@warmdrift/kgauto-compiler 2.0.0-alpha.69 → 2.0.0-alpha.70

package/dist/{chunk-EZXVJUK7.mjs → chunk-FR4DNGLW.mjs}

@@ -1,5 +1,5 @@
 // src/version.ts
-var LIBRARY_VERSION = "2.0.0-alpha.69";
+var LIBRARY_VERSION = "2.0.0-alpha.70";
 
 // src/key-health.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };

package/dist/index.d.mts

@@ -425,6 +425,17 @@ interface BrainQueryConfig {
      * `https://kgauto-dashboard.vercel.app/api/kgauto-v2/promotions`.
      */
     promotionsEndpoint?: string;
+    /**
+     * alpha.70 — hard opt-out of the measured-failure gate fetch layer.
+     * Default true (the gate is opt-OUT, see `BrainConfig.measuredFailureGate`).
+     */
+    measuredFailure?: boolean;
+    /**
+     * alpha.70 — override the measured-failure endpoint. Library appends
+     * `?app_id=X`. Defaults to
+     * `https://kgauto-dashboard.vercel.app/api/kgauto-v2/measured-failure`.
+     */
+    measuredFailureEndpoint?: string;
 }
 interface BrainConfig {
     /** Brain HTTP endpoint base URL (e.g., https://kgauto-brain.vercel.app/api). */
@@ -495,6 +506,25 @@ interface BrainConfig {
      * promotion entirely.
      */
     autoPromote?: boolean;
+    /**
+     * alpha.70 — the measured-failure quality gate. **Default ON** wherever
+     * the brain is configured; set `false` (or `KGAUTO_MEASURED_FAILURE_GATE=0`)
+     * to disable. An explicit value here wins over the env var.
+     *
+     * Why this is opt-OUT while `autoPromote` is opt-IN: a promotion silently
+     * changes WHICH model serves you on kgauto's evidence, so it needs
+     * consent. This gate only ever DE-RANKS a model that the consumer's own
+     * outcome rows show failing them — the failures are already being paid
+     * for on their bill and their users' latency, and the model stays
+     * available as a graceful fallback. Requiring an opt-in to stop paying
+     * would be the wrong default.
+     *
+     * Consumer sovereignty is unchanged: `forceModel` still wins. Unlike a
+     * promotion, `policy.preferredModels` does NOT defer the gate — a
+     * preference says which model you would like to lead, not that a
+     * measurably-failing one works.
+     */
+    measuredFailureGate?: boolean;
 }
 declare function configureBrain(config: BrainConfig): void;
 declare function clearBrain(): void;
@@ -973,7 +1003,7 @@ declare function runGoldenEval(opts: GoldenEvalOptions): Promise<GoldenEvalRunRe
  * guard in `tests/version.test.ts` fails the suite (and therefore
  * `prepublishOnly`) when they diverge — a stale constant cannot reach npm.
  */
-declare const LIBRARY_VERSION = "2.0.0-alpha.69";
+declare const LIBRARY_VERSION = "2.0.0-alpha.70";
 
 /**
  * Oracle contract — how an app tells the brain whether a response was good.
@@ -2833,6 +2863,145 @@ declare function _testResetPromotions(): void;
 /** Wait for any in-flight refresh to settle. */
 declare function _testWaitForPromotionsRefresh(): Promise<void>;
 
+/**
+ * measured-failure-brain — the CREATE-a-gate direction of
+ * measured-supersedes-judgment (alpha.70).
+ *
+ * alpha.49 gives kgauto a quality gate that fires off a model profile's
+ * DECLARED conventions (`archetypeConventions.structuredOutputHint: 'avoid'`).
+ * alpha.64 let a MEASURED eval verdict SUPPRESS that gate
+ * (`kgauto_promotions.suppress_quality_gate`). Nothing could go the other
+ * way — a model whose declarations are wrong could not have a gate CREATED
+ * for it, which is precisely the case where declarations cannot be trusted.
+ *
+ * The originating evidence: `claude-haiku-4-5` on playbacksam/summarize
+ * declares `structuredOutput: 'grammar'` + `archetypePerf.summarize: 8`, so
+ * every quality signal reads green and it wins the surface on price — while
+ * failing **12 of 12 in-window attempts** (2026-07-14..25, seven in one
+ * day). The brain held that evidence and nothing could act on it.
+ *
+ * ── Design notes ───────────────────────────────────────────────────────
+ *
+ * **No stored decision.** The gate is DERIVED from a rolling 28d window
+ * (`kgauto_surface_model_failure_v`), never written down. That kills the
+ * flap problem by construction — there is no state to flap — and it means
+ * a gated model un-gates itself once its failures age out. Combined with
+ * the gate being a DE-RANK (out of leadership, retained as graceful
+ * fallback) rather than a hard block, the model keeps earning evidence, so
+ * this cannot become the exclusion-lock-in trap where a blocked model can
+ * never prove itself again.
+ *
+ * **The threshold is a confidence bound, not a fixed sample floor.** A flat
+ * `minSample: 20` (promotion-guard's rate floor) would NOT have fired on
+ * haiku's n=12 — the consumer would keep paying while we waited for a
+ * rounder number. But distinguishing 100% from 5% needs far fewer trials
+ * than distinguishing 2% from 6%. Gating on the Wilson score lower bound
+ * makes the sample requirement adapt to the effect size automatically,
+ * which is the alpha.67 insight ("the sample floor for a median can be far
+ * lower than for a rate") generalised properly.
+ *
+ * **Direct app-scoped read, not the config-endpoint cache.** Modelled on
+ * `promotions-brain.ts`, deliberately NOT `createBrainQueryCache` — that
+ * routes through the dashboard `/v2/config` projection, which is the third
+ * layer in the L-073 "executable knowledge is dropped at every transport
+ * boundary" chain. One fewer place to forget a field.
+ */
+
+/**
+ * One row of the rolling-window evidence view, per (app, archetype, model).
+ * Raw counts only — the brain serves facts, this module decides.
+ */
+interface SurfaceFailureRow {
+    archetype: string;
+    model: string;
+    /** Total attempts in-window (served + quality walkaways). */
+    n: number;
+    /** Attempts that failed on the quality axis. */
+    nFail: number;
+}
+declare const MEASURED_FAILURE_CFG: {
+    /**
+     * Hard minimum attempts before ANY gate may be created. Guards against
+     * pathological tiny samples that the confidence bound alone would let
+     * through in edge cases. At 5-for-5 the bound clears the threshold; at
+     * 3-for-3 it does not, which is the behaviour we want (three failures is
+     * a bad day, five in a row is a pattern).
+     */
+    readonly minSample: 5;
+    /**
+     * Gate when we are 95% confident the model fails MORE OFTEN THAN IT
+     * SUCCEEDS on this surface. Deliberately unarguable rather than tuned —
+     * a model that probably fails the majority of the time has no business
+     * leading a surface, whatever its declared scores say.
+     */
+    readonly lowerBoundThreshold: 0.5;
+    /** 95% one-sided-ish confidence (standard two-sided z at α=0.05). */
+    readonly z: 1.96;
+    /** Must match the view's window. Documented here for the advisory text. */
+    readonly windowDays: 28;
+};
+/**
+ * Wilson score interval, lower bound. Preferred over the normal
+ * approximation because it stays sane at the extremes — at p̂ = 1 the
+ * normal approximation gives a zero-width interval (it would gate on a
+ * single failure), while Wilson correctly returns a bound that tightens
+ * with n.
+ *
+ * Returns 0 for n <= 0.
+ */
+declare function wilsonLowerBound(failures: number, n: number, z?: number): number;
+interface MeasuredFailureVerdict {
+    /** Whether the measured-failure quality gate fires for this tuple. */
+    gated: boolean;
+    /** Observed failure rate in-window. */
+    rate: number;
+    /** 95% lower confidence bound on that rate — what the gate tests. */
+    lowerBound: number;
+    /** Attempts backing the verdict. */
+    n: number;
+    nFail: number;
+}
+/**
+ * Pure decision, exported for tests and for the advisory text. Separated
+ * from the I/O so the policy can be exercised without a brain.
+ */
+declare function judgeMeasuredFailure(row: SurfaceFailureRow | undefined, cfg?: typeof MEASURED_FAILURE_CFG): MeasuredFailureVerdict | undefined;
+interface MeasuredFailureRuntime {
+    /** Endpoint base URL. The library appends `?app_id=<id>`. */
+    endpoint: string;
+    /** Stale-while-revalidate window in ms. */
+    ttlMs: number;
+    fetchImpl: typeof fetch;
+    onError?: (err: unknown) => void;
+}
+/** Default endpoint on the kgauto-dashboard. Mirrors the promotions convention. */
+declare const DEFAULT_MEASURED_FAILURE_ENDPOINT = "https://kgauto-dashboard.vercel.app/api/kgauto-v2/measured-failure";
+/**
+ * Opt-out env switch. UNLIKE auto-promote this defaults ON wherever the
+ * brain is configured, because the gate is protective: it only ever
+ * de-ranks a model the consumer's OWN traffic shows to be failing them, and
+ * the failure is already being paid for. Set `KGAUTO_MEASURED_FAILURE_GATE=0`
+ * (or 'false') to disable.
+ */
+declare function isMeasuredFailureGateEnabledFromEnv(envSource?: Record<string, string | undefined>): boolean;
+declare function configureMeasuredFailureBrain(rt: MeasuredFailureRuntime | undefined): void;
+declare function isMeasuredFailureBrainActive(): boolean;
+interface GetMeasuredFailureOpts {
+    appId: string;
+    archetype: IntentArchetypeName | string;
+    model: string;
+}
+/**
+ * Sync reader. Returns the verdict for `(appId, archetype, model)` or
+ * undefined (not configured / cold / below minSample / brain down).
+ *
+ * NEVER throws. Cold start returns undefined and warms in the background —
+ * same posture as every other brain-driven lever in compile().
+ */
+declare function getMeasuredFailureVerdict(opts: GetMeasuredFailureOpts): MeasuredFailureVerdict | undefined;
+declare function _testResetMeasuredFailure(): void;
+declare function _testWaitForMeasuredFailureRefresh(): Promise<void>;
+
 /**
  * @warmdrift/kgauto v2 — prompt compiler + central learning brain.
  *
@@ -2879,4 +3048,4 @@ declare function _testWaitForPromotionsRefresh(): Promise<void>;
  */
 declare function compile(ir: PromptIR, opts?: CompileOptions): CompileResult;
 
