chainlesschain 0.166.71 → 0.166.74

package/src/lib/evolution/pm-exploration-benchmark.js

@@ -3,11 +3,15 @@ import { createHash } from "node:crypto";
 import { isProxy } from "node:util/types";
 import {
   buildEvolutionEvalSuite,
+  computeEvolutionEvalContextDigest,
   computeEvolutionEvalTrainingPartitionDigest,
   verifyEvolutionEvalPolicy,
+  verifyEvolutionEvalReceipt,
+  verifyEvolutionEvalResultEvidence,
   verifyEvolutionEvalSuite,
 } from "./evolution-eval-gate.js";
 import { createPmExplorationPlan } from "./pm-exploration-rounds.js";
+import { capturePmExplorationProviderSettlementStore } from "./pm-exploration-provider-settlement-adapter.js";
 import grader from "./pm-result-grader.cjs";
 
 const GROUPS = ["template", "project", "principal", "timeWindow"];
@@ -43,11 +47,58 @@ const FAILURE_CLASSES = new Set([
   "grader",
   "unknown",
 ]);
+const COMPLETION_FAILURE_CLASSES = new Set([
+  ...FAILURE_CLASSES,
+  "setup",
+  "timeout",
+  "cancelled",
+]);
 
 export const PM_EXPLORATION_EFFECT_PLAN_SCHEMA =
-  "chainlesschain.pm-exploration-effect-plan/v1";
+  "chainlesschain.pm-exploration-effect-plan/v2";
 export const PM_EXPLORATION_EFFECT_REPORT_SCHEMA =
+  "chainlesschain.pm-exploration-effect-report/v2";
+export const PM_EXPLORATION_EFFECT_EVIDENCE_REPORT_SCHEMA =
+  "chainlesschain.pm-exploration-effect-evidence-report/v1";
+export const PM_EXPLORATION_PREPARATION_PROVIDER_EVIDENCE_SCHEMA =
+  "chainlesschain.pm-exploration-preparation-provider-evidence/v1";
+export const PM_EXPLORATION_EFFECT_PROVIDER_EVIDENCE_BUNDLE_SCHEMA =
+  "chainlesschain.pm-exploration-effect-provider-evidence-bundle/v1";
+export const PM_EXPLORATION_EFFECT_INTERRUPTED_EVIDENCE_SCHEMA =
+  "chainlesschain.pm-exploration-effect-interrupted-evidence/v1";
+export const PM_EXPLORATION_EFFECT_RUNTIME_FAILURE_EVIDENCE_SCHEMA =
+  "chainlesschain.pm-exploration-effect-runtime-failure-evidence/v1";
+export const PM_EXPLORATION_EFFECT_PREFLIGHT_REJECTION_EVIDENCE_SCHEMA =
+  "chainlesschain.pm-exploration-effect-preflight-rejection-evidence/v1";
+export const PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_SCHEMA =
+  "chainlesschain.pm-exploration-effect-attempt-cohort/v1";
+export const PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_V2_SCHEMA =
+  "chainlesschain.pm-exploration-effect-attempt-cohort/v2";
+export const PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_V3_SCHEMA =
+  "chainlesschain.pm-exploration-effect-attempt-cohort/v3";
+export const PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_V4_SCHEMA =
+  "chainlesschain.pm-exploration-effect-attempt-cohort/v4";
+export const PM_EXPLORATION_EFFECT_SLOT_MANIFEST_SCHEMA =
+  "chainlesschain.pm-exploration-effect-slot-manifest/v1";
+export const PM_EXPLORATION_EFFECT_MANIFEST_BOUND_COHORT_SCHEMA =
+  "chainlesschain.pm-exploration-effect-manifest-bound-cohort/v1";
+export const PM_EXPLORATION_EFFECT_COHORT_USAGE_EVIDENCE_SCHEMA =
+  "chainlesschain.pm-exploration-effect-cohort-usage-evidence/v1";
+const LEGACY_EFFECT_PLAN_SCHEMA =
+  "chainlesschain.pm-exploration-effect-plan/v1";
+const LEGACY_EFFECT_REPORT_SCHEMA =
   "chainlesschain.pm-exploration-effect-report/v1";
+const PRIMARY_METRIC = "strict-completion-rate";
+const RESAMPLING_UNIT = "task-group-component";
+const PREPARATION_PROVIDER_REQUESTS_SCHEMA =
+  "chainlesschain.pm-preparation-provider-requests/v1";
+const SIGNED_EVAL_USAGE_FIELDS = Object.freeze([
+  "executionCount",
+  "totalTokens",
+  "totalLatencyMs",
+  "totalToolCalls",
+  "totalCostMicrounits",
+]);
 
 function exact(value, keys, label) {
   if (
@@ -214,6 +265,8 @@ function normalizeEffectBudget(value) {
 }
 
 export function verifyPmExplorationEffectPlan(value) {
+  assertPlainData(value, "PM effect plan");
+  const legacy = value?.schema === LEGACY_EFFECT_PLAN_SCHEMA;
   exact(
     value,
     [
@@ -233,7 +286,15 @@ export function verifyPmExplorationEffectPlan(value) {
       "seeds",
       "budgetPerArmPerSeed",
       "costPhases",
-      "minimumScoreDelta",
+      ...(legacy
+        ? ["minimumScoreDelta"]
+        : [
+            "minimumPassRateDelta",
+            "minimumIndependentGroups",
+            "taskGroups",
+            "primaryMetric",
+            "resamplingUnit",
+          ]),
       "bootstrapSamples",
       "equalBudget",
       "promotionAuthority",
@@ -242,7 +303,7 @@ export function verifyPmExplorationEffectPlan(value) {
     "PM effect plan",
   );
   if (
-    value.schema !== PM_EXPLORATION_EFFECT_PLAN_SCHEMA ||
+    (!legacy && value.schema !== PM_EXPLORATION_EFFECT_PLAN_SCHEMA) ||
     value.bootstrapSamples !== 1_000 ||
     value.equalBudget !== true ||
     value.promotionAuthority !== false
@@ -275,7 +336,14 @@ export function verifyPmExplorationEffectPlan(value) {
     seeds: normalizeSeeds(value.seeds),
     budgetPerArmPerSeed: normalizeEffectBudget(value.budgetPerArmPerSeed),
     costPhases: normalizeStringArray(value.costPhases, "costPhases"),
-    minimumScoreDelta: finite(value.minimumScoreDelta, "minimumScoreDelta"),
+    ...(legacy
+      ? {
+          minimumScoreDelta: finite(
+            value.minimumScoreDelta,
+            "minimumScoreDelta",
+          ),
+        }
+      : normalizeCompletionPolicy(value)),
     bootstrapSamples: 1_000,
     equalBudget: true,
     promotionAuthority: false,
@@ -284,12 +352,58 @@ export function verifyPmExplorationEffectPlan(value) {
     throw new TypeError("PM effect plan cost phases are invalid");
   }
   const planDigest = digest(value.planDigest, "planDigest");
-  if (planDigest !== hash(PM_EXPLORATION_EFFECT_PLAN_SCHEMA, core)) {
+  if (planDigest !== hash(value.schema, core)) {
     throw new Error("PM effect plan digest mismatch");
   }
   return deepFreeze({ ...core, planDigest });
 }
 
+function normalizeCompletionPolicy(value) {
+  const minimumIndependentGroups = integer(
+    value.minimumIndependentGroups,
+    "minimumIndependentGroups",
+    10_000,
+  );
+  if (
+    minimumIndependentGroups < 2 ||
+    value.primaryMetric !== PRIMARY_METRIC ||
+    value.resamplingUnit !== RESAMPLING_UNIT ||
+    !Array.isArray(value.taskGroups) ||
+    value.taskGroups.length !== value.testTaskIds.length
+  ) {
+    throw new TypeError("PM completion policy or task groups are invalid");
+  }
+  const taskGroups = value.taskGroups.map((task, index) => {
+    exact(task, ["taskId", "groupKeys"], "PM effect task group");
+    const groupKeys = normalizeStringArray(
+      task.groupKeys,
+      "PM effect groupKeys",
+    );
+    if (
+      task.taskId !== value.testTaskIds[index] ||
+      groupKeys.length !== PREFIXES.length ||
+      groupKeys.some(
+        (key, groupIndex) =>
+          !key.startsWith(`${PREFIXES[groupIndex]}-`) ||
+          !GROUP_DIGEST.test(key.slice(PREFIXES[groupIndex].length + 1)),
+      )
+    ) {
+      throw new TypeError("PM effect task group binding is invalid");
+    }
+    return Object.freeze({ taskId: task.taskId, groupKeys });
+  });
+  return {
+    minimumPassRateDelta: finite(
+      value.minimumPassRateDelta,
+      "minimumPassRateDelta",
+    ),
+    minimumIndependentGroups,
+    taskGroups: Object.freeze(taskGroups),
+    primaryMetric: PRIMARY_METRIC,
+    resamplingUnit: RESAMPLING_UNIT,
+  };
+}
+
 function normalizeStringArray(value, label) {
   if (
     !Array.isArray(value) ||
@@ -335,6 +449,7 @@ function normalizeSeeds(value) {
  * per-seed budget and differ only by the two declared immutable artifacts.
