDifference, pairedRiskDifferenceExact, pairedRiskDifferenceScore, paretoPolicy, paretoSignificanceGate, powerPreflight, randomizedCanaryObservationDigest, randomizedCanaryRosterDigest, readField, renderFunnelTable, requiredPairedSampleSize, requiredSampleSize, sealExperiment, sealRandomizedCanaryRule, sequentialDecide, sequentialPairedGate, signManifest, summarizeEvaluationUnits, verifyEvidenceReceipt, verifyManifest, verifyMatchedBudgets, verifySealedExperiment, wilson };
 
 //# sourceMappingURL=index.js.map