-export { ABSOLUTE_FLOOR, type AISDKConvertedMessage, ARCHETYPE_FAMILY_FITS, ARCHETYPE_FLOOR_DEFAULT, type ActionableAdvisory, Adapter, type AdvisoryResolutionSource, type AdvisorySeverity, type AdvisoryStatus, type AdvisorySuggestedFix, ApiKeys, type AppOracle, type ApplySectionRewritesArgs, type ApplySectionRewritesResult, ArchetypeConvention, type ArchetypeFamilyFit, type ArchetypePerfMap, type ArchetypePerfNMap, type ArchetypePerfScoreResult, type AttachCacheControlResult, BestPracticeAdvisory, type BrainConfig, type BrainDeadLetterEntry, type BrainHealthSnapshot, type BrainQueryConfig, type BrainReadEnv, CallOptions, CallResult, ChainEntry, type CompatibilityIntent, type CompileForAISDKv6Result, type CompileOptions, CompilePolicy, CompileResult, CompiledRequest, DEFAULT_FINDINGS_ENDPOINT, DEFAULT_PROMOTIONS_ENDPOINT, type ExclusionFindingRow, type ExclusionResolutionSource, type ExecuteErr, type ExecuteOk, type ExecuteOptions, type ExecuteResult, type FallbackPosture, FamilyResolutionError, type GetActionableAdvisoriesOptions, type GetApplicablePromotionOpts, type GetDefaultFallbackChainOpts, type GetPerAxisMetricsOpts, type GetRecommendedPrimaryOptions, type GoldenEvalCase, type GoldenEvalOptions, type GoldenEvalRunResult, type GoldenIrRecordInput, Grounding, IntentArchetypeName, JUDGE_RUBRICS, LIBRARY_VERSION, type LLMJudgeOptions, MEASURED_GROUNDING_MIN_N, type MarkAdvisoryResolvedOptions, type MarkExclusionFindingHandledOptions, type MarkPromoteReadyHandledOptions, type ModelBrainRow, type ModelCompatibility, ModelProfile, NormalizedResponse, type OracleContext, OracleScore, type OutcomePayload, OutcomeResult, OutputMode, PRODUCER_OWNED_RULE_CODES, PROVIDER_ENV_KEYS, PerAxisMetrics, type PricingRow, type ProbeShadowOptions, type ProbeShadowServed, type ProfileToRowOptions, type PromoteReadyFindingRow, type PromoteReadyResolution, type PromotionRow, type PromotionsRuntime, PromptIR, Provider, ProviderOverrides, type ProviderReachability, RULE_SEQUENTIAL_TOOL_CLIFF, type ReachabilityOpts, RecordInput, RecordOutcomeInput, type RunAdvisorPhase2Context, SectionRewrite, type ShadowProbeRecordInput, type SupportedProvider, SystemModelMessage, TRANSLATOR_FLOOR, _testResetPromotions, _testWaitForPromotionsRefresh, applyArchetypeConvention, applySectionRewrites, attachCacheControlToStreamTextInput, brainHealth, buildGoldenIrRow, buildLLMJudge, buildPairwiseJudgePrompt, buildShadowProbeRow, call, clearBrain, combineOrderSwappedVerdicts, compile, compileForAISDKv6, configureBrain, configurePromotionsBrain, countTokens, deriveFamilyFromModelId, deriveOwnership, execute, findBetterFit, flushBrainDeadLetter, getActionableAdvisories, getAllStarterChains, getAllStarterChainsWithGrounding, getApplicablePromotion, getArchetypePerfScore, getDefaultFallbackChain, getDefaultFallbackChainWithGrounding, getModelCompatibility, getPerAxisMetrics, getReachabilityDiagnostic, getRecommendedPrimary, getSequentialStarterChain, getSequentialStarterChainWithGrounding, getStaleExclusionFindings, getStarterChain, getStarterChainWithGrounding, isAutoPromoteEnabledFromEnv, isBrainQueryActiveFor, isBrainSync, isExclusionFindingsBrainActive, isModelReachable, isPromotionsBrainActive, isProviderReachable, loadAliasesFromBrain, loadArchetypePerfFromBrain, loadArchetypePerfNFromBrain, loadChainsFromBrain, loadModelsFromBrain, loadPricingFromBrain, markAdvisoryResolved, markExclusionFindingHandled, markPromoteReadyHandled, parseJudgeVerdict, peekBrainDeadLetter, probeShadow, profileToRow, readBrainReadEnv, record, recordGoldenIr, recordOutcome, recordShadowProbe, renderIrForJudge, resetTokenizer, resolveConventionsForProfile, resolvePricingAt, resolveProviderKey, rubricFor, runAdvisor, runGoldenEval, setTokenizer };
+export { ABSOLUTE_FLOOR, type AISDKConvertedMessage, ARCHETYPE_FAMILY_FITS, ARCHETYPE_FLOOR_DEFAULT, type ActionableAdvisory, Adapter, type AdvisoryResolutionSource, type AdvisorySeverity, type AdvisoryStatus, type AdvisorySuggestedFix, ApiKeys, type AppOracle, type ApplySectionRewritesArgs, type ApplySectionRewritesResult, ArchetypeConvention, type ArchetypeFamilyFit, type ArchetypePerfMap, type ArchetypePerfNMap, type ArchetypePerfScoreResult, type AttachCacheControlResult, BestPracticeAdvisory, type BrainConfig, type BrainDeadLetterEntry, type BrainHealthSnapshot, type BrainQueryConfig, type BrainReadEnv, CallOptions, CallResult, ChainEntry, type CompatibilityIntent, type CompileForAISDKv6Result, type CompileOptions, CompilePolicy, CompileResult, CompiledRequest, DEFAULT_FINDINGS_ENDPOINT, DEFAULT_MEASURED_FAILURE_ENDPOINT, DEFAULT_PROMOTIONS_ENDPOINT, type ExclusionFindingRow, type ExclusionResolutionSource, type ExecuteErr, type ExecuteOk, type ExecuteOptions, type ExecuteResult, type FallbackPosture, FamilyResolutionError, type GetActionableAdvisoriesOptions, type GetApplicablePromotionOpts, type GetDefaultFallbackChainOpts, type GetMeasuredFailureOpts, type GetPerAxisMetricsOpts, type GetRecommendedPrimaryOptions, type GoldenEvalCase, type GoldenEvalOptions, type GoldenEvalRunResult, type GoldenIrRecordInput, Grounding, IntentArchetypeName, JUDGE_RUBRICS, LIBRARY_VERSION, type LLMJudgeOptions, MEASURED_FAILURE_CFG, MEASURED_GROUNDING_MIN_N, type MarkAdvisoryResolvedOptions, type MarkExclusionFindingHandledOptions, type MarkPromoteReadyHandledOptions, type MeasuredFailureRuntime, type MeasuredFailureVerdict, type ModelBrainRow, type ModelCompatibility, ModelProfile, NormalizedResponse, type OracleContext, OracleScore, type OutcomePayload, OutcomeResult, OutputMode, PRODUCER_OWNED_RULE_CODES, PROVIDER_ENV_KEYS, PerAxisMetrics, type PricingRow, type ProbeShadowOptions, type ProbeShadowServed, type ProfileToRowOptions, type PromoteReadyFindingRow, type PromoteReadyResolution, type PromotionRow, type PromotionsRuntime, PromptIR, Provider, ProviderOverrides, type ProviderReachability, RULE_SEQUENTIAL_TOOL_CLIFF, type ReachabilityOpts, RecordInput, RecordOutcomeInput, type RunAdvisorPhase2Context, SectionRewrite, type ShadowProbeRecordInput, type SupportedProvider, type SurfaceFailureRow, SystemModelMessage, TRANSLATOR_FLOOR, _testResetMeasuredFailure, _testResetPromotions, _testWaitForMeasuredFailureRefresh, _testWaitForPromotionsRefresh, applyArchetypeConvention, applySectionRewrites, attachCacheControlToStreamTextInput, brainHealth, buildGoldenIrRow, buildLLMJudge, buildPairwiseJudgePrompt, buildShadowProbeRow, call, clearBrain, combineOrderSwappedVerdicts, compile, compileForAISDKv6, configureBrain, configureMeasuredFailureBrain, configurePromotionsBrain, countTokens, deriveFamilyFromModelId, deriveOwnership, execute, findBetterFit, flushBrainDeadLetter, getActionableAdvisories, getAllStarterChains, getAllStarterChainsWithGrounding, getApplicablePromotion, getArchetypePerfScore, getDefaultFallbackChain, getDefaultFallbackChainWithGrounding, getMeasuredFailureVerdict, getModelCompatibility, getPerAxisMetrics, getReachabilityDiagnostic, getRecommendedPrimary, getSequentialStarterChain, getSequentialStarterChainWithGrounding, getStaleExclusionFindings, getStarterChain, getStarterChainWithGrounding, isAutoPromoteEnabledFromEnv, isBrainQueryActiveFor, isBrainSync, isExclusionFindingsBrainActive, isMeasuredFailureBrainActive, isMeasuredFailureGateEnabledFromEnv, isModelReachable, isPromotionsBrainActive, isProviderReachable, judgeMeasuredFailure, loadAliasesFromBrain, loadArchetypePerfFromBrain, loadArchetypePerfNFromBrain, loadChainsFromBrain, loadModelsFromBrain, loadPricingFromBrain, markAdvisoryResolved, markExclusionFindingHandled, markPromoteReadyHandled, parseJudgeVerdict, peekBrainDeadLetter, probeShadow, profileToRow, readBrainReadEnv, record, recordGoldenIr, recordOutcome, recordShadowProbe, renderIrForJudge, resetTokenizer, resolveConventionsForProfile, resolvePricingAt, resolveProviderKey, rubricFor, runAdvisor, runGoldenEval, setTokenizer, wilsonLowerBound };