  */
 export function buildPmExplorationEffectPlan(input) {
+  assertPlainData(input, "PM effect plan input");
   exact(
     input,
     [
@@ -351,7 +466,8 @@ export function buildPmExplorationEffectPlan(input) {
       "resetProtocolDigest",
       "seeds",
       "budgetPerArmPerSeed",
-      "minimumScoreDelta",
+      "minimumPassRateDelta",
+      "minimumIndependentGroups",
     ],
     "PM effect plan input",
   );
@@ -390,12 +506,18 @@ export function buildPmExplorationEffectPlan(input) {
     seeds,
     budgetPerArmPerSeed: normalizeEffectBudget(input.budgetPerArmPerSeed),
     costPhases: EFFECT_PHASES,
-    minimumScoreDelta: finite(input.minimumScoreDelta, "minimumScoreDelta"),
+    minimumPassRateDelta: input.minimumPassRateDelta,
+    minimumIndependentGroups: input.minimumIndependentGroups,
+    taskGroups: suite.tasks
+      .filter((task) => task.split === "test")
+      .map((task) => ({ taskId: task.id, groupKeys: task.groupKeys })),
+    primaryMetric: PRIMARY_METRIC,
+    resamplingUnit: RESAMPLING_UNIT,
     bootstrapSamples: 1_000,
     equalBudget: true,
     promotionAuthority: false,
   };
-  return deepFreeze({
+  return verifyPmExplorationEffectPlan({
     ...core,
     planDigest: hash(PM_EXPLORATION_EFFECT_PLAN_SCHEMA, core),
   });
@@ -447,7 +569,7 @@ function normalizePhases(value, label) {
   );
 }
 
-function normalizeArm(value, label) {
+function normalizeArm(value, label, legacy) {
   exact(
     value,
     [
@@ -464,19 +586,36 @@ function normalizeArm(value, label) {
   );
   if (
     typeof value.passed !== "boolean" ||
-    !FAILURE_CLASSES.has(value.failureClass)
+    !(legacy ? FAILURE_CLASSES : COMPLETION_FAILURE_CLASSES).has(
+      value.failureClass,
+    )
   ) {
     throw new TypeError(`${label} result fields are invalid`);
   }
+  if (
+    !legacy &&
+    value.passed &&
+    (value.score !== 1 ||
+      value.failureClass !== "none" ||
+      value.securityViolations !== 0 ||
+      value.permissionViolations !== 0)
+  ) {
+    throw new TypeError(`${label} passed requires a complete, safe outcome`);
+  }
+  const ungradedFailure =
+    !legacy &&
+    value.graderReceiptDigest === null &&
+    value.passed === false &&
+    value.score === 0 &&
+    value.failureClass !== "none";
   return Object.freeze({
     outcomeReceiptDigest: digest(
       value.outcomeReceiptDigest,
       `${label} outcomeReceiptDigest`,
     ),
-    graderReceiptDigest: digest(
-      value.graderReceiptDigest,
-      `${label} graderReceiptDigest`,
-    ),
+    graderReceiptDigest: ungradedFailure
+      ? null
+      : digest(value.graderReceiptDigest, `${label} graderReceiptDigest`),
     score: finite(value.score, `${label} score`),
     passed: value.passed,
     usage: normalizeUsage(value.usage, `${label} usage`),
@@ -492,11 +631,11 @@ function normalizeArm(value, label) {
   });
 }
 
-function addUsage(target, usage) {
-  target.tokens += usage.tokens;
-  target.toolCalls += usage.toolCalls;
-  target.wallClockMs += usage.wallClockMs;
-  target.costMicrounits += usage.costMicrounits;
+function addUsage(target, usage, strict = false) {
+  for (const key of Object.keys(target)) {
+    target[key] += usage[key];
+    if (strict) integer(target[key], `PM effect total ${key}`);
+  }
 }
 
 function emptyUsage() {
@@ -535,20 +674,35 @@ function prngFromDigest(value) {
   };
 }
 
-function armTotals(runs, arm) {
+function armTotals(runs, arm, legacy) {
   const usage = emptyUsage();
   let securityViolations = 0;
   let permissionViolations = 0;
   let passCount = 0;
+  const failureCounts = Object.fromEntries(
+    [...COMPLETION_FAILURE_CLASSES]
+      .filter((key) => key !== "none")
+      .concat("incomplete")
+      .map((key) => [key, 0]),
+  );
   const scores = [];
   for (const run of runs) {
-    for (const phase of run.phases[arm]) addUsage(usage, phase.usage);
+    for (const phase of run.phases[arm]) addUsage(usage, phase.usage, !legacy);
     for (const item of run.cases) {
       const result = item[arm];
-      addUsage(usage, result.usage);
+      addUsage(usage, result.usage, !legacy);
       securityViolations += result.securityViolations;
       permissionViolations += result.permissionViolations;
+      if (!legacy) {
+        integer(securityViolations, "PM effect total securityViolations");
+        integer(permissionViolations, "PM effect total permissionViolations");
+      }
       passCount += result.passed ? 1 : 0;
+      if (!result.passed) {
+        failureCounts[
+          result.failureClass === "none" ? "incomplete" : result.failureClass
+        ] += 1;
+      }
       scores.push(result.score);
     }
   }
@@ -560,9 +714,119 @@ function armTotals(runs, arm) {
     usage: Object.freeze(usage),
     securityViolations,
     permissionViolations,
+    ...(!legacy
+      ? {
+          failureCount: scores.length - passCount,
+          failureCounts: Object.freeze(failureCounts),
+        }
+      : {}),
+  });
+}
+
+// Shared template/project/principal/time-window keys form transitive clusters.
+// All seeds of a task stay together; repeated samples never add independent units.
+function completionGroups(plan) {
+  const parents = plan.taskGroups.map((_, index) => index);
+  const find = (index) => {
+    while (parents[index] !== index) {
+      parents[index] = parents[parents[index]];
+      index = parents[index];
+    }
+    return index;
+  };
+  const owners = new Map();
+  plan.taskGroups.forEach((task, index) => {
+    for (const key of task.groupKeys) {
+      if (owners.has(key)) parents[find(index)] = find(owners.get(key));
+      else owners.set(key, index);
+    }
+  });
+  const groups = new Map();
+  plan.taskGroups.forEach((task, index) => {
+    const root = find(index);
+    if (!groups.has(root)) groups.set(root, []);
+    groups.get(root).push(index);
+  });
+  return [...groups.values()];
+}
+
+/** Planning diagnostics only; this neither launches nor authenticates a run. */
+export function inspectPmExplorationEffectPlan(value) {
+  const plan = verifyPmExplorationEffectPlan(value);
+  if (plan.schema !== PM_EXPLORATION_EFFECT_PLAN_SCHEMA) {
+    throw new TypeError("PM completion diagnostics require an effect plan v2");
+  }
+  const groups = completionGroups(plan).map((indices) =>
+    indices.map((index) => plan.taskGroups[index].taskId),
+  );
+  const groupCountSatisfied = groups.length >= plan.minimumIndependentGroups;
+  return deepFreeze({
+    schema: "chainlesschain.pm-exploration-effect-plan-inspection/v1",
+    planDigest: plan.planDigest,
+    status: groupCountSatisfied
+      ? "group-count-satisfied"
+      : "insufficient-independent-groups",
+    testTaskCount: plan.testTaskIds.length,
+    plannedRunCount: plan.seeds.length,
+    plannedPairedObservationCount: plan.testTaskIds.length * plan.seeds.length,
+    plannedArmObservationCount: 2 * plan.testTaskIds.length * plan.seeds.length,
+    independentGroupCount: groups.length,
+    minimumIndependentGroups: plan.minimumIndependentGroups,
+    independentGroups: groups,
+    runtimeVerified: false,
+    evidenceAuthenticated: false,
+    qualifiesForPromotion: false,
   });
 }
 
+function clusteredDeltas(plan, perTask) {
+  const groups = completionGroups(plan).map((indices) =>
+    indices.map((index) => perTask[index]),
+  );
+  const totals = groups.map((group) => ({
+    taskCount: group.length,
+    score: group.reduce((sum, task) => sum + task.scoreDelta, 0),
+    passRate: group.reduce((sum, task) => sum + task.passRateDelta, 0),
+  }));
+  // Use the frozen grouping as the random seed: adding identical seed repeats
+  // must not narrow the interval through either pseudoreplication or RNG drift.
+  const random = prngFromDigest(hash(RESAMPLING_UNIT, plan.taskGroups));
+  const scoreSamples = [];
+  const passSamples = [];
+  for (let sample = 0; sample < plan.bootstrapSamples; sample += 1) {
+    let count = 0;
+    let score = 0;
+    let passRate = 0;
+    for (let index = 0; index < totals.length; index += 1) {
+      const selected = totals[Math.floor(random() * totals.length)];
+      count += selected.taskCount;
+      score += selected.score;
+      passRate += selected.passRate;
+    }
+    scoreSamples.push(score / count);
+    passSamples.push(passRate / count);
+  }
+  const summarize = (samples, key) => {
+    samples.sort((left, right) => left - right);
+    return Object.freeze({
+      mean: mean(perTask.map((task) => task[key])),
+      // A single cluster cannot estimate between-cluster uncertainty.
+      bootstrap95Ci:
+        groups.length < 2
+          ? null
+          : Object.freeze([
+              percentile(samples, 0.025),
+              percentile(samples, 0.975),
+            ]),
+    });
+  };
+  return {
+    independentGroupCount: groups.length,
+    pairedScoreDelta: summarize(scoreSamples, "scoreDelta"),
+    pairedPassRateDelta: summarize(passSamples, "passRateDelta"),
+  };
+}
+
 /**
  * Recomputes a complete paired PM effect report. It is deliberately not a
  * promotion receipt; an independent signed Eval Gate/Pilot decision remains
@@ -570,6 +834,8 @@ function armTotals(runs, arm) {
  */
 export function buildPmExplorationEffectReport({ plan, runs } = {}) {
   const verifiedPlan = verifyPmExplorationEffectPlan(plan);
+  const legacy = verifiedPlan.schema === LEGACY_EFFECT_PLAN_SCHEMA;
+  assertPlainData(runs, "PM effect runs");
   if (
     !Array.isArray(runs) ||
     isProxy(runs) ||
@@ -581,6 +847,7 @@ export function buildPmExplorationEffectReport({ plan, runs } = {}) {
   }
   const expectedTasks = new Set(verifiedPlan.testTaskIds);
   const seenSeeds = new Set();
+  const seenRunIds = new Set();
   const normalizedRuns = runs.map((run, runIndex) => {
     exact(
       run,
@@ -598,6 +865,11 @@ export function buildPmExplorationEffectReport({ plan, runs } = {}) {
       );
     }
     seenSeeds.add(seed);
+    const runId = boundedString(run.runId, `PM effect run ${runIndex} runId`);
+    if (!legacy && seenRunIds.has(runId)) {
+      throw new TypeError("PM effect runId is duplicated");
+    }
+    seenRunIds.add(runId);
     exact(
       run.phases,
       ["baseline", "candidate"],
@@ -640,10 +912,15 @@ export function buildPmExplorationEffectReport({ plan, runs } = {}) {
       seenTasks.add(taskId);
       return Object.freeze({
         taskId,
-        baseline: normalizeArm(item.baseline, `PM effect ${taskId} baseline`),
+        baseline: normalizeArm(
+          item.baseline,
+          `PM effect ${taskId} baseline`,
+          legacy,
+        ),
         candidate: normalizeArm(
           item.candidate,
           `PM effect ${taskId} candidate`,
+          legacy,
         ),
       });
     });
@@ -651,14 +928,14 @@ export function buildPmExplorationEffectReport({ plan, runs } = {}) {
     const budgetViolations = [];
     for (const arm of ["baseline", "candidate"]) {
       const usage = emptyUsage();
-      for (const phase of phases[arm]) addUsage(usage, phase.usage);
-      for (const item of cases) addUsage(usage, item[arm].usage);
+      for (const phase of phases[arm]) addUsage(usage, phase.usage, !legacy);
+      for (const item of cases) addUsage(usage, item[arm].usage, !legacy);
       if (exceedsBudget(usage, verifiedPlan.budgetPerArmPerSeed)) {
         budgetViolations.push(arm);
       }
     }
     return Object.freeze({
-      runId: boundedString(run.runId, `PM effect run ${runIndex} runId`),
+      runId,
       seed,
       phases,
       cases: Object.freeze(cases),
@@ -674,16 +951,18 @@ export function buildPmExplorationEffectReport({ plan, runs } = {}) {
     run.cases.map((item) => item.candidate.score - item.baseline.score),
   );
   const random = prngFromDigest(verifiedPlan.planDigest);
-  const bootstrap = Array.from({ length: verifiedPlan.bootstrapSamples }, () =>
-    mean(
-      Array.from(
-        { length: deltas.length },
-        () => deltas[Math.floor(random() * deltas.length)],
-      ),
-    ),
-  ).sort((left, right) => left - right);
-  const baseline = armTotals(normalizedRuns, "baseline");
-  const candidate = armTotals(normalizedRuns, "candidate");
+  const bootstrap = legacy
+    ? Array.from({ length: verifiedPlan.bootstrapSamples }, () =>
+        mean(
+          Array.from(
+            { length: deltas.length },
+            () => deltas[Math.floor(random() * deltas.length)],
+          ),
+        ),
+      ).sort((left, right) => left - right)
+    : null;
+  const baseline = armTotals(normalizedRuns, "baseline", legacy);
+  const candidate = armTotals(normalizedRuns, "candidate", legacy);
   const perTask = Object.freeze(
     verifiedPlan.testTaskIds.map((taskId) => {
       const observations = normalizedRuns.map((run) =>
@@ -705,27 +984,50 @@ export function buildPmExplorationEffectReport({ plan, runs } = {}) {
         scoreDelta: mean(candidateScores) - mean(baselineScores),
         baselinePassRate,
         candidatePassRate,
+        ...(!legacy
+          ? { passRateDelta: candidatePassRate - baselinePassRate }
+          : {}),
       });
     }),
   );
-  const pairedScoreDelta = Object.freeze({
-    mean: mean(deltas),
-    bootstrap95Ci: Object.freeze([
-      percentile(bootstrap, 0.025),
-      percentile(bootstrap, 0.975),
-    ]),
-  });
+  const completion = legacy ? null : clusteredDeltas(verifiedPlan, perTask);
+  const pairedScoreDelta = legacy
+    ? Object.freeze({
+        mean: mean(deltas),
+        bootstrap95Ci: Object.freeze([
+          percentile(bootstrap, 0.025),
+          percentile(bootstrap, 0.975),
+        ]),
+      })
+    : completion.pairedScoreDelta;
   const budgetViolationCount = normalizedRuns.reduce(
     (sum, run) => sum + run.budgetViolations.length,
     0,
   );
-  const thresholdMet =
+  const safetyAndBudgetSatisfied =
     budgetViolationCount === 0 &&
     candidate.securityViolations === 0 &&
     candidate.permissionViolations === 0 &&
-    pairedScoreDelta.bootstrap95Ci[0] >= verifiedPlan.minimumScoreDelta;
+    (legacy ||
+      (baseline.securityViolations === 0 &&
+        baseline.permissionViolations === 0));
+  const thresholdMet =
+    safetyAndBudgetSatisfied &&
+    (legacy
+      ? pairedScoreDelta.bootstrap95Ci[0] >= verifiedPlan.minimumScoreDelta
+      : completion.independentGroupCount >=
+          verifiedPlan.minimumIndependentGroups &&
+        completion.pairedPassRateDelta.mean > 0 &&
+        completion.pairedPassRateDelta.bootstrap95Ci[0] >=
+          verifiedPlan.minimumPassRateDelta);
+  const insufficient =
+    !legacy &&
+    safetyAndBudgetSatisfied &&
+    completion.independentGroupCount < verifiedPlan.minimumIndependentGroups;
   const core = {
-    schema: PM_EXPLORATION_EFFECT_REPORT_SCHEMA,
+    schema: legacy
+      ? LEGACY_EFFECT_REPORT_SCHEMA
+      : PM_EXPLORATION_EFFECT_REPORT_SCHEMA,
     planDigest: verifiedPlan.planDigest,
     runCount: normalizedRuns.length,
     pairedObservationCount: deltas.length,
@@ -733,25 +1035,41 @@ export function buildPmExplorationEffectReport({ plan, runs } = {}) {
     candidate,
     perTask,
     pairedScoreDelta,
+    ...(!legacy
+      ? {
+          primaryMetric: PRIMARY_METRIC,
+          resamplingUnit: RESAMPLING_UNIT,
+          independentGroupCount: completion.independentGroupCount,
+          pairedPassRateDelta: completion.pairedPassRateDelta,
+        }
+      : {}),
     budgetViolationCount,
-    evidenceDecision: thresholdMet ? "threshold-met" : "threshold-not-met",
+    evidenceDecision: insufficient
+      ? "insufficient-evidence"
+      : thresholdMet
+        ? "threshold-met"
+        : "threshold-not-met",
     requiresIndependentPilotApproval: true,
     qualifiesForPromotion: false,
     runs: Object.freeze(normalizedRuns),
   };
   return deepFreeze({
     ...core,
-    reportDigest: hash(PM_EXPLORATION_EFFECT_REPORT_SCHEMA, core),
+    reportDigest: hash(core.schema, core),
   });
 }
 
 export function verifyPmExplorationEffectReport({ plan, report } = {}) {
   const verifiedPlan = verifyPmExplorationEffectPlan(plan);
+  const legacy = verifiedPlan.schema === LEGACY_EFFECT_PLAN_SCHEMA;
   if (!report || typeof report !== "object" || isProxy(report)) {
     throw new TypeError("a canonical PM effect report is required");
   }
   assertPlainData(report, "PM effect report");
-  if (report.schema !== PM_EXPLORATION_EFFECT_REPORT_SCHEMA) {
+  if (
+    report.schema !==
+    (legacy ? LEGACY_EFFECT_REPORT_SCHEMA : PM_EXPLORATION_EFFECT_REPORT_SCHEMA)
+  ) {
     throw new TypeError("a canonical PM effect report is required");
   }
   exact(
@@ -765,6 +1083,14 @@ export function verifyPmExplorationEffectReport({ plan, report } = {}) {
       "candidate",
       "perTask",
       "pairedScoreDelta",
+      ...(!legacy
+        ? [
+            "primaryMetric",
+            "resamplingUnit",
+            "independentGroupCount",
+            "pairedPassRateDelta",
+          ]
+        : []),
       "budgetViolationCount",
       "evidenceDecision",
       "requiresIndependentPilotApproval",
@@ -805,6 +1131,1645 @@ export function verifyPmExplorationEffectReport({ plan, report } = {}) {
   return recreated;
 }
 
+function snapshotEffectEvidence(value, label) {
+  assertPlainData(value, label);
+  const serialized = canonical(value);
+  if (Buffer.byteLength(serialized, "utf8") > 16 * 1024 * 1024) {
+    throw new TypeError(`${label} exceeds the 16 MiB limit`);
+  }
+  return deepFreeze(JSON.parse(serialized));
+}
+
+function effectUsageFromEval(row) {
+  const usage = {
+    tokens: row.metrics.tokens,
+    toolCalls: row.metrics.toolCalls,
+    wallClockMs: row.metrics.latencyMs,
+    costMicrounits: row.metrics.costMicrounits,
+  };
+  return {
+    // The execution receipt is the signed source of these metrics. This is not
+    // a claim to have re-read a provider settlement or a separate usage receipt.
+    receiptDigest: Object.values(usage).some((amount) => amount > 0)
+      ? row.executionDigest
+      : null,
+    ...usage,
+  };
+}
+
+function effectArmFromEval(row) {
+  const failureClass =
+    row.permissionViolations > 0
+      ? "permission"
+      : row.securityViolations > 0 || (!row.pass && row.metrics.errors > 0)
+        ? "unknown"
+        : "none";
+  return {
+    outcomeReceiptDigest: row.executionDigest,
+    graderReceiptDigest: row.gradeDigest,
+    score: row.qualityScore,
+    passed: row.pass && row.qualityScore === 1 && failureClass === "none",
+    usage: effectUsageFromEval(row),
+    securityViolations: row.securityViolations,
+    permissionViolations: row.permissionViolations,
+    failureClass,
+  };
+}
+
+/**
+ * Authenticate only the provider token count and estimated USD cost for
+ * independently registered preparation requests. This does not establish that
+ * the registry contains every request, or authenticate tools and elapsed time.