package/dist/index.d.ts

@@ -425,6 +425,17 @@ interface BrainQueryConfig {
      * `https://kgauto-dashboard.vercel.app/api/kgauto-v2/promotions`.
      */
     promotionsEndpoint?: string;
+    /**
+     * alpha.70 — hard opt-out of the measured-failure gate fetch layer.
+     * Default true (the gate is opt-OUT, see `BrainConfig.measuredFailureGate`).
+     */
+    measuredFailure?: boolean;
+    /**
+     * alpha.70 — override the measured-failure endpoint. Library appends
+     * `?app_id=X`. Defaults to
+     * `https://kgauto-dashboard.vercel.app/api/kgauto-v2/measured-failure`.
+     */
+    measuredFailureEndpoint?: string;
 }
 interface BrainConfig {
     /** Brain HTTP endpoint base URL (e.g., https://kgauto-brain.vercel.app/api). */
@@ -495,6 +506,25 @@ interface BrainConfig {
      * promotion entirely.
      */
     autoPromote?: boolean;
+    /**
+     * alpha.70 — the measured-failure quality gate. **Default ON** wherever
+     * the brain is configured; set `false` (or `KGAUTO_MEASURED_FAILURE_GATE=0`)
+     * to disable. An explicit value here wins over the env var.
+     *
+     * Why this is opt-OUT while `autoPromote` is opt-IN: a promotion silently
+     * changes WHICH model serves you on kgauto's evidence, so it needs
+     * consent. This gate only ever DE-RANKS a model that the consumer's own
+     * outcome rows show failing them — the failures are already being paid
+     * for on their bill and their users' latency, and the model stays
+     * available as a graceful fallback. Requiring an opt-in to stop paying
+     * would be the wrong default.
+     *
+     * Consumer sovereignty is unchanged: `forceModel` still wins. Unlike a
+     * promotion, `policy.preferredModels` does NOT defer the gate — a
+     * preference says which model you would like to lead, not that a
+     * measurably-failing one works.
+     */
+    measuredFailureGate?: boolean;
 }
 declare function configureBrain(config: BrainConfig): void;
 declare function clearBrain(): void;
@@ -973,7 +1003,7 @@ declare function runGoldenEval(opts: GoldenEvalOptions): Promise<GoldenEvalRunRe
  * guard in `tests/version.test.ts` fails the suite (and therefore
  * `prepublishOnly`) when they diverge — a stale constant cannot reach npm.
  */
-declare const LIBRARY_VERSION = "2.0.0-alpha.69";
+declare const LIBRARY_VERSION = "2.0.0-alpha.70";
 
 /**
  * Oracle contract — how an app tells the brain whether a response was good.
@@ -2833,6 +2863,145 @@ declare function _testResetPromotions(): void;
 /** Wait for any in-flight refresh to settle. */
 declare function _testWaitForPromotionsRefresh(): Promise<void>;
 
+/**
+ * measured-failure-brain — the CREATE-a-gate direction of
+ * measured-supersedes-judgment (alpha.70).
+ *
+ * alpha.49 gives kgauto a quality gate that fires off a model profile's
+ * DECLARED conventions (`archetypeConventions.structuredOutputHint: 'avoid'`).
+ * alpha.64 let a MEASURED eval verdict SUPPRESS that gate
+ * (`kgauto_promotions.suppress_quality_gate`). Nothing could go the other
+ * way — a model whose declarations are wrong could not have a gate CREATED
+ * for it, which is precisely the case where declarations cannot be trusted.
+ *
+ * The originating evidence: `claude-haiku-4-5` on playbacksam/summarize
+ * declares `structuredOutput: 'grammar'` + `archetypePerf.summarize: 8`, so
+ * every quality signal reads green and it wins the surface on price — while
+ * failing **12 of 12 in-window attempts** (2026-07-14..25, seven in one
+ * day). The brain held that evidence and nothing could act on it.
+ *
+ * ── Design notes ───────────────────────────────────────────────────────
+ *
+ * **No stored decision.** The gate is DERIVED from a rolling 28d window
+ * (`kgauto_surface_model_failure_v`), never written down. That kills the
+ * flap problem by construction — there is no state to flap — and it means
+ * a gated model un-gates itself once its failures age out. Combined with
+ * the gate being a DE-RANK (out of leadership, retained as graceful
+ * fallback) rather than a hard block, the model keeps earning evidence, so
+ * this cannot become the exclusion-lock-in trap where a blocked model can
+ * never prove itself again.
+ *
+ * **The threshold is a confidence bound, not a fixed sample floor.** A flat
+ * `minSample: 20` (promotion-guard's rate floor) would NOT have fired on
+ * haiku's n=12 — the consumer would keep paying while we waited for a
+ * rounder number. But distinguishing 100% from 5% needs far fewer trials
+ * than distinguishing 2% from 6%. Gating on the Wilson score lower bound
+ * makes the sample requirement adapt to the effect size automatically,
+ * which is the alpha.67 insight ("the sample floor for a median can be far
+ * lower than for a rate") generalised properly.
+ *
+ * **Direct app-scoped read, not the config-endpoint cache.** Modelled on
+ * `promotions-brain.ts`, deliberately NOT `createBrainQueryCache` — that
+ * routes through the dashboard `/v2/config` projection, which is the third
+ * layer in the L-073 "executable knowledge is dropped at every transport
+ * boundary" chain. One fewer place to forget a field.
+ */
+
+/**
+ * One row of the rolling-window evidence view, per (app, archetype, model).
+ * Raw counts only — the brain serves facts, this module decides.
+ */
+interface SurfaceFailureRow {
+    archetype: string;
+    model: string;
+    /** Total attempts in-window (served + quality walkaways). */
+    n: number;
+    /** Attempts that failed on the quality axis. */
+    nFail: number;
+}
+declare const MEASURED_FAILURE_CFG: {
+    /**
+     * Hard minimum attempts before ANY gate may be created. Guards against
+     * pathological tiny samples that the confidence bound alone would let
+     * through in edge cases. At 5-for-5 the bound clears the threshold; at
+     * 3-for-3 it does not, which is the behaviour we want (three failures is
+     * a bad day, five in a row is a pattern).
+     */
+    readonly minSample: 5;
+    /**
+     * Gate when we are 95% confident the model fails MORE OFTEN THAN IT
+     * SUCCEEDS on this surface. Deliberately unarguable rather than tuned —
+     * a model that probably fails the majority of the time has no business
+     * leading a surface, whatever its declared scores say.
+     */
+    readonly lowerBoundThreshold: 0.5;
+    /** 95% one-sided-ish confidence (standard two-sided z at α=0.05). */
+    readonly z: 1.96;
+    /** Must match the view's window. Documented here for the advisory text. */
+    readonly windowDays: 28;
+};
+/**
+ * Wilson score interval, lower bound. Preferred over the normal
+ * approximation because it stays sane at the extremes — at p̂ = 1 the
+ * normal approximation gives a zero-width interval (it would gate on a
+ * single failure), while Wilson correctly returns a bound that tightens
+ * with n.
+ *
+ * Returns 0 for n <= 0.
+ */
+declare function wilsonLowerBound(failures: number, n: number, z?: number): number;
+interface MeasuredFailureVerdict {
+    /** Whether the measured-failure quality gate fires for this tuple. */
+    gated: boolean;
+    /** Observed failure rate in-window. */
+    rate: number;
+    /** 95% lower confidence bound on that rate — what the gate tests. */
+    lowerBound: number;
+    /** Attempts backing the verdict. */
+    n: number;
+    nFail: number;
+}
+/**
+ * Pure decision, exported for tests and for the advisory text. Separated
+ * from the I/O so the policy can be exercised without a brain.
+ */
+declare function judgeMeasuredFailure(row: SurfaceFailureRow | undefined, cfg?: typeof MEASURED_FAILURE_CFG): MeasuredFailureVerdict | undefined;
+interface MeasuredFailureRuntime {
+    /** Endpoint base URL. The library appends `?app_id=<id>`. */
+    endpoint: string;
+    /** Stale-while-revalidate window in ms. */
+    ttlMs: number;
+    fetchImpl: typeof fetch;
+    onError?: (err: unknown) => void;
+}
+/** Default endpoint on the kgauto-dashboard. Mirrors the promotions convention. */
+declare const DEFAULT_MEASURED_FAILURE_ENDPOINT = "https://kgauto-dashboard.vercel.app/api/kgauto-v2/measured-failure";
+/**
+ * Opt-out env switch. UNLIKE auto-promote this defaults ON wherever the
+ * brain is configured, because the gate is protective: it only ever
+ * de-ranks a model the consumer's OWN traffic shows to be failing them, and
+ * the failure is already being paid for. Set `KGAUTO_MEASURED_FAILURE_GATE=0`
+ * (or 'false') to disable.
+ */
+declare function isMeasuredFailureGateEnabledFromEnv(envSource?: Record<string, string | undefined>): boolean;
+declare function configureMeasuredFailureBrain(rt: MeasuredFailureRuntime | undefined): void;
+declare function isMeasuredFailureBrainActive(): boolean;
+interface GetMeasuredFailureOpts {
+    appId: string;
+    archetype: IntentArchetypeName | string;
+    model: string;
+}
+/**
+ * Sync reader. Returns the verdict for `(appId, archetype, model)` or
+ * undefined (not configured / cold / below minSample / brain down).
+ *
+ * NEVER throws. Cold start returns undefined and warms in the background —
+ * same posture as every other brain-driven lever in compile().
+ */
+declare function getMeasuredFailureVerdict(opts: GetMeasuredFailureOpts): MeasuredFailureVerdict | undefined;
+declare function _testResetMeasuredFailure(): void;
+declare function _testWaitForMeasuredFailureRefresh(): Promise<void>;
+
 /**
  * @warmdrift/kgauto v2 — prompt compiler + central learning brain.
  *
@@ -2879,4 +3048,4 @@ declare function _testWaitForPromotionsRefresh(): Promise<void>;
  */
 declare function compile(ir: PromptIR, opts?: CompileOptions): CompileResult;
 