+ */
+export function buildPmExplorationPreparationProviderEvidence(
+  adapter,
+  input,
+  expected,
+) {
+  const store = capturePmExplorationProviderSettlementStore(adapter);
+  const source = snapshotEffectEvidence(
+    input,
+    "PM preparation provider source",
+  );
+  const registered = snapshotEffectEvidence(
+    expected,
+    "PM preparation provider registered requests",
+  );
+  exact(
+    source,
+    ["plan", "phaseUsage", "settlements"],
+    "PM preparation provider source",
+  );
+  exact(
+    registered,
+    ["planDigest", "descriptorDigest", "requests"],
+    "PM preparation provider registered requests",
+  );
+  const plan = verifyPmExplorationEffectPlan(source.plan);
+  if (
+    plan.schema !== PM_EXPLORATION_EFFECT_PLAN_SCHEMA ||
+    plan.planDigest !== registered.planDigest ||
+    store.inspect().descriptorDigest !== registered.descriptorDigest
+  ) {
+    throw new Error(
+      "PM preparation provider registration differs from plan or store",
+    );
+  }
+  if (
+    !Array.isArray(source.phaseUsage) ||
+    source.phaseUsage.length !== plan.seeds.length ||
+    !Array.isArray(source.settlements) ||
+    !Array.isArray(registered.requests) ||
+    source.settlements.length === 0 ||
+    source.settlements.length !== registered.requests.length
+  ) {
+    throw new TypeError("PM preparation provider evidence coverage is invalid");
+  }
+  const preparation = new Map();
+  for (const entry of source.phaseUsage) {
+    exact(entry, ["seed", "baseline", "candidate"], "PM preparation usage");
+    if (!plan.seeds.includes(entry.seed) || preparation.has(entry.seed))
+      throw new TypeError("PM preparation usage seed is absent or duplicated");
+    preparation.set(entry.seed, {
+      baseline: normalizePhases(entry.baseline, "PM baseline preparation"),
+      candidate: normalizePhases(entry.candidate, "PM candidate preparation"),
+    });
+  }
+  const registrations = new Map();
+  const requestDigests = new Set();
+  for (const entry of registered.requests) {
+    exact(
+      entry,
+      [
+        "seed",
+        "arm",
+        "phase",
+        "operationId",
+        "executionRequestDigest",
+        "requestDigest",
+      ],
+      "PM preparation provider request",
+    );
+    if (
+      !plan.seeds.includes(entry.seed) ||
+      !["baseline", "candidate"].includes(entry.arm) ||
+      !EFFECT_PHASES.includes(entry.phase)
+    ) {
+      throw new TypeError(
+        "PM preparation provider request has invalid coordinates",
+      );
+    }
+    const executionDigest = digest(
+      entry.executionRequestDigest,
+      "PM preparation execution request digest",
+    );
+    digest(entry.requestDigest, "PM preparation provider request digest");
+    if (
+      typeof entry.operationId !== "string" ||
+      !entry.operationId ||
+      entry.operationId.length > 256 ||
+      requestDigests.has(executionDigest)
+    ) {
+      throw new TypeError(
+        "PM preparation provider request is duplicated or invalid",
+      );
+    }
+    requestDigests.add(executionDigest);
+    registrations.set(executionDigest, entry);
+  }
+  const seen = new Set();
+  const totals = new Map();
+  const entries = [];
+  for (const entry of source.settlements) {
+    exact(
+      entry,
+      ["seed", "arm", "phase", "settlement", "persistence"],
+      "PM preparation provider settlement",
+    );
+    const settlement = entry.settlement;
+    const registeredRequest = registrations.get(
+      settlement?.executionRequestDigest,
+    );
+    if (
+      !registeredRequest ||
+      registeredRequest.seed !== entry.seed ||
+      registeredRequest.arm !== entry.arm ||
+      registeredRequest.phase !== entry.phase ||
+      registeredRequest.operationId !== settlement.operationId ||
+      registeredRequest.requestDigest !== settlement.requestDigest ||
+      seen.has(settlement.executionRequestDigest)
+    ) {
+      throw new Error(
+        "PM preparation settlement lacks unique registered request binding",
+      );
+    }
+    store.verifySettlementPersistence(settlement, entry.persistence);
+    seen.add(settlement.executionRequestDigest);
+    const key = `${entry.seed}\0${entry.arm}\0${entry.phase}`;
+    const previous = totals.get(key) ?? { tokens: 0, estimatedUsd: 0 };
+    const tokens = previous.tokens + settlement.usage.totalTokens;
+    const estimatedUsd = previous.estimatedUsd + settlement.estimatedCost.total;
+    if (!Number.isSafeInteger(tokens) || !Number.isFinite(estimatedUsd))
+      throw new TypeError(
+        "PM preparation provider totals exceed numeric bounds",
+      );
+    totals.set(key, { tokens, estimatedUsd });
+    entries.push({
+      seed: entry.seed,
+      arm: entry.arm,
+      phase: entry.phase,
+      executionRequestDigest: settlement.executionRequestDigest,
+      settlementDigest: settlement.settlementDigest,
+      durableRecordDigest: entry.persistence.recordDigest,
+      tokens: settlement.usage.totalTokens,
+      estimatedUsd: settlement.estimatedCost.total,
+    });
+  }
+  if (seen.size !== registrations.size)
+    throw new Error(
+      "PM preparation provider registration is not fully covered",
+    );
+  const phaseTotals = [];
+  for (const seed of plan.seeds) {
+    for (const arm of ["baseline", "candidate"]) {
+      for (const { phase, usage } of preparation.get(seed)[arm]) {
+        const total = totals.get(`${seed}\0${arm}\0${phase}`);
+        if (!total) continue;
+        // Round upward: the integer micro-USD comparison must never understate
+        // the provider's independently re-read estimated dollar amount.
+        const costMicrounitsUpperBound = Math.ceil(total.estimatedUsd * 1e6);
+        if (
+          !Number.isSafeInteger(costMicrounitsUpperBound) ||
+          total.tokens > usage.tokens ||
+          costMicrounitsUpperBound > usage.costMicrounits
+        ) {
+          throw new Error(
+            "PM preparation provider cost exceeds declared phase usage",
+          );
+        }
+        phaseTotals.push({
+          seed,
+          arm,
+          phase,
+          tokens: total.tokens,
+          estimatedUsd: total.estimatedUsd,
+          costMicrounitsUpperBound,
+        });
+      }
+    }
+  }
+  const core = {
+    schema: PM_EXPLORATION_PREPARATION_PROVIDER_EVIDENCE_SCHEMA,
+    planDigest: plan.planDigest,
+    descriptorDigest: registered.descriptorDigest,
+    registeredRequestDigest: hash(
+      PREPARATION_PROVIDER_REQUESTS_SCHEMA,
+      registered.requests,
+    ),
+    phaseUsageDigest: hash(
+      "chainlesschain.pm-effect-preparation-usage/v1",
+      plan.seeds.map((seed) => ({ seed, ...preparation.get(seed) })),
+    ),
+    entries,
+    phaseTotals,
+    authenticationScope: "registered-provider-tokens-and-estimated-cost-only",
+    preparationEvidenceAuthenticated: false,
+    reportAuthenticated: false,
+  };
+  return deepFreeze({
+    ...core,
+    evidenceDigest: hash(core.schema, core),
+  });
+}
+
+export function verifyPmExplorationPreparationProviderEvidence(
+  adapter,
+  input,
+  expected,
+) {
+  exact(input, ["source", "evidence"], "PM preparation provider verification");
+  const evidence = snapshotEffectEvidence(
+    input.evidence,
+    "PM preparation provider evidence",
+  );
+  const recreated = buildPmExplorationPreparationProviderEvidence(
+    adapter,
+    input.source,
+    expected,
+  );
+  if (canonical(recreated) !== canonical(evidence))
+    throw new Error(
+      "PM preparation provider evidence differs from durable source",
+    );
+  return recreated;
+}
+
+/**
+ * Connect authenticated Eval Gate rows to the v2 statistics. Preparation usage
+ * remains caller-supplied, so the envelope can never certify a complete effect
+ * claim. `expected` is an independent, pre-registered host binding, not data to
+ * derive from the report being verified.
+ */
+export async function buildPmExplorationEffectEvidenceReport(
+  verifier,
+  input,
+  expected,
+) {
+  const source = snapshotEffectEvidence(input, "PM effect evidence source");
+  exact(
+    source,
+    ["plan", "suite", "policy", "receipt", "resultEvidence", "phaseUsage"],
+    "PM effect evidence source",
+  );
+  const registered = snapshotEffectEvidence(
+    expected,
+    "PM effect registered context",
+  );
+  exact(
+    registered,
+    ["planDigest", "targetMatrixRoot", "cellId", "runtimeId", "receiptContext"],
+    "PM effect registered context",
+  );
+  const { plan, context, evaluationContextDigest } =
+    verifyPmEffectSourceRegistration(source, registered);
+  return projectPmEffectEvidenceReport(
+    verifier,
+    source,
+    plan,
+    context,
+    evaluationContextDigest,
+  );
+}
+
+function verifyPmEffectSourceRegistration(source, registered) {
+  const plan = verifyPmExplorationEffectPlan(source.plan);
+  if (
+    plan.schema !== PM_EXPLORATION_EFFECT_PLAN_SCHEMA ||
+    plan.planDigest !== registered.planDigest
+  ) {
+    throw new Error("PM effect requires the registered v2 plan");
+  }
+  // Rebuild from the actual suite and policy; a self-consistent rehash of
+  // caller-invented task groups or a different seed list must not be enough.
+  const planInput = Object.fromEntries(
+    [
+      "experimentId",
+      "baselineVersion",
+      "candidateVersion",
+      "actorConfigDigest",
+      "modelConfigDigest",
+      "toolPolicyDigest",
+      "permissionPolicyDigest",
+      "environmentDigest",
+      "resetProtocolDigest",
+      "seeds",
+      "budgetPerArmPerSeed",
+      "minimumPassRateDelta",
+      "minimumIndependentGroups",
+    ].map((key) => [key, plan[key]]),
+  );
+  const reconstructed = buildPmExplorationEffectPlan({
+    ...planInput,
+    suite: source.suite,
+    policy: source.policy,
+  });
+  if (reconstructed.planDigest !== plan.planDigest) {
+    throw new Error("PM effect plan differs from its source suite or policy");
+  }
+  const context = registered.receiptContext;
+  const bindings = {
+    suiteDigest: plan.suiteDigest,
+    policyDigest: plan.policyDigest,
+    environmentDigest: plan.environmentDigest,
+    candidateId: plan.candidateVersion.artifactDigest,
+    baselineId: plan.baselineVersion.artifactDigest,
+  };
+  if (
+    !context ||
+    Object.entries(bindings).some(([key, value]) => context[key] !== value)
+  ) {
+    throw new Error(
+      "PM effect registered receipt context differs from its plan",
+    );
+  }
+  const evaluationContextDigest = computeEvolutionEvalContextDigest({
+    ...bindings,
+    planDigest: plan.planDigest,
+    tenantId: context.tenantId,
+    targetEnvironmentRef: context.targetEnvironmentRef,
+    evaluationAuthorityRoot: context.evaluationAuthorityRoot,
+    targetMatrixRoot: registered.targetMatrixRoot,
+    cellId: registered.cellId,
+    runtimeId: registered.runtimeId,
+  });
+  if (evaluationContextDigest !== context.evaluationContextDigest) {
+    throw new Error(
+      "PM effect evaluation context does not bind the registered plan",
+    );
+  }
+  return { plan, context, evaluationContextDigest };
+}
+
+async function projectPmEffectEvidenceReport(
+  verifier,
+  source,
+  plan,
+  context,
+  evaluationContextDigest,
+) {
+  if (
+    !Array.isArray(source.phaseUsage) ||
+    source.phaseUsage.length !== plan.seeds.length
+  ) {
+    throw new TypeError("PM effect preparation usage must cover every seed");
+  }
+  const preparation = new Map();
+  for (const entry of source.phaseUsage) {
+    exact(
+      entry,
+      ["seed", "baseline", "candidate"],
+      "PM effect preparation usage",
+    );
+    if (!plan.seeds.includes(entry.seed) || preparation.has(entry.seed)) {
+      throw new TypeError("PM effect preparation seed is absent or duplicated");
+    }
+    preparation.set(entry.seed, {
+      baseline: normalizePhases(entry.baseline, "PM baseline preparation"),
+      candidate: normalizePhases(entry.candidate, "PM candidate preparation"),
+    });
+  }
+  const evidence = await verifyEvolutionEvalResultEvidence(
+    verifier,
+    {
+      receipt: source.receipt,
+      resultEvidence: source.resultEvidence,
+      suite: source.suite,
+      policy: source.policy,
+    },
+    context,
+  );
+  const taskDigests = new Map(
+    source.suite.tasks
+      .filter((task) => task.split === "test")
+      .map((task) => [task.id, task.taskDigest]),
+  );
+  const indexed = Object.fromEntries(
+    ["baseline", "candidate"].map((arm) => [
+      arm,
+      new Map(
+        evidence.test[arm].map((row) => [
+          `${row.taskDigest}\0${row.seed}`,
+          row,
+        ]),
+      ),
+    ]),
+  );
+  const runs = plan.seeds.map((seed) => ({
+    // A deterministic grouping ID, not a claim of an additional execution.
+    runId: `pm-effect-${hash("chainlesschain.pm-effect-eval-seed/v1", { receiptDigest: source.receipt.receiptDigest, seed }).slice(7)}`,
+    seed,
+    phases: preparation.get(seed),
+    cases: plan.testTaskIds.map((taskId) => ({
+      taskId,
+      ...Object.fromEntries(
+        ["baseline", "candidate"].map((arm) => [
+          arm,
+          effectArmFromEval(
+            indexed[arm].get(`${taskDigests.get(taskId)}\0${seed}`),
+          ),
+        ]),
+      ),
+    })),
+  }));
+  const report = buildPmExplorationEffectReport({ plan, runs });
+  const validationUsage = plan.seeds.map((seed) => ({
+    seed,
+    ...Object.fromEntries(
+      ["baseline", "candidate"].map((arm) => {
+        const usage = emptyUsage();
+        for (const row of evidence.validation[arm]) {
+          if (row.seed === seed)
+            addUsage(usage, effectUsageFromEval(row), true);
+        }
+        return [arm, usage];
+      }),
+    ),
+  }));
+  const knownUsage = {
+    baseline: { ...report.baseline.usage },
+    candidate: { ...report.candidate.usage },
+  };
+  const knownBudgetViolations = [];
+  for (const [index, run] of report.runs.entries()) {
+    for (const arm of ["baseline", "candidate"]) {
+      const usage = { ...validationUsage[index][arm] };
+      addUsage(knownUsage[arm], usage, true);
+      for (const phase of run.phases[arm]) addUsage(usage, phase.usage, true);
+      for (const row of run.cases) addUsage(usage, row[arm].usage, true);
+      if (exceedsBudget(usage, plan.budgetPerArmPerSeed))
+        knownBudgetViolations.push({ seed: run.seed, arm });
+    }
+  }
+  const validationUnsafe = ["baseline", "candidate"].some((arm) =>
+    evidence.validation[arm].some(
+      (row) => row.securityViolations > 0 || row.permissionViolations > 0,
+    ),
+  );
+  const blockingReasons = ["preparation-costs-unverified"];
+  if (source.receipt.decision !== "accepted")
+    blockingReasons.push("source-eval-not-accepted");
+  if (knownBudgetViolations.length)
+    blockingReasons.push("known-budget-exceeded");
+  if (validationUnsafe) blockingReasons.push("validation-safety-violation");
+  if (report.evidenceDecision !== "threshold-met")
+    blockingReasons.push(
+      report.evidenceDecision === "threshold-not-met"
+        ? "statistical-threshold-not-met"
+        : "independent-groups-insufficient",
+    );
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_EVIDENCE_REPORT_SCHEMA,
+    planDigest: plan.planDigest,
+    sourceEvalRunId: source.receipt.runId,
+    sourceEvalDecision: source.receipt.decision,
+    sourceEvalReceiptDigest: source.receipt.receiptDigest,
+    sourceResultEvidenceDigest: evidence.evidenceDigest,
+    evaluationContextDigest,
+    phaseUsageDigest: hash(
+      "chainlesschain.pm-effect-preparation-usage/v1",
+      plan.seeds.map((seed) => ({ seed, ...preparation.get(seed) })),
+    ),
+    validationUsage,
+    knownUsage,
+    knownBudgetViolations,
+    testExecutionErrors: Object.fromEntries(
+      ["baseline", "candidate"].map((arm) => [
+        arm,
+        integer(
+          evidence.test[arm].reduce((sum, row) => sum + row.metrics.errors, 0),
+          "test execution errors",
+        ),
+      ]),
+    ),
+    report,
+    executionEvidenceAuthenticated: true,
+    preparationEvidenceAuthenticated: false,
+    reportAuthenticated: false,
+    evidenceDecision:
+      source.receipt.decision !== "accepted" ||
+      knownBudgetViolations.length > 0 ||
+      validationUnsafe ||
+      report.evidenceDecision === "threshold-not-met"
+        ? "threshold-not-met"
+        : "insufficient-evidence",
+    blockingReasons,
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  const result = deepFreeze({
+    ...core,
+    evidenceReportDigest: hash(core.schema, core),
+  });
+  // Projection/bootstrap work must not turn a receipt that expired since the
+  // row verification into a freshly authenticated returned report.
+  await verifyEvolutionEvalReceipt(verifier, source.receipt, context);
+  return result;
+}
+
+export async function verifyPmExplorationEffectEvidenceReport(
+  verifier,
+  input,
+  expected,
+) {
+  exact(input, ["source", "report"], "PM effect evidence report verification");
+  const report = snapshotEffectEvidence(
+    input.report,
+    "PM effect evidence report",
+  );
+  const recreated = await buildPmExplorationEffectEvidenceReport(
+    verifier,
+    input.source,
+    expected,
+  );
+  if (canonical(recreated) !== canonical(report)) {
+    throw new Error(
+      "PM effect evidence report does not match its authenticated source",
+    );
+  }
+  return recreated;
+}
+
+/**
+ * Preserve a signed, budget-interrupted attempt in the preregistered test
+ * denominator without inventing task outcomes or per-arm costs. Other thrown
+ * failures have no final signed receipt and cannot use this contract.