-export { ABSOLUTE_FLOOR, type AISDKConvertedMessage, ARCHETYPE_FAMILY_FITS, ARCHETYPE_FLOOR_DEFAULT, type ActionableAdvisory, Adapter, type AdvisoryResolutionSource, type AdvisorySeverity, type AdvisoryStatus, type AdvisorySuggestedFix, ApiKeys, type AppOracle, type ApplySectionRewritesArgs, type ApplySectionRewritesResult, ArchetypeConvention, type ArchetypeFamilyFit, type ArchetypePerfMap, type ArchetypePerfNMap, type ArchetypePerfScoreResult, type AttachCacheControlResult, BestPracticeAdvisory, type BrainConfig, type BrainDeadLetterEntry, type BrainHealthSnapshot, type BrainQueryConfig, type BrainReadEnv, CallOptions, CallResult, ChainEntry, type CompatibilityIntent, type CompileForAISDKv6Result, type CompileOptions, CompilePolicy, CompileResult, CompiledRequest, DEFAULT_FINDINGS_ENDPOINT, DEFAULT_PROMOTIONS_ENDPOINT, type ExclusionFindingRow, type ExclusionResolutionSource, type ExecuteErr, type ExecuteOk, type ExecuteOptions, type ExecuteResult, type FallbackPosture, FamilyResolutionError, type GetActionableAdvisoriesOptions, type GetApplicablePromotionOpts, type GetDefaultFallbackChainOpts, type GetPerAxisMetricsOpts, type GetRecommendedPrimaryOptions, type GoldenEvalCase, type GoldenEvalOptions, type GoldenEvalRunResult, type GoldenIrRecordInput, Grounding, IntentArchetypeName, JUDGE_RUBRICS, LIBRARY_VERSION, type LLMJudgeOptions, MEASURED_GROUNDING_MIN_N, type MarkAdvisoryResolvedOptions, type MarkExclusionFindingHandledOptions, type MarkPromoteReadyHandledOptions, type ModelBrainRow, type ModelCompatibility, ModelProfile, NormalizedResponse, type OracleContext, OracleScore, type OutcomePayload, OutcomeResult, OutputMode, PRODUCER_OWNED_RULE_CODES, PROVIDER_ENV_KEYS, PerAxisMetrics, type PricingRow, type ProbeShadowOptions, type ProbeShadowServed, type ProfileToRowOptions, type PromoteReadyFindingRow, type PromoteReadyResolution, type PromotionRow, type PromotionsRuntime, PromptIR, Provider, ProviderOverrides, type ProviderReachability, RULE_SEQUENTIAL_TOOL_CLIFF, type ReachabilityOpts, RecordInput, RecordOutcomeInput, type RunAdvisorPhase2Context, SectionRewrite, type ShadowProbeRecordInput, type SupportedProvider, SystemModelMessage, TRANSLATOR_FLOOR, _testResetPromotions, _testWaitForPromotionsRefresh, applyArchetypeConvention, applySectionRewrites, attachCacheControlToStreamTextInput, brainHealth, buildGoldenIrRow, buildLLMJudge, buildPairwiseJudgePrompt, buildShadowProbeRow, call, clearBrain, combineOrderSwappedVerdicts, compile, compileForAISDKv6, configureBrain, configurePromotionsBrain, countTokens, deriveFamilyFromModelId, deriveOwnership, execute, findBetterFit, flushBrainDeadLetter, getActionableAdvisories, getAllStarterChains, getAllStarterChainsWithGrounding, getApplicablePromotion, getArchetypePerfScore, getDefaultFallbackChain, getDefaultFallbackChainWithGrounding, getModelCompatibility, getPerAxisMetrics, getReachabilityDiagnostic, getRecommendedPrimary, getSequentialStarterChain, getSequentialStarterChainWithGrounding, getStaleExclusionFindings, getStarterChain, getStarterChainWithGrounding, isAutoPromoteEnabledFromEnv, isBrainQueryActiveFor, isBrainSync, isExclusionFindingsBrainActive, isModelReachable, isPromotionsBrainActive, isProviderReachable, loadAliasesFromBrain, loadArchetypePerfFromBrain, loadArchetypePerfNFromBrain, loadChainsFromBrain, loadModelsFromBrain, loadPricingFromBrain, markAdvisoryResolved, markExclusionFindingHandled, markPromoteReadyHandled, parseJudgeVerdict, peekBrainDeadLetter, probeShadow, profileToRow, readBrainReadEnv, record, recordGoldenIr, recordOutcome, recordShadowProbe, renderIrForJudge, resetTokenizer, resolveConventionsForProfile, resolvePricingAt, resolveProviderKey, rubricFor, runAdvisor, runGoldenEval, setTokenizer };
+export { ABSOLUTE_FLOOR, type AISDKConvertedMessage, ARCHETYPE_FAMILY_FITS, ARCHETYPE_FLOOR_DEFAULT, type ActionableAdvisory, Adapter, type AdvisoryResolutionSource, type AdvisorySeverity, type AdvisoryStatus, type AdvisorySuggestedFix, ApiKeys, type AppOracle, type ApplySectionRewritesArgs, type ApplySectionRewritesResult, ArchetypeConvention, type ArchetypeFamilyFit, type ArchetypePerfMap, type ArchetypePerfNMap, type ArchetypePerfScoreResult, type AttachCacheControlResult, BestPracticeAdvisory, type BrainConfig, type BrainDeadLetterEntry, type BrainHealthSnapshot, type BrainQueryConfig, type BrainReadEnv, CallOptions, CallResult, ChainEntry, type CompatibilityIntent, type CompileForAISDKv6Result, type CompileOptions, CompilePolicy, CompileResult, CompiledRequest, DEFAULT_FINDINGS_ENDPOINT, DEFAULT_MEASURED_FAILURE_ENDPOINT, DEFAULT_PROMOTIONS_ENDPOINT, type ExclusionFindingRow, type ExclusionResolutionSource, type ExecuteErr, type ExecuteOk, type ExecuteOptions, type ExecuteResult, type FallbackPosture, FamilyResolutionError, type GetActionableAdvisoriesOptions, type GetApplicablePromotionOpts, type GetDefaultFallbackChainOpts, type GetMeasuredFailureOpts, type GetPerAxisMetricsOpts, type GetRecommendedPrimaryOptions, type GoldenEvalCase, type GoldenEvalOptions, type GoldenEvalRunResult, type GoldenIrRecordInput, Grounding, IntentArchetypeName, JUDGE_RUBRICS, LIBRARY_VERSION, type LLMJudgeOptions, MEASURED_FAILURE_CFG, MEASURED_GROUNDING_MIN_N, type MarkAdvisoryResolvedOptions, type MarkExclusionFindingHandledOptions, type MarkPromoteReadyHandledOptions, type MeasuredFailureRuntime, type MeasuredFailureVerdict, type ModelBrainRow, type ModelCompatibility, ModelProfile, NormalizedResponse, type OracleContext, OracleScore, type OutcomePayload, OutcomeResult, OutputMode, PRODUCER_OWNED_RULE_CODES, PROVIDER_ENV_KEYS, PerAxisMetrics, type PricingRow, type ProbeShadowOptions, type ProbeShadowServed, type ProfileToRowOptions, type PromoteReadyFindingRow, type PromoteReadyResolution, type PromotionRow, type PromotionsRuntime, PromptIR, Provider, ProviderOverrides, type ProviderReachability, RULE_SEQUENTIAL_TOOL_CLIFF, type ReachabilityOpts, RecordInput, RecordOutcomeInput, type RunAdvisorPhase2Context, SectionRewrite, type ShadowProbeRecordInput, type SupportedProvider, type SurfaceFailureRow, SystemModelMessage, TRANSLATOR_FLOOR, _testResetMeasuredFailure, _testResetPromotions, _testWaitForMeasuredFailureRefresh, _testWaitForPromotionsRefresh, applyArchetypeConvention, applySectionRewrites, attachCacheControlToStreamTextInput, brainHealth, buildGoldenIrRow, buildLLMJudge, buildPairwiseJudgePrompt, buildShadowProbeRow, call, clearBrain, combineOrderSwappedVerdicts, compile, compileForAISDKv6, configureBrain, configureMeasuredFailureBrain, configurePromotionsBrain, countTokens, deriveFamilyFromModelId, deriveOwnership, execute, findBetterFit, flushBrainDeadLetter, getActionableAdvisories, getAllStarterChains, getAllStarterChainsWithGrounding, getApplicablePromotion, getArchetypePerfScore, getDefaultFallbackChain, getDefaultFallbackChainWithGrounding, getMeasuredFailureVerdict, getModelCompatibility, getPerAxisMetrics, getReachabilityDiagnostic, getRecommendedPrimary, getSequentialStarterChain, getSequentialStarterChainWithGrounding, getStaleExclusionFindings, getStarterChain, getStarterChainWithGrounding, isAutoPromoteEnabledFromEnv, isBrainQueryActiveFor, isBrainSync, isExclusionFindingsBrainActive, isMeasuredFailureBrainActive, isMeasuredFailureGateEnabledFromEnv, isModelReachable, isPromotionsBrainActive, isProviderReachable, judgeMeasuredFailure, loadAliasesFromBrain, loadArchetypePerfFromBrain, loadArchetypePerfNFromBrain, loadChainsFromBrain, loadModelsFromBrain, loadPricingFromBrain, markAdvisoryResolved, markExclusionFindingHandled, markPromoteReadyHandled, parseJudgeVerdict, peekBrainDeadLetter, probeShadow, profileToRow, readBrainReadEnv, record, recordGoldenIr, recordOutcome, recordShadowProbe, renderIrForJudge, resetTokenizer, resolveConventionsForProfile, resolvePricingAt, resolveProviderKey, rubricFor, runAdvisor, runGoldenEval, setTokenizer, wilsonLowerBound };

package/dist/index.js

@@ -27,6 +27,7 @@ __export(index_exports, {
   ARCHETYPE_FLOOR_DEFAULT: () => ARCHETYPE_FLOOR_DEFAULT,
   CallError: () => CallError,
   DEFAULT_FINDINGS_ENDPOINT: () => DEFAULT_FINDINGS_ENDPOINT,
+  DEFAULT_MEASURED_FAILURE_ENDPOINT: () => DEFAULT_MEASURED_FAILURE_ENDPOINT,
   DEFAULT_PROMOTIONS_ENDPOINT: () => DEFAULT_PROMOTIONS_ENDPOINT,
   DIALECT_VERSION: () => DIALECT_VERSION,
   FamilyResolutionError: () => FamilyResolutionError,
@@ -34,12 +35,15 @@ __export(index_exports, {
   JUDGE_RUBRICS: () => JUDGE_RUBRICS,
   LATENCY_TIER_MS: () => LATENCY_TIER_MS,
   LIBRARY_VERSION: () => LIBRARY_VERSION,
+  MEASURED_FAILURE_CFG: () => MEASURED_FAILURE_CFG,
   MEASURED_GROUNDING_MIN_N: () => MEASURED_GROUNDING_MIN_N,
   PRODUCER_OWNED_RULE_CODES: () => PRODUCER_OWNED_RULE_CODES,
   PROVIDER_ENV_KEYS: () => PROVIDER_ENV_KEYS,
   RULE_SEQUENTIAL_TOOL_CLIFF: () => RULE_SEQUENTIAL_TOOL_CLIFF,
   TRANSLATOR_FLOOR: () => TRANSLATOR_FLOOR,
+  _testResetMeasuredFailure: () => _testResetMeasuredFailure,
   _testResetPromotions: () => _testResetPromotions,
+  _testWaitForMeasuredFailureRefresh: () => _testWaitForMeasuredFailureRefresh,
   _testWaitForPromotionsRefresh: () => _testWaitForPromotionsRefresh,
   allProfiles: () => allProfiles,
   applyArchetypeConvention: () => applyArchetypeConvention,
@@ -60,6 +64,7 @@ __export(index_exports, {
   compile: () => compile2,
   compileForAISDKv6: () => compileForAISDKv6,
   configureBrain: () => configureBrain,
+  configureMeasuredFailureBrain: () => configureMeasuredFailureBrain,
   configurePromotionsBrain: () => configurePromotionsBrain,
   countTokens: () => countTokens,
   createBrainForwardRoutes: () => createBrainForwardRoutes,
@@ -76,6 +81,7 @@ __export(index_exports, {
   getArchetypePerfScore: () => getArchetypePerfScore,
   getDefaultFallbackChain: () => getDefaultFallbackChain,
   getDefaultFallbackChainWithGrounding: () => getDefaultFallbackChainWithGrounding,
+  getMeasuredFailureVerdict: () => getMeasuredFailureVerdict,
   getModelCompatibility: () => getModelCompatibility,
   getPerAxisMetrics: () => getPerAxisMetrics,
   getProfile: () => getProfile,
@@ -92,9 +98,12 @@ __export(index_exports, {
   isBrainQueryActiveFor: () => isBrainQueryActiveFor,
   isBrainSync: () => isBrainSync,
   isExclusionFindingsBrainActive: () => isExclusionFindingsBrainActive,
+  isMeasuredFailureBrainActive: () => isMeasuredFailureBrainActive,
+  isMeasuredFailureGateEnabledFromEnv: () => isMeasuredFailureGateEnabledFromEnv,
   isModelReachable: () => isModelReachable,
   isPromotionsBrainActive: () => isPromotionsBrainActive,
   isProviderReachable: () => isProviderReachable,
+  judgeMeasuredFailure: () => judgeMeasuredFailure,
   latencyTierOf: () => latencyTierOf,
   learningKey: () => learningKey,
   loadAliasesFromBrain: () => loadAliasesFromBrain,
@@ -128,7 +137,8 @@ __export(index_exports, {
   runGoldenEval: () => runGoldenEval,
   setTokenizer: () => setTokenizer,
   shouldCaptureGolden: () => shouldCaptureGolden,
-  tryGetProfile: () => tryGetProfile
+  tryGetProfile: () => tryGetProfile,
+  wilsonLowerBound: () => wilsonLowerBound
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -2849,11 +2859,14 @@ function passScoreTargets(ir, opts) {
       );
       if (schemaWeak) qualityGatePenalty = QUALITY_GATE_PENALTY;
     }
+    const measuredGate = opts.measuredFailureGates?.get(modelId);
+    if (measuredGate) qualityGatePenalty = QUALITY_GATE_PENALTY;
     const isPromoted = promotion?.promotedModel === modelId;
-    if (isPromoted && promotion.suppressQualityGate) {
+    if (isPromoted && promotion.suppressQualityGate && !measuredGate) {
       qualityGatePenalty = 0;
     }
-    const promotionBoost = isPromoted ? PROMOTION_BOOST : 0;
+    const promotionNeutralized = isPromoted && !!measuredGate;
+    const promotionBoost = isPromoted && !measuredGate ? PROMOTION_BOOST : 0;
     const rank = qualityScore + callerOrderBoost - costPenalty - reasons.length * 10 + preferredBoost - latencyPenalty - qualityGatePenalty + promotionBoost;
     scores.push({
       modelId,
@@ -2897,14 +2910,31 @@ function passScoreTargets(ir, opts) {
       });
     }
     if (qualityGatePenalty > 0) {
+      if (measuredGate) {
+        const pct = (x) => `${(x * 100).toFixed(0)}%`;
+        policyMutations.push({
+          id: `quality-gate-measured-${modelId}`,
+          source: "quality_gate",
+          passName: "score_targets",
+          description: `Model ${modelId} gated below the quality floor for archetype '${ir.intent.archetype}' by MEASURED evidence from this app's own outcomes \u2014 ${measuredGate.nFail} of ${measuredGate.n} attempts failed on the quality axis in the trailing window (${pct(measuredGate.rate)}; 95% lower bound ${pct(measuredGate.lowerBound)} > 50%). Down-ranked out of leadership; retained as graceful fallback only. The gate is derived, not stored \u2014 it lifts on its own once the failures age out of the window.`
+        });
+      } else {
+        policyMutations.push({
+          id: `quality-gate-structured-${modelId}`,
+          source: "quality_gate",
+          passName: "score_targets",
+          description: `Model ${modelId} gated below the quality floor for archetype '${ir.intent.archetype}' \u2014 declared structuredOutput + kgauto convention flags it schema-weak for this contract (structuredOutputHint:'avoid'). Down-ranked out of leadership; retained as graceful fallback only.`
+        });
+      }
+    }
+    if (promotionNeutralized && reasons.length === 0) {
       policyMutations.push({
-        id: `quality-gate-structured-${modelId}`,
-        source: "quality_gate",
+        id: `promotion-neutralized-${modelId}`,
+        source: "surface_promotion",
         passName: "score_targets",
-        description: `Model ${modelId} gated below the quality floor for archetype '${ir.intent.archetype}' \u2014 declared structuredOutput + kgauto convention flags it schema-weak for this contract (structuredOutputHint:'avoid'). Down-ranked out of leadership; retained as graceful fallback only.`
+        description: `Active promotion #${promotion.id} for ${modelId} NOT applied \u2014 the surface's own measured evidence contradicts it (${measuredGate.nFail}/${measuredGate.n} attempts failed in the trailing window). A promotion rests on an eval at promote time; this rests on what the surface is doing now, and the fresher evidence wins. The 7-day rollback guard is expected to retire this promotion on its next run.`
       });
-    }
-    if (isPromoted && reasons.length === 0) {
+    } else if (isPromoted && reasons.length === 0) {
       policyMutations.push({
         id: `promotion-applied-${modelId}`,
         source: "surface_promotion",
@@ -4538,6 +4568,171 @@ async function _testWaitForPromotionsRefresh() {
   if (pending.length > 0) await Promise.all(pending);
 }
 