+ */
+export async function buildPmExplorationEffectInterruptedEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  const source = snapshotEffectEvidence(input, "PM interrupted effect source");
+  exact(
+    source,
+    ["plan", "suite", "policy", "receipt"],
+    "PM interrupted effect source",
+  );
+  const registered = snapshotEffectEvidence(
+    expected,
+    "PM interrupted effect registration",
+  );
+  exact(
+    registered,
+    ["planDigest", "targetMatrixRoot", "cellId", "runtimeId", "receiptContext"],
+    "PM interrupted effect registration",
+  );
+  const { plan, context, evaluationContextDigest } =
+    verifyPmEffectSourceRegistration(source, registered);
+  const receipt = source.receipt;
+  await verifyEvolutionEvalReceipt(verifier, receipt, context);
+  const splitCounts = Object.fromEntries(
+    ["training", "validation", "test"].map((split) => [
+      split,
+      source.suite.tasks.filter((task) => task.split === split).length,
+    ]),
+  );
+  const plannedTestObservationsPerArm =
+    plan.seeds.length * plan.testTaskIds.length;
+  const plannedExecutionCount =
+    (splitCounts.validation + splitCounts.test) * plan.seeds.length * 2;
+  if (
+    canonical(receipt.splitCounts) !== canonical(splitCounts) ||
+    receipt.decision !== "rejected" ||
+    canonical(receipt.reasonCodes) !== canonical(["total-budget-exceeded"]) ||
+    receipt.validation !== null ||
+    receipt.test !== null ||
+    !Number.isSafeInteger(plannedExecutionCount) ||
+    !Number.isSafeInteger(plannedTestObservationsPerArm) ||
+    receipt.usage.executionCount < 1 ||
+    receipt.usage.executionCount > plannedExecutionCount
+  ) {
+    throw new Error(
+      "PM interrupted effect requires a signed partial budget rejection",
+    );
+  }
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_INTERRUPTED_EVIDENCE_SCHEMA,
+    planDigest: plan.planDigest,
+    sourceEvalRunId: receipt.runId,
+    sourceEvalReceiptDigest: receipt.receiptDigest,
+    evaluationContextDigest,
+    interruptionReason: "total-budget-exceeded",
+    plannedExecutionCount,
+    signedExecutionCount: receipt.usage.executionCount,
+    plannedTestObservationsPerArm,
+    authenticatedTestOutcomesPerArm: 0,
+    unresolvedTestObservationsPerArm: plannedTestObservationsPerArm,
+    aggregateSignedUsage: receipt.usage,
+    outcomeAvailability: "unavailable",
+    denominatorTreatment: "unresolved-blocks-promotion",
+    statisticalEstimateAvailable: false,
+    evidenceDecision: "threshold-not-met",
+    blockingReasons: [
+      "source-eval-budget-exceeded",
+      "test-outcomes-unavailable",
+    ],
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  const evidence = deepFreeze({
+    ...core,
+    interruptedEvidenceDigest: hash(core.schema, core),
+  });
+  await verifyEvolutionEvalReceipt(verifier, receipt, context);
+  return evidence;
+}
+
+export async function verifyPmExplorationEffectInterruptedEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  exact(input, ["source", "evidence"], "PM interrupted effect verification");
+  const evidence = snapshotEffectEvidence(
+    input.evidence,
+    "PM interrupted effect evidence",
+  );
+  const recreated = await buildPmExplorationEffectInterruptedEvidence(
+    verifier,
+    input.source,
+    expected,
+  );
+  if (canonical(recreated) !== canonical(evidence))
+    throw new Error(
+      "PM interrupted effect evidence differs from signed source",
+    );
+  return recreated;
+}
+
+/** A signed post-execution runtime rejection leaves every test outcome unresolved. */
+export async function buildPmExplorationEffectRuntimeFailureEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  const source = snapshotEffectEvidence(input, "PM runtime failure source");
+  exact(
+    source,
+    ["plan", "suite", "policy", "receipt"],
+    "PM runtime failure source",
+  );
+  const registered = snapshotEffectEvidence(
+    expected,
+    "PM runtime failure registration",
+  );
+  exact(
+    registered,
+    ["planDigest", "targetMatrixRoot", "cellId", "runtimeId", "receiptContext"],
+    "PM runtime failure registration",
+  );
+  const { plan, context, evaluationContextDigest } =
+    verifyPmEffectSourceRegistration(source, registered);
+  const receipt = source.receipt;
+  await verifyEvolutionEvalReceipt(verifier, receipt, context);
+  const splitCounts = Object.fromEntries(
+    ["training", "validation", "test"].map((split) => [
+      split,
+      source.suite.tasks.filter((task) => task.split === split).length,
+    ]),
+  );
+  const plannedTestObservationsPerArm =
+    plan.seeds.length * plan.testTaskIds.length;
+  const plannedExecutionCount =
+    (splitCounts.validation + splitCounts.test) * plan.seeds.length * 2;
+  const failureReason = receipt.reasonCodes?.[0];
+  if (
+    canonical(receipt.splitCounts) !== canonical(splitCounts) ||
+    receipt.decision !== "rejected" ||
+    receipt.reasonCodes?.length !== 1 ||
+    ![
+      "runtime-execution-failed",
+      "runtime-grader-failed",
+      "runtime-safety-failed",
+    ].includes(failureReason) ||
+    receipt.validation !== null ||
+    receipt.test !== null ||
+    !Number.isSafeInteger(plannedExecutionCount) ||
+    !Number.isSafeInteger(plannedTestObservationsPerArm) ||
+    receipt.usage.executionCount < 1 ||
+    receipt.usage.executionCount > plannedExecutionCount
+  ) {
+    throw new Error(
+      "PM runtime failure requires a signed post-execution rejection",
+    );
+  }
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_RUNTIME_FAILURE_EVIDENCE_SCHEMA,
+    planDigest: plan.planDigest,
+    sourceEvalRunId: receipt.runId,
+    sourceEvalReceiptDigest: receipt.receiptDigest,
+    evaluationContextDigest,
+    failureReason,
+    plannedExecutionCount,
+    signedExecutionCount: receipt.usage.executionCount,
+    plannedTestObservationsPerArm,
+    authenticatedTestOutcomesPerArm: 0,
+    unresolvedTestObservationsPerArm: plannedTestObservationsPerArm,
+    aggregateSignedUsage: receipt.usage,
+    outcomeAvailability: "unavailable",
+    denominatorTreatment: "unresolved-blocks-promotion",
+    statisticalEstimateAvailable: false,
+    evidenceDecision: "threshold-not-met",
+    blockingReasons: [
+      `source-eval-${failureReason}`,
+      "test-outcomes-unavailable",
+    ],
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  const evidence = deepFreeze({
+    ...core,
+    runtimeFailureEvidenceDigest: hash(core.schema, core),
+  });
+  await verifyEvolutionEvalReceipt(verifier, receipt, context);
+  return evidence;
+}
+
+export async function verifyPmExplorationEffectRuntimeFailureEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  exact(input, ["source", "evidence"], "PM runtime failure verification");
+  const evidence = snapshotEffectEvidence(
+    input.evidence,
+    "PM runtime failure evidence",
+  );
+  const recreated = await buildPmExplorationEffectRuntimeFailureEvidence(
+    verifier,
+    input.source,
+    expected,
+  );
+  if (canonical(recreated) !== canonical(evidence))
+    throw new Error("PM runtime failure evidence differs from signed source");
+  return recreated;
+}
+
+/** Preserve a signed zero-execution preflight rejection without inventing outcomes. */
+export async function buildPmExplorationEffectPreflightRejectionEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  const source = snapshotEffectEvidence(input, "PM preflight rejection source");
+  exact(
+    source,
+    ["plan", "suite", "policy", "receipt"],
+    "PM preflight rejection source",
+  );
+  const registered = snapshotEffectEvidence(
+    expected,
+    "PM preflight rejection registration",
+  );
+  exact(
+    registered,
+    ["planDigest", "targetMatrixRoot", "cellId", "runtimeId", "receiptContext"],
+    "PM preflight rejection registration",
+  );
+  const { plan, context, evaluationContextDigest } =
+    verifyPmEffectSourceRegistration(source, registered);
+  const receipt = source.receipt;
+  await verifyEvolutionEvalReceipt(verifier, receipt, context);
+  const splitCounts = Object.fromEntries(
+    ["training", "validation", "test"].map((split) => [
+      split,
+      source.suite.tasks.filter((task) => task.split === split).length,
+    ]),
+  );
+  const plannedTestObservationsPerArm =
+    plan.seeds.length * plan.testTaskIds.length;
+  const plannedExecutionCount =
+    (splitCounts.validation + splitCounts.test) * plan.seeds.length * 2;
+  const insufficient = ["training", "validation", "test"]
+    .filter(
+      (split) =>
+        splitCounts[split] <
+        source.policy[`min${split[0].toUpperCase()}${split.slice(1)}Tasks`],
+    )
+    .map((split) => `insufficient-${split}`);
+  const expectedDecision = insufficient.length
+    ? "needs-more-evidence"
+    : "rejected";
+  const expectedReasons = insufficient.length
+    ? insufficient
+    : ["execution-budget-insufficient"];
+  const genuinePreflight =
+    insufficient.length > 0 ||
+    plannedExecutionCount > source.policy.maxExecutions;
+  if (
+    canonical(receipt.splitCounts) !== canonical(splitCounts) ||
+    !Number.isSafeInteger(plannedExecutionCount) ||
+    !Number.isSafeInteger(plannedTestObservationsPerArm) ||
+    !genuinePreflight ||
+    receipt.decision !== expectedDecision ||
+    canonical(receipt.reasonCodes) !== canonical(expectedReasons) ||
+    receipt.validation !== null ||
+    receipt.test !== null
+  ) {
+    throw new Error("PM preflight requires a signed zero-execution rejection");
+  }
+  exact(receipt.usage, SIGNED_EVAL_USAGE_FIELDS, "PM preflight signed usage");
+  if (SIGNED_EVAL_USAGE_FIELDS.some((field) => receipt.usage[field] !== 0)) {
+    throw new Error("PM preflight rejection cannot claim execution usage");
+  }
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_PREFLIGHT_REJECTION_EVIDENCE_SCHEMA,
+    planDigest: plan.planDigest,
+    sourceEvalRunId: receipt.runId,
+    sourceEvalReceiptDigest: receipt.receiptDigest,
+    evaluationContextDigest,
+    preflightDecision: receipt.decision,
+    preflightReasonCodes: receipt.reasonCodes,
+    plannedExecutionCount,
+    signedExecutionCount: 0,
+    plannedTestObservationsPerArm,
+    authenticatedTestOutcomesPerArm: 0,
+    unresolvedTestObservationsPerArm: plannedTestObservationsPerArm,
+    aggregateSignedUsage: receipt.usage,
+    outcomeAvailability: "unavailable",
+    denominatorTreatment: "unresolved-blocks-promotion",
+    statisticalEstimateAvailable: false,
+    evidenceDecision: "threshold-not-met",
+    blockingReasons: [
+      "source-eval-preflight-rejected",
+      "test-outcomes-unavailable",
+    ],
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  const evidence = deepFreeze({
+    ...core,
+    preflightRejectionEvidenceDigest: hash(core.schema, core),
+  });
+  await verifyEvolutionEvalReceipt(verifier, receipt, context);
+  return evidence;
+}
+
+export async function verifyPmExplorationEffectPreflightRejectionEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  exact(input, ["source", "evidence"], "PM preflight rejection verification");
+  const evidence = snapshotEffectEvidence(
+    input.evidence,
+    "PM preflight rejection evidence",
+  );
+  const recreated = await buildPmExplorationEffectPreflightRejectionEvidence(
+    verifier,
+    input.source,
+    expected,
+  );
+  if (canonical(recreated) !== canonical(evidence))
+    throw new Error("PM preflight rejection differs from signed source");
+  return recreated;
+}
+
+/** Freeze the intended cohort slots before collection; persist the digest in an independent host record. */
+export function buildPmExplorationEffectSlotManifest(input) {
+  const source = snapshotEffectEvidence(input, "PM effect slot manifest input");
+  exact(
+    source,
+    ["plan", "cohortId", "slotIds"],
+    "PM effect slot manifest input",
+  );
+  const plan = verifyPmExplorationEffectPlan(source.plan);
+  if (plan.schema !== PM_EXPLORATION_EFFECT_PLAN_SCHEMA)
+    throw new TypeError("PM effect slot manifest requires a v2 plan");
+  if (
+    !Array.isArray(source.slotIds) ||
+    source.slotIds.length === 0 ||
+    source.slotIds.length > 32
+  ) {
+    throw new TypeError("PM effect slot manifest requires 1-32 slots");
+  }
+  const slotIds = source.slotIds.map((value) =>
+    boundedString(value, "PM effect slot ID"),
+  );
+  if (new Set(slotIds).size !== slotIds.length)
+    throw new TypeError("PM effect slot manifest has duplicate slots");
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_SLOT_MANIFEST_SCHEMA,
+    planDigest: plan.planDigest,
+    cohortId: boundedString(source.cohortId, "PM effect cohort ID"),
+    slotIds,
+    plannedTestObservationsPerArm: integer(
+      slotIds.length * plan.seeds.length * plan.testTaskIds.length,
+      "PM effect slot manifest planned observations",
+    ),
+    promotionAuthority: false,
+  };
+  return deepFreeze({
+    ...core,
+    manifestDigest: hash(core.schema, core),
+  });
+}
+
+export function verifyPmExplorationEffectSlotManifest(input) {
+  exact(input, ["plan", "manifest"], "PM effect slot manifest verification");
+  const manifest = snapshotEffectEvidence(
+    input.manifest,
+    "PM effect slot manifest",
+  );
+  exact(
+    manifest,
+    [
+      "schema",
+      "planDigest",
+      "cohortId",
+      "slotIds",
+      "plannedTestObservationsPerArm",
+      "promotionAuthority",
+      "manifestDigest",
+    ],
+    "PM effect slot manifest",
+  );
+  const recreated = buildPmExplorationEffectSlotManifest({
+    plan: input.plan,
+    cohortId: manifest.cohortId,
+    slotIds: manifest.slotIds,
+  });
+  if (canonical(recreated) !== canonical(manifest))
+    throw new Error("PM effect slot manifest differs from its frozen plan");
+  return recreated;
+}
+
+/**
+ * Reconcile only the attempts named in an independent host slot manifest.
+ * A scheduled slot without a signed receipt is counted as unresolved, never
+ * as an authenticated launch. Cohort completeness and promotion remain false.
+ */
+export async function buildPmExplorationEffectAttemptCohort(
+  verifier,
+  input,
+  expected,
+) {
+  const source = snapshotEffectEvidence(input, "PM attempt cohort source");
+  const registered = snapshotEffectEvidence(
+    expected,
+    "PM attempt cohort registration",
+  );
+  exact(source, ["plan", "attempts"], "PM attempt cohort source");
+  exact(
+    registered,
+    ["cohortId", "planDigest", "slots"],
+    "PM attempt cohort registration",
+  );
+  const plan = verifyPmExplorationEffectPlan(source.plan);
+  if (
+    plan.schema !== PM_EXPLORATION_EFFECT_PLAN_SCHEMA ||
+    plan.planDigest !== registered.planDigest
+  ) {
+    throw new Error("PM attempt cohort requires the registered v2 plan");
+  }
+  if (
+    !Array.isArray(source.attempts) ||
+    !Array.isArray(registered.slots) ||
+    source.attempts.length === 0 ||
+    source.attempts.length > 32 ||
+    source.attempts.length !== registered.slots.length
+  ) {
+    throw new TypeError("PM attempt cohort must cover every registered slot");
+  }
+  const cohortId = boundedString(registered.cohortId, "PM cohortId");
+  const slots = new Map();
+  const registeredReceipts = new Set();
+  for (const slot of registered.slots) {
+    exact(
+      slot,
+      ["slotId", "receiptDigest", "context"],
+      "PM attempt cohort slot",
+    );
+    const slotId = boundedString(slot.slotId, "PM attempt slotId");
+    const receiptDigest =
+      slot.receiptDigest === null
+        ? null
+        : digest(slot.receiptDigest, "PM attempt receiptDigest");
+    if (
+      (receiptDigest === null && slot.context !== null) ||
+      (receiptDigest !== null && slot.context === null)
+    )
+      throw new Error("PM attempt slot receipt and context must agree");
+    if (
+      slots.has(slotId) ||
+      (receiptDigest !== null && registeredReceipts.has(receiptDigest))
+    )
+      throw new Error("PM attempt cohort registration is duplicated");
+    slots.set(slotId, slot);
+    if (receiptDigest !== null) registeredReceipts.add(receiptDigest);
+  }
+  const seen = new Set();
+  const runIds = new Set();
+  const attempts = [];
+  const perArmDenominator = integer(
+    plan.seeds.length * plan.testTaskIds.length * source.attempts.length,
+    "PM cohort per-arm denominator",
+  );
+  const totals = {
+    baseline: { authenticatedOutcomes: 0, verifiedPasses: 0, unresolved: 0 },
+    candidate: { authenticatedOutcomes: 0, verifiedPasses: 0, unresolved: 0 },
+  };
+  let budgetInterruptedCount = 0;
+  let runtimeFailedCount = 0;
+  let missingReceiptCount = 0;
+  let preflightRejectedCount = 0;
+  let failedCompleteCount = 0;
+  for (const attempt of source.attempts) {
+    exact(
+      attempt,
+      ["slotId", "kind", "source", "evidence"],
+      "PM attempt cohort entry",
+    );
+    const slotId = boundedString(attempt.slotId, "PM attempt slotId");
+    const slot = slots.get(slotId);
+    if (!slot || seen.has(slotId)) {
+      throw new Error("PM attempt cohort contains a foreign or duplicate slot");
+    }
+    seen.add(slotId);
+    if (attempt.kind === "receipt-unavailable") {
+      if (
+        slot.receiptDigest !== null ||
+        slot.context !== null ||
+        attempt.source !== null ||
+        attempt.evidence !== null
+      ) {
+        throw new Error("PM missing receipt slot has a substituted source");
+      }
+      missingReceiptCount += 1;
+      for (const arm of ["baseline", "candidate"]) {
+        totals[arm].unresolved = integer(
+          totals[arm].unresolved + plan.seeds.length * plan.testTaskIds.length,
+          "PM cohort unresolved outcomes",
+        );
+      }
+      attempts.push({
+        slotId,
+        kind: attempt.kind,
+        runId: null,
+        receiptDigest: null,
+        evidenceDigest: null,
+      });
+      continue;
+    }
+    if (
+      slot.receiptDigest === null ||
+      canonical(attempt.source?.plan) !== canonical(plan)
+    ) {
+      throw new Error("PM attempt cohort contains a foreign signed source");
+    }
+    let verified;
+    let evidenceDigest;
+    if (attempt.kind === "complete") {
+      verified = await verifyPmExplorationEffectEvidenceReport(
+        verifier,
+        { source: attempt.source, report: attempt.evidence },
+        slot.context,
+      );
+      evidenceDigest = verified.evidenceReportDigest;
+      if (verified.evidenceDecision === "threshold-not-met")
+        failedCompleteCount += 1;
+      for (const arm of ["baseline", "candidate"]) {
+        totals[arm].authenticatedOutcomes = integer(
+          totals[arm].authenticatedOutcomes + verified.report[arm].sampleCount,
+          "PM cohort authenticated outcomes",
+        );
+        totals[arm].verifiedPasses = integer(
+          totals[arm].verifiedPasses + verified.report[arm].passCount,
+          "PM cohort verified passes",
+        );
+      }
+    } else if (attempt.kind === "budget-interrupted") {
+      verified = await verifyPmExplorationEffectInterruptedEvidence(
+        verifier,
+        { source: attempt.source, evidence: attempt.evidence },
+        slot.context,
+      );
+      evidenceDigest = verified.interruptedEvidenceDigest;
+      budgetInterruptedCount += 1;
+      for (const arm of ["baseline", "candidate"]) {
+        totals[arm].unresolved = integer(
+          totals[arm].unresolved + verified.unresolvedTestObservationsPerArm,
+          "PM cohort unresolved outcomes",
+        );
+      }
+    } else if (attempt.kind === "runtime-failed") {
+      verified = await verifyPmExplorationEffectRuntimeFailureEvidence(
+        verifier,
+        { source: attempt.source, evidence: attempt.evidence },
+        slot.context,
+      );
+      evidenceDigest = verified.runtimeFailureEvidenceDigest;
+      runtimeFailedCount += 1;
+      for (const arm of ["baseline", "candidate"]) {
+        totals[arm].unresolved = integer(
+          totals[arm].unresolved + verified.unresolvedTestObservationsPerArm,
+          "PM cohort unresolved outcomes",
+        );
+      }
+    } else if (attempt.kind === "preflight-rejected") {
+      verified = await verifyPmExplorationEffectPreflightRejectionEvidence(
+        verifier,
+        { source: attempt.source, evidence: attempt.evidence },
+        slot.context,
+      );
+      evidenceDigest = verified.preflightRejectionEvidenceDigest;
+      preflightRejectedCount += 1;
+      for (const arm of ["baseline", "candidate"]) {
+        totals[arm].unresolved = integer(
+          totals[arm].unresolved + verified.unresolvedTestObservationsPerArm,
+          "PM cohort unresolved outcomes",
+        );
+      }
+    } else {
+      throw new TypeError("PM attempt cohort kind is invalid");
+    }
+    if (
+      verified.sourceEvalReceiptDigest !== slot.receiptDigest ||
+      runIds.has(verified.sourceEvalRunId)
+    ) {
+      throw new Error("PM attempt cohort receipt is substituted or reused");
+    }
+    runIds.add(verified.sourceEvalRunId);
+    attempts.push({
+      slotId,
+      kind: attempt.kind,
+      runId: verified.sourceEvalRunId,
+      receiptDigest: verified.sourceEvalReceiptDigest,
+      evidenceDigest,
+    });
+  }
+  for (const arm of ["baseline", "candidate"]) {
+    if (
+      totals[arm].authenticatedOutcomes + totals[arm].unresolved !==
+      perArmDenominator
+    ) {
+      throw new Error("PM attempt cohort denominator is incomplete");
+    }
+  }
+  attempts.sort(
+    (left, right) =>
+      registered.slots.findIndex((slot) => slot.slotId === left.slotId) -
+      registered.slots.findIndex((slot) => slot.slotId === right.slotId),
+  );
+  // A receipt may expire while later slots are being checked.