+// src/measured-failure-brain.ts
+function coerceCount(v) {
+  if (typeof v === "number") return Number.isFinite(v) ? v : null;
+  if (typeof v === "string") {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+  }
+  return null;
+}
+function isRawFailureRow(x) {
+  if (!x || typeof x !== "object") return false;
+  const r = x;
+  return typeof r.intent_archetype === "string" && typeof r.model === "string" && (typeof r.n === "number" || typeof r.n === "string");
+}
+function mapRows(rows) {
+  const out = [];
+  for (const row of rows) {
+    if (!isRawFailureRow(row)) continue;
+    const n = coerceCount(row.n);
+    const nFail = coerceCount(row.n_fail) ?? 0;
+    if (n === null || n <= 0) continue;
+    out.push({
+      archetype: row.intent_archetype,
+      model: row.model,
+      n,
+      nFail
+    });
+  }
+  return out;
+}
+var MEASURED_FAILURE_CFG = {
+  /**
+   * Hard minimum attempts before ANY gate may be created. Guards against
+   * pathological tiny samples that the confidence bound alone would let
+   * through in edge cases. At 5-for-5 the bound clears the threshold; at
+   * 3-for-3 it does not, which is the behaviour we want (three failures is
+   * a bad day, five in a row is a pattern).
+   */
+  minSample: 5,
+  /**
+   * Gate when we are 95% confident the model fails MORE OFTEN THAN IT
+   * SUCCEEDS on this surface. Deliberately unarguable rather than tuned —
+   * a model that probably fails the majority of the time has no business
+   * leading a surface, whatever its declared scores say.
+   */
+  lowerBoundThreshold: 0.5,
+  /** 95% one-sided-ish confidence (standard two-sided z at α=0.05). */
+  z: 1.96,
+  /** Must match the view's window. Documented here for the advisory text. */
+  windowDays: 28
+};
+function wilsonLowerBound(failures, n, z = MEASURED_FAILURE_CFG.z) {
+  if (n <= 0) return 0;
+  const p = failures / n;
+  const z2 = z * z;
+  const denom = 1 + z2 / n;
+  const centre = p + z2 / (2 * n);
+  const margin = z * Math.sqrt(p * (1 - p) / n + z2 / (4 * n * n));
+  const lower2 = (centre - margin) / denom;
+  return lower2 < 0 ? 0 : lower2;
+}
+function judgeMeasuredFailure(row, cfg = MEASURED_FAILURE_CFG) {
+  if (!row || row.n < cfg.minSample) return void 0;
+  const lowerBound = wilsonLowerBound(row.nFail, row.n, cfg.z);
+  return {
+    gated: lowerBound > cfg.lowerBoundThreshold,
+    rate: row.nFail / row.n,
+    lowerBound,
+    n: row.n,
+    nFail: row.nFail
+  };
+}
+var snapshots5 = /* @__PURE__ */ new Map();
+var runtime6;
+var warnedOnce5 = false;
+var DEFAULT_MEASURED_FAILURE_ENDPOINT = "https://kgauto-dashboard.vercel.app/api/kgauto-v2/measured-failure";
+function isMeasuredFailureGateEnabledFromEnv(envSource) {
+  const env = envSource ?? (typeof process !== "undefined" && process.env ? process.env : {});
+  const raw = (env.KGAUTO_MEASURED_FAILURE_GATE ?? "").trim().toLowerCase();
+  return !(raw === "0" || raw === "false");
+}
+function configureMeasuredFailureBrain(rt) {
+  runtime6 = rt;
+  snapshots5.clear();
+  warnedOnce5 = false;
+}
+function isMeasuredFailureBrainActive() {
+  return runtime6 !== void 0;
+}
+function getMeasuredFailureVerdict(opts) {
+  const rt = runtime6;
+  if (!rt) return void 0;
+  const { appId, archetype, model } = opts;
+  if (!appId || !archetype || !model) return void 0;
+  let snap = snapshots5.get(appId);
+  if (!snap) {
+    snap = { data: [], expiresAt: 0, refreshing: false };
+    snapshots5.set(appId, snap);
+  }
+  const now = Date.now();
+  if (snap.expiresAt <= now && !snap.refreshing) {
+    snap.refreshing = true;
+    void asyncRefresh6(rt, appId);
+  }
+  const row = snap.data.find(
+    (r) => r.archetype === archetype && r.model === model
+  );
+  return judgeMeasuredFailure(row);
+}
+var pendingRefreshes5 = /* @__PURE__ */ new Map();
+async function asyncRefresh6(rt, appId) {
+  const promise = doRefresh6(rt, appId);
+  pendingRefreshes5.set(appId, promise);
+  try {
+    await promise;
+  } finally {
+    if (pendingRefreshes5.get(appId) === promise) {
+      pendingRefreshes5.delete(appId);
+    }
+  }
+}
+async function doRefresh6(rt, appId) {
+  const url = `${rt.endpoint}?app_id=${encodeURIComponent(appId)}`;
+  let snap = snapshots5.get(appId);
+  if (!snap) {
+    snap = { data: [], expiresAt: 0, refreshing: false };
+    snapshots5.set(appId, snap);
+  }
+  try {
+    const res = await rt.fetchImpl(url, { method: "GET" });
+    if (!res.ok) {
+      throw new Error(`measured-failure ${res.status}: ${res.statusText}`);
+    }
+    const body = await res.json();
+    if (runtime6 !== rt) return;
+    snap.data = Array.isArray(body) ? mapRows(body) : [];
+    snap.expiresAt = Date.now() + rt.ttlMs;
+    snap.refreshing = false;
+  } catch (err) {
+    if (runtime6 !== rt) return;
+    snap.refreshing = false;
+    snap.expiresAt = Date.now() + rt.ttlMs;
+    if (!warnedOnce5) {
+      warnedOnce5 = true;
+      (rt.onError ?? defaultOnError6)(err);
+    }
+  }
+}
+function defaultOnError6(err) {
+  console.warn(
+    "[kgauto] measured-failure fetch failed (gate inactive until next refresh):",
+    err
+  );
+}
+function _testResetMeasuredFailure() {
+  runtime6 = void 0;
+  snapshots5.clear();
+  pendingRefreshes5 = /* @__PURE__ */ new Map();
+  warnedOnce5 = false;
+}
+async function _testWaitForMeasuredFailureRefresh() {
+  const pending = Array.from(pendingRefreshes5.values());
+  if (pending.length > 0) await Promise.all(pending);
+}
+
 // src/compile.ts
 var counter = 0;
 function makeHandle() {
@@ -4574,12 +4769,31 @@ function compile(ir, opts = {}) {
     evalRunId: activePromotion.evalRunId,
     suppressQualityGate: activePromotion.suppressQualityGate
   } : void 0;
+  const measuredFailureGates = /* @__PURE__ */ new Map();
+  for (const entry of workingIR.models ?? []) {
+    const modelId = typeof entry === "string" ? entry : void 0;
+    if (!modelId) continue;
+    const verdict = getMeasuredFailureVerdict({
+      appId: ir.appId,
+      archetype: ir.intent.archetype,
+      model: modelId
+    });
+    if (verdict?.gated) {
+      measuredFailureGates.set(modelId, {
+        rate: verdict.rate,
+        lowerBound: verdict.lowerBound,
+        n: verdict.n,
+        nFail: verdict.nFail
+      });
+    }
+  }
   const inputTokens = estimateInputTokens(workingIR);
   const scores = passScoreTargets(workingIR, {
     estimatedInputTokens: inputTokens,
     profilesById: resolver,
     policy: opts.policy,
-    promotion
+    promotion,
+    measuredFailureGates
   });
   accumulatedMutations.push(...scores.mutations);
   const target = pickTarget(workingIR, scores.value);
@@ -4940,12 +5154,24 @@ function configureBrain(config) {
   } else {
     configurePromotionsBrain(void 0);
   }
+  const measuredFailureConsent = config.measuredFailureGate ?? isMeasuredFailureGateEnabledFromEnv();
+  if (measuredFailureConsent && bq.measuredFailure !== false) {
+    configureMeasuredFailureBrain({
+      endpoint: bq.measuredFailureEndpoint ?? DEFAULT_MEASURED_FAILURE_ENDPOINT,
+      ttlMs: bq.cacheTtlMs ?? 3e5,
+      fetchImpl: config.fetchImpl ?? fetch,
+      onError: config.onError
+    });
+  } else {
+    configureMeasuredFailureBrain(void 0);
+  }
 }
 function clearBrain() {
   activeConfig = void 0;
   configureBrainQuery(void 0);
   configureExclusionFindingsBrain(void 0);
   configurePromotionsBrain(void 0);
+  configureMeasuredFailureBrain(void 0);
 }
 var DEAD_LETTER_MAX_ENTRIES = 50;
 var DEAD_LETTER_MAX_ATTEMPTS = 3;
@@ -5062,7 +5288,7 @@ async function flushBrainDeadLetter() {
         if (entry.attempts >= DEAD_LETTER_MAX_ATTEMPTS) {
           const idx = deadLetter.indexOf(entry);
           if (idx !== -1) deadLetter.splice(idx, 1);
-          (config.onError ?? defaultOnError6)(
+          (config.onError ?? defaultOnError7)(
             new Error(
               `brain dead-letter: dropping ${entry.route} payload after ${entry.attempts} attempts \u2014 last error: ${entry.lastError}`
             )
@@ -5220,7 +5446,7 @@ async function record(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("outcomes", config.endpoint, payload, err);
-      (config.onError ?? defaultOnError6)(err);
+      (config.onError ?? defaultOnError7)(err);
       return;
     }
     maybeAutoFlush();
@@ -5248,7 +5474,7 @@ async function record(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("compile_outcome_advisories", config.endpoint, advisoryPayload, err);
-      (config.onError ?? defaultOnError6)(err);
+      (config.onError ?? defaultOnError7)(err);
     }
   };
   if (config.sync) {
@@ -5257,7 +5483,7 @@ async function record(input) {
     void send();
   }
 }
-function defaultOnError6(err) {
+function defaultOnError7(err) {
   console.warn("[kgauto] brain record failed:", err);
 }
 function describeBrainWriteFailure(status, route, body) {
@@ -5422,7 +5648,7 @@ async function recordOutcome(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("compile_outcome_quality", config.endpoint, payload, err);
-      (config.onError ?? defaultOnError6)(err);
+      (config.onError ?? defaultOnError7)(err);
       return { ok: false, reason: "persistence_failed" };
     }
   };
@@ -5493,7 +5719,7 @@ async function recordShadowProbe(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("probe_outcomes", config.endpoint, row, err);
-      (config.onError ?? defaultOnError6)(err);
+      (config.onError ?? defaultOnError7)(err);
     }
   };
   if (config.sync) {
@@ -5548,7 +5774,7 @@ async function recordGoldenIr(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("golden_irs", config.endpoint, row, err);
-      (config.onError ?? defaultOnError6)(err);
+      (config.onError ?? defaultOnError7)(err);
     }
   };
   if (config.sync) {
@@ -8376,7 +8602,7 @@ function createBrainForwardRoutes(config) {
 }
 
 // src/version.ts
-var LIBRARY_VERSION = "2.0.0-alpha.69";
+var LIBRARY_VERSION = "2.0.0-alpha.70";
 
 // src/key-health.ts
 var JSON_HEADERS2 = { "Content-Type": "application/json" };
@@ -9009,6 +9235,7 @@ function compile2(ir, opts) {
   ARCHETYPE_FLOOR_DEFAULT,
   CallError,
   DEFAULT_FINDINGS_ENDPOINT,
+  DEFAULT_MEASURED_FAILURE_ENDPOINT,
   DEFAULT_PROMOTIONS_ENDPOINT,
   DIALECT_VERSION,
   FamilyResolutionError,
@@ -9016,12 +9243,15 @@ function compile2(ir, opts) {
   JUDGE_RUBRICS,
   LATENCY_TIER_MS,
   LIBRARY_VERSION,
+  MEASURED_FAILURE_CFG,
   MEASURED_GROUNDING_MIN_N,
   PRODUCER_OWNED_RULE_CODES,
   PROVIDER_ENV_KEYS,
   RULE_SEQUENTIAL_TOOL_CLIFF,
   TRANSLATOR_FLOOR,
+  _testResetMeasuredFailure,
   _testResetPromotions,
+  _testWaitForMeasuredFailureRefresh,
   _testWaitForPromotionsRefresh,
   allProfiles,
   applyArchetypeConvention,
@@ -9042,6 +9272,7 @@ function compile2(ir, opts) {
   compile,
   compileForAISDKv6,
   configureBrain,
+  configureMeasuredFailureBrain,
   configurePromotionsBrain,
   countTokens,
   createBrainForwardRoutes,
@@ -9058,6 +9289,7 @@ function compile2(ir, opts) {
   getArchetypePerfScore,
   getDefaultFallbackChain,
   getDefaultFallbackChainWithGrounding,
+  getMeasuredFailureVerdict,
   getModelCompatibility,
   getPerAxisMetrics,
   getProfile,
@@ -9074,9 +9306,12 @@ function compile2(ir, opts) {
   isBrainQueryActiveFor,
   isBrainSync,
   isExclusionFindingsBrainActive,
+  isMeasuredFailureBrainActive,
+  isMeasuredFailureGateEnabledFromEnv,
   isModelReachable,
   isPromotionsBrainActive,
   isProviderReachable,
+  judgeMeasuredFailure,
   latencyTierOf,
   learningKey,
   loadAliasesFromBrain,
@@ -9110,5 +9345,6 @@ function compile2(ir, opts) {
   runGoldenEval,
   setTokenizer,
   shouldCaptureGolden,
-  tryGetProfile
+  tryGetProfile,
+  wilsonLowerBound
 });

package/dist/index.mjs

@@ -16,7 +16,7 @@ import {
 import {
   LIBRARY_VERSION,
   createKeyHealthRoute
-} from "./chunk-EZXVJUK7.mjs";
+} from "./chunk-FR4DNGLW.mjs";
 import {
   ABSOLUTE_FLOOR,
   ARCHETYPE_FLOOR_DEFAULT,
@@ -826,11 +826,14 @@ function passScoreTargets(ir, opts) {
       );
       if (schemaWeak) qualityGatePenalty = QUALITY_GATE_PENALTY;
     }
+    const measuredGate = opts.measuredFailureGates?.get(modelId);
+    if (measuredGate) qualityGatePenalty = QUALITY_GATE_PENALTY;
     const isPromoted = promotion?.promotedModel === modelId;
-    if (isPromoted && promotion.suppressQualityGate) {
+    if (isPromoted && promotion.suppressQualityGate && !measuredGate) {
       qualityGatePenalty = 0;
     }
-    const promotionBoost = isPromoted ? PROMOTION_BOOST : 0;
+    const promotionNeutralized = isPromoted && !!measuredGate;
+    const promotionBoost = isPromoted && !measuredGate ? PROMOTION_BOOST : 0;
     const rank = qualityScore + callerOrderBoost - costPenalty - reasons.length * 10 + preferredBoost - latencyPenalty - qualityGatePenalty + promotionBoost;
     scores.push({
       modelId,
@@ -874,14 +877,31 @@ function passScoreTargets(ir, opts) {
       });
     }
     if (qualityGatePenalty > 0) {
+      if (measuredGate) {
+        const pct = (x) => `${(x * 100).toFixed(0)}%`;
+        policyMutations.push({
+          id: `quality-gate-measured-${modelId}`,
+          source: "quality_gate",
+          passName: "score_targets",
+          description: `Model ${modelId} gated below the quality floor for archetype '${ir.intent.archetype}' by MEASURED evidence from this app's own outcomes \u2014 ${measuredGate.nFail} of ${measuredGate.n} attempts failed on the quality axis in the trailing window (${pct(measuredGate.rate)}; 95% lower bound ${pct(measuredGate.lowerBound)} > 50%). Down-ranked out of leadership; retained as graceful fallback only. The gate is derived, not stored \u2014 it lifts on its own once the failures age out of the window.`
+        });
+      } else {
+        policyMutations.push({
+          id: `quality-gate-structured-${modelId}`,
+          source: "quality_gate",
+          passName: "score_targets",
+          description: `Model ${modelId} gated below the quality floor for archetype '${ir.intent.archetype}' \u2014 declared structuredOutput + kgauto convention flags it schema-weak for this contract (structuredOutputHint:'avoid'). Down-ranked out of leadership; retained as graceful fallback only.`
+        });
+      }
+    }
+    if (promotionNeutralized && reasons.length === 0) {
       policyMutations.push({
-        id: `quality-gate-structured-${modelId}`,
-        source: "quality_gate",
+        id: `promotion-neutralized-${modelId}`,
+        source: "surface_promotion",
         passName: "score_targets",
-        description: `Model ${modelId} gated below the quality floor for archetype '${ir.intent.archetype}' \u2014 declared structuredOutput + kgauto convention flags it schema-weak for this contract (structuredOutputHint:'avoid'). Down-ranked out of leadership; retained as graceful fallback only.`
+        description: `Active promotion #${promotion.id} for ${modelId} NOT applied \u2014 the surface's own measured evidence contradicts it (${measuredGate.nFail}/${measuredGate.n} attempts failed in the trailing window). A promotion rests on an eval at promote time; this rests on what the surface is doing now, and the fresher evidence wins. The 7-day rollback guard is expected to retire this promotion on its next run.`
       });
-    }
-    if (isPromoted && reasons.length === 0) {
+    } else if (isPromoted && reasons.length === 0) {
       policyMutations.push({
         id: `promotion-applied-${modelId}`,
         source: "surface_promotion",
@@ -2515,6 +2535,171 @@ async function _testWaitForPromotionsRefresh() {
   if (pending.length > 0) await Promise.all(pending);
 }
 