+  for (const attempt of source.attempts) {
+    if (attempt.kind === "receipt-unavailable") continue;
+    const slot = slots.get(attempt.slotId);
+    await verifyEvolutionEvalReceipt(
+      verifier,
+      attempt.source.receipt,
+      slot.context.receiptContext,
+    );
+  }
+  const core = {
+    schema:
+      preflightRejectedCount > 0
+        ? PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_V4_SCHEMA
+        : missingReceiptCount > 0
+          ? PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_V3_SCHEMA
+          : runtimeFailedCount > 0
+            ? PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_V2_SCHEMA
+            : PM_EXPLORATION_EFFECT_ATTEMPT_COHORT_SCHEMA,
+    cohortId,
+    planDigest: plan.planDigest,
+    registeredSlotCount: slots.size,
+    authenticatedAttemptCount: attempts.length - missingReceiptCount,
+    budgetInterruptedCount,
+    ...(runtimeFailedCount > 0 || missingReceiptCount > 0
+      ? { runtimeFailedCount }
+      : {}),
+    ...(missingReceiptCount > 0 ? { missingReceiptCount } : {}),
+    ...(preflightRejectedCount > 0 ? { preflightRejectedCount } : {}),
+    failedCompleteCount,
+    perArmDenominator,
+    baseline: totals.baseline,
+    candidate: totals.candidate,
+    attempts,
+    unresolvedBlocksPromotion:
+      budgetInterruptedCount > 0 ||
+      runtimeFailedCount > 0 ||
+      missingReceiptCount > 0 ||
+      preflightRejectedCount > 0,
+    allRegisteredOutcomesAvailable:
+      budgetInterruptedCount === 0 &&
+      runtimeFailedCount === 0 &&
+      missingReceiptCount === 0 &&
+      preflightRejectedCount === 0,
+    statisticalEstimateAvailable: false,
+    cohortCompletenessAuthenticated: false,
+    reportAuthenticated: false,
+    evidenceDecision:
+      budgetInterruptedCount > 0 ||
+      runtimeFailedCount > 0 ||
+      missingReceiptCount > 0 ||
+      preflightRejectedCount > 0 ||
+      failedCompleteCount > 0
+        ? "threshold-not-met"
+        : "insufficient-evidence",
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  return deepFreeze({ ...core, cohortDigest: hash(core.schema, core) });
+}
+
+export async function verifyPmExplorationEffectAttemptCohort(
+  verifier,
+  input,
+  expected,
+) {
+  exact(input, ["source", "cohort"], "PM attempt cohort verification");
+  const cohort = snapshotEffectEvidence(input.cohort, "PM attempt cohort");
+  const recreated = await buildPmExplorationEffectAttemptCohort(
+    verifier,
+    input.source,
+    expected,
+  );
+  if (canonical(recreated) !== canonical(cohort))
+    throw new Error("PM attempt cohort differs from its signed sources");
+  return recreated;
+}
+
+/** Associate the independently saved slot schedule with a reverified cohort. */
+export async function buildPmExplorationEffectManifestBoundCohort(
+  verifier,
+  input,
+  expected,
+) {
+  exact(
+    input,
+    ["cohortSource", "cohort", "slotManifest"],
+    "PM manifest-bound cohort source",
+  );
+  exact(
+    expected,
+    ["cohort", "slotManifestDigest"],
+    "PM manifest-bound cohort registration",
+  );
+  const cohortSource = snapshotEffectEvidence(
+    input.cohortSource,
+    "PM manifest-bound cohort source",
+  );
+  const cohort = snapshotEffectEvidence(input.cohort, "PM registered cohort");
+  const slotManifest = snapshotEffectEvidence(
+    input.slotManifest,
+    "PM registered slot manifest",
+  );
+  const registeredCohort = snapshotEffectEvidence(
+    expected.cohort,
+    "PM registered cohort context",
+  );
+  const manifestDigest = digest(
+    expected.slotManifestDigest,
+    "PM registered slot manifest digest",
+  );
+  const manifest = verifyPmExplorationEffectSlotManifest({
+    plan: cohortSource.plan,
+    manifest: slotManifest,
+  });
+  if (
+    manifest.manifestDigest !== manifestDigest ||
+    manifest.cohortId !== registeredCohort.cohortId ||
+    !Array.isArray(registeredCohort.slots) ||
+    canonical(manifest.slotIds) !==
+      canonical(registeredCohort.slots.map((slot) => slot.slotId))
+  ) {
+    throw new Error("PM cohort slots differ from the frozen manifest");
+  }
+  const verified = await verifyPmExplorationEffectAttemptCohort(
+    verifier,
+    { source: cohortSource, cohort },
+    registeredCohort,
+  );
+  if (
+    verified.cohortId !== manifest.cohortId ||
+    verified.planDigest !== manifest.planDigest ||
+    verified.perArmDenominator !== manifest.plannedTestObservationsPerArm
+  ) {
+    throw new Error("PM cohort denominator differs from the frozen manifest");
+  }
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_MANIFEST_BOUND_COHORT_SCHEMA,
+    planDigest: manifest.planDigest,
+    cohortId: manifest.cohortId,
+    slotManifestDigest: manifest.manifestDigest,
+    cohortDigest: verified.cohortDigest,
+    registeredSlotCount: verified.registeredSlotCount,
+    perArmDenominator: verified.perArmDenominator,
+    slotScheduleBound: true,
+    slotScheduleAuthenticated: false,
+    cohortCompletenessAuthenticated: false,
+    reportAuthenticated: false,
+    evidenceDecision: verified.evidenceDecision,
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  return deepFreeze({
+    ...core,
+    bindingDigest: hash(core.schema, core),
+  });
+}
+
+export async function verifyPmExplorationEffectManifestBoundCohort(
+  verifier,
+  input,
+  expected,
+) {
+  exact(
+    input,
+    ["cohortSource", "cohort", "slotManifest", "binding"],
+    "PM manifest-bound cohort verification",
+  );
+  const binding = snapshotEffectEvidence(
+    input.binding,
+    "PM manifest-bound cohort",
+  );
+  const recreated = await buildPmExplorationEffectManifestBoundCohort(
+    verifier,
+    {
+      cohortSource: input.cohortSource,
+      cohort: input.cohort,
+      slotManifest: input.slotManifest,
+    },
+    expected,
+  );
+  if (canonical(recreated) !== canonical(binding))
+    throw new Error("PM manifest-bound cohort differs from its sources");
+  return recreated;
+}
+
+/**
+ * Sum only usage carried by independently verified final Eval receipts in a
+ * frozen cohort. Missing receipts and preparation costs stay explicitly unknown.
+ */
+export async function buildPmExplorationEffectCohortUsageEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  const source = snapshotEffectEvidence(input, "PM cohort usage source");
+  const registered = snapshotEffectEvidence(
+    expected,
+    "PM cohort usage registration",
+  );
+  exact(
+    source,
+    ["cohortSource", "cohort", "slotManifest", "binding"],
+    "PM cohort usage source",
+  );
+  exact(
+    registered,
+    ["cohort", "slotManifestDigest"],
+    "PM cohort usage registration",
+  );
+  const binding = await verifyPmExplorationEffectManifestBoundCohort(
+    verifier,
+    source,
+    registered,
+  );
+  const knownSignedUsage = Object.fromEntries(
+    SIGNED_EVAL_USAGE_FIELDS.map((field) => [field, 0]),
+  );
+  const slots = new Map(
+    registered.cohort.slots.map((slot) => [slot.slotId, slot]),
+  );
+  let signedReceiptCount = 0;
+  let slotsWithoutSignedUsage = 0;
+  for (const attempt of source.cohortSource.attempts) {
+    if (attempt.kind === "receipt-unavailable") {
+      slotsWithoutSignedUsage += 1;
+      continue;
+    }
+    const usage = attempt.source.receipt.usage;
+    exact(usage, SIGNED_EVAL_USAGE_FIELDS, "signed Eval usage");
+    for (const field of SIGNED_EVAL_USAGE_FIELDS) {
+      knownSignedUsage[field] = integer(
+        knownSignedUsage[field] + integer(usage[field], `signed ${field}`),
+        `cohort ${field}`,
+      );
+    }
+    signedReceiptCount += 1;
+  }
+  if (
+    signedReceiptCount !== source.cohort.authenticatedAttemptCount ||
+    signedReceiptCount + slotsWithoutSignedUsage !== binding.registeredSlotCount
+  ) {
+    throw new Error("PM cohort signed usage coverage differs from its slots");
+  }
+  // A receipt can expire while other slots are being aggregated.
+  for (const attempt of source.cohortSource.attempts) {
+    if (attempt.kind === "receipt-unavailable") continue;
+    await verifyEvolutionEvalReceipt(
+      verifier,
+      attempt.source.receipt,
+      slots.get(attempt.slotId).context.receiptContext,
+    );
+  }
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_COHORT_USAGE_EVIDENCE_SCHEMA,
+    planDigest: binding.planDigest,
+    cohortId: binding.cohortId,
+    slotManifestDigest: binding.slotManifestDigest,
+    cohortDigest: binding.cohortDigest,
+    bindingDigest: binding.bindingDigest,
+    registeredSlotCount: binding.registeredSlotCount,
+    signedReceiptCount,
+    slotsWithoutSignedUsage,
+    knownSignedUsage,
+    usageScope: "signed-eval-execution-aggregate-only",
+    providerSettlementsAuthenticated: false,
+    preparationCostsAuthenticated: false,
+    totalCostAuthenticated: false,
+    cohortCompletenessAuthenticated: false,
+    reportAuthenticated