+// src/measured-failure-brain.ts
+function coerceCount(v) {
+  if (typeof v === "number") return Number.isFinite(v) ? v : null;
+  if (typeof v === "string") {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+  }
+  return null;
+}
+function isRawFailureRow(x) {
+  if (!x || typeof x !== "object") return false;
+  const r = x;
+  return typeof r.intent_archetype === "string" && typeof r.model === "string" && (typeof r.n === "number" || typeof r.n === "string");
+}
+function mapRows(rows) {
+  const out = [];
+  for (const row of rows) {
+    if (!isRawFailureRow(row)) continue;
+    const n = coerceCount(row.n);
+    const nFail = coerceCount(row.n_fail) ?? 0;
+    if (n === null || n <= 0) continue;
+    out.push({
+      archetype: row.intent_archetype,
+      model: row.model,
+      n,
+      nFail
+    });
+  }
+  return out;
+}
+var MEASURED_FAILURE_CFG = {
+  /**
+   * Hard minimum attempts before ANY gate may be created. Guards against
+   * pathological tiny samples that the confidence bound alone would let
+   * through in edge cases. At 5-for-5 the bound clears the threshold; at
+   * 3-for-3 it does not, which is the behaviour we want (three failures is
+   * a bad day, five in a row is a pattern).
+   */
+  minSample: 5,
+  /**
+   * Gate when we are 95% confident the model fails MORE OFTEN THAN IT
+   * SUCCEEDS on this surface. Deliberately unarguable rather than tuned —
+   * a model that probably fails the majority of the time has no business
+   * leading a surface, whatever its declared scores say.
+   */
+  lowerBoundThreshold: 0.5,
+  /** 95% one-sided-ish confidence (standard two-sided z at α=0.05). */
+  z: 1.96,
+  /** Must match the view's window. Documented here for the advisory text. */
+  windowDays: 28
+};
+function wilsonLowerBound(failures, n, z = MEASURED_FAILURE_CFG.z) {
+  if (n <= 0) return 0;
+  const p = failures / n;
+  const z2 = z * z;
+  const denom = 1 + z2 / n;
+  const centre = p + z2 / (2 * n);
+  const margin = z * Math.sqrt(p * (1 - p) / n + z2 / (4 * n * n));
+  const lower2 = (centre - margin) / denom;
+  return lower2 < 0 ? 0 : lower2;
+}
+function judgeMeasuredFailure(row, cfg = MEASURED_FAILURE_CFG) {
+  if (!row || row.n < cfg.minSample) return void 0;
+  const lowerBound = wilsonLowerBound(row.nFail, row.n, cfg.z);
+  return {
+    gated: lowerBound > cfg.lowerBoundThreshold,
+    rate: row.nFail / row.n,
+    lowerBound,
+    n: row.n,
+    nFail: row.nFail
+  };
+}
+var snapshots5 = /* @__PURE__ */ new Map();
+var runtime5;
+var warnedOnce5 = false;
+var DEFAULT_MEASURED_FAILURE_ENDPOINT = "https://kgauto-dashboard.vercel.app/api/kgauto-v2/measured-failure";
+function isMeasuredFailureGateEnabledFromEnv(envSource) {
+  const env = envSource ?? (typeof process !== "undefined" && process.env ? process.env : {});
+  const raw = (env.KGAUTO_MEASURED_FAILURE_GATE ?? "").trim().toLowerCase();
+  return !(raw === "0" || raw === "false");
+}
+function configureMeasuredFailureBrain(rt) {
+  runtime5 = rt;
+  snapshots5.clear();
+  warnedOnce5 = false;
+}
+function isMeasuredFailureBrainActive() {
+  return runtime5 !== void 0;
+}
+function getMeasuredFailureVerdict(opts) {
+  const rt = runtime5;
+  if (!rt) return void 0;
+  const { appId, archetype, model } = opts;
+  if (!appId || !archetype || !model) return void 0;
+  let snap = snapshots5.get(appId);
+  if (!snap) {
+    snap = { data: [], expiresAt: 0, refreshing: false };
+    snapshots5.set(appId, snap);
+  }
+  const now = Date.now();
+  if (snap.expiresAt <= now && !snap.refreshing) {
+    snap.refreshing = true;
+    void asyncRefresh5(rt, appId);
+  }
+  const row = snap.data.find(
+    (r) => r.archetype === archetype && r.model === model
+  );
+  return judgeMeasuredFailure(row);
+}
+var pendingRefreshes5 = /* @__PURE__ */ new Map();
+async function asyncRefresh5(rt, appId) {
+  const promise = doRefresh5(rt, appId);
+  pendingRefreshes5.set(appId, promise);
+  try {
+    await promise;
+  } finally {
+    if (pendingRefreshes5.get(appId) === promise) {
+      pendingRefreshes5.delete(appId);
+    }
+  }
+}
+async function doRefresh5(rt, appId) {
+  const url = `${rt.endpoint}?app_id=${encodeURIComponent(appId)}`;
+  let snap = snapshots5.get(appId);
+  if (!snap) {
+    snap = { data: [], expiresAt: 0, refreshing: false };
+    snapshots5.set(appId, snap);
+  }
+  try {
+    const res = await rt.fetchImpl(url, { method: "GET" });
+    if (!res.ok) {
+      throw new Error(`measured-failure ${res.status}: ${res.statusText}`);
+    }
+    const body = await res.json();
+    if (runtime5 !== rt) return;
+    snap.data = Array.isArray(body) ? mapRows(body) : [];
+    snap.expiresAt = Date.now() + rt.ttlMs;
+    snap.refreshing = false;
+  } catch (err) {
+    if (runtime5 !== rt) return;
+    snap.refreshing = false;
+    snap.expiresAt = Date.now() + rt.ttlMs;
+    if (!warnedOnce5) {
+      warnedOnce5 = true;
+      (rt.onError ?? defaultOnError5)(err);
+    }
+  }
+}
+function defaultOnError5(err) {
+  console.warn(
+    "[kgauto] measured-failure fetch failed (gate inactive until next refresh):",
+    err
+  );
+}
+function _testResetMeasuredFailure() {
+  runtime5 = void 0;
+  snapshots5.clear();
+  pendingRefreshes5 = /* @__PURE__ */ new Map();
+  warnedOnce5 = false;
+}
+async function _testWaitForMeasuredFailureRefresh() {
+  const pending = Array.from(pendingRefreshes5.values());
+  if (pending.length > 0) await Promise.all(pending);
+}
+
 // src/compile.ts
 var counter = 0;
 function makeHandle() {
@@ -2551,12 +2736,31 @@ function compile(ir, opts = {}) {
     evalRunId: activePromotion.evalRunId,
     suppressQualityGate: activePromotion.suppressQualityGate
   } : void 0;
+  const measuredFailureGates = /* @__PURE__ */ new Map();
+  for (const entry of workingIR.models ?? []) {
+    const modelId = typeof entry === "string" ? entry : void 0;
+    if (!modelId) continue;
+    const verdict = getMeasuredFailureVerdict({
+      appId: ir.appId,
+      archetype: ir.intent.archetype,
+      model: modelId
+    });
+    if (verdict?.gated) {
+      measuredFailureGates.set(modelId, {
+        rate: verdict.rate,
+        lowerBound: verdict.lowerBound,
+        n: verdict.n,
+        nFail: verdict.nFail
+      });
+    }
+  }
   const inputTokens = estimateInputTokens(workingIR);
   const scores = passScoreTargets(workingIR, {
     estimatedInputTokens: inputTokens,
     profilesById: resolver,
     policy: opts.policy,
-    promotion
+    promotion,
+    measuredFailureGates
   });
   accumulatedMutations.push(...scores.mutations);
   const target = pickTarget(workingIR, scores.value);
@@ -2917,12 +3121,24 @@ function configureBrain(config) {
   } else {
     configurePromotionsBrain(void 0);
   }
+  const measuredFailureConsent = config.measuredFailureGate ?? isMeasuredFailureGateEnabledFromEnv();
+  if (measuredFailureConsent && bq.measuredFailure !== false) {
+    configureMeasuredFailureBrain({
+      endpoint: bq.measuredFailureEndpoint ?? DEFAULT_MEASURED_FAILURE_ENDPOINT,
+      ttlMs: bq.cacheTtlMs ?? 3e5,
+      fetchImpl: config.fetchImpl ?? fetch,
+      onError: config.onError
+    });
+  } else {
+    configureMeasuredFailureBrain(void 0);
+  }
 }
 function clearBrain() {
   activeConfig = void 0;
   configureBrainQuery(void 0);
   configureExclusionFindingsBrain(void 0);
   configurePromotionsBrain(void 0);
+  configureMeasuredFailureBrain(void 0);
 }
 var DEAD_LETTER_MAX_ENTRIES = 50;
 var DEAD_LETTER_MAX_ATTEMPTS = 3;
@@ -3039,7 +3255,7 @@ async function flushBrainDeadLetter() {
         if (entry.attempts >= DEAD_LETTER_MAX_ATTEMPTS) {
           const idx = deadLetter.indexOf(entry);
           if (idx !== -1) deadLetter.splice(idx, 1);
-          (config.onError ?? defaultOnError5)(
+          (config.onError ?? defaultOnError6)(
             new Error(
               `brain dead-letter: dropping ${entry.route} payload after ${entry.attempts} attempts \u2014 last error: ${entry.lastError}`
             )
@@ -3197,7 +3413,7 @@ async function record(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("outcomes", config.endpoint, payload, err);
-      (config.onError ?? defaultOnError5)(err);
+      (config.onError ?? defaultOnError6)(err);
       return;
     }
     maybeAutoFlush();
@@ -3225,7 +3441,7 @@ async function record(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("compile_outcome_advisories", config.endpoint, advisoryPayload, err);
-      (config.onError ?? defaultOnError5)(err);
+      (config.onError ?? defaultOnError6)(err);
     }
   };
   if (config.sync) {
@@ -3234,7 +3450,7 @@ async function record(input) {
     void send();
   }
 }
-function defaultOnError5(err) {
+function defaultOnError6(err) {
   console.warn("[kgauto] brain record failed:", err);
 }
 function describeBrainWriteFailure(status, route, body) {
@@ -3399,7 +3615,7 @@ async function recordOutcome(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("compile_outcome_quality", config.endpoint, payload, err);
-      (config.onError ?? defaultOnError5)(err);
+      (config.onError ?? defaultOnError6)(err);
       return { ok: false, reason: "persistence_failed" };
     }
   };
@@ -3470,7 +3686,7 @@ async function recordShadowProbe(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("probe_outcomes", config.endpoint, row, err);
-      (config.onError ?? defaultOnError5)(err);
+      (config.onError ?? defaultOnError6)(err);
     }
   };
   if (config.sync) {
@@ -3525,7 +3741,7 @@ async function recordGoldenIr(input) {
     } catch (err) {
       noteFailure(err);
       pushDeadLetter("golden_irs", config.endpoint, row, err);
-      (config.onError ?? defaultOnError5)(err);
+      (config.onError ?? defaultOnError6)(err);
     }
   };
   if (config.sync) {
@@ -5881,6 +6097,7 @@ export {
   ARCHETYPE_FLOOR_DEFAULT,
   CallError,
   DEFAULT_FINDINGS_ENDPOINT,
+  DEFAULT_MEASURED_FAILURE_ENDPOINT,
   DEFAULT_PROMOTIONS_ENDPOINT,
   DIALECT_VERSION,
   FamilyResolutionError,
@@ -5888,12 +6105,15 @@ export {
   JUDGE_RUBRICS,
   LATENCY_TIER_MS,
   LIBRARY_VERSION,
+  MEASURED_FAILURE_CFG,
   MEASURED_GROUNDING_MIN_N,
   PRODUCER_OWNED_RULE_CODES,
   PROVIDER_ENV_KEYS,
   RULE_SEQUENTIAL_TOOL_CLIFF,
   TRANSLATOR_FLOOR,
+  _testResetMeasuredFailure,
   _testResetPromotions,
+  _testWaitForMeasuredFailureRefresh,
   _testWaitForPromotionsRefresh,
   allProfiles,
   applyArchetypeConvention,
@@ -5914,6 +6134,7 @@ export {
   compile2 as compile,
   compileForAISDKv6,
   configureBrain,
+  configureMeasuredFailureBrain,
   configurePromotionsBrain,
   countTokens,
   createBrainForwardRoutes,
@@ -5930,6 +6151,7 @@ export {
   getArchetypePerfScore,
   getDefaultFallbackChain,
   getDefaultFallbackChainWithGrounding,
+  getMeasuredFailureVerdict,
   getModelCompatibility,
   getPerAxisMetrics,
   getProfile,
@@ -5946,9 +6168,12 @@ export {
   isBrainQueryActiveFor,
   isBrainSync,
   isExclusionFindingsBrainActive,
+  isMeasuredFailureBrainActive,
+  isMeasuredFailureGateEnabledFromEnv,
   isModelReachable,
   isPromotionsBrainActive,
   isProviderReachable,
+  judgeMeasuredFailure,
   latencyTierOf,
   learningKey,
   loadAliasesFromBrain,
@@ -5982,5 +6207,6 @@ export {
   runGoldenEval,
   setTokenizer,
   shouldCaptureGolden,
-  tryGetProfile
+  tryGetProfile,
+  wilsonLowerBound
 };

package/dist/key-health.js

@@ -25,7 +25,7 @@ __export(key_health_exports, {
 module.exports = __toCommonJS(key_health_exports);
 
 // src/version.ts
-var LIBRARY_VERSION = "2.0.0-alpha.69";
+var LIBRARY_VERSION = "2.0.0-alpha.70";
 
 // src/key-health.ts
 var JSON_HEADERS = { "Content-Type": "application/json" };

package/dist/key-health.mjs

@@ -1,6 +1,6 @@
 import {
   createKeyHealthRoute
-} from "./chunk-EZXVJUK7.mjs";
+} from "./chunk-FR4DNGLW.mjs";
 export {
   createKeyHealthRoute
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmdrift/kgauto-compiler",
-  "version": "2.0.0-alpha.69",
+  "version": "2.0.0-alpha.70",
   "description": "Prompt compiler with executable provider knowledge for multi-model AI apps: normalized multi-provider transport with fallback chains, compile-time cliff guards, a curated model registry, and a telemetry flight recorder. Swap models without rewriting prompts.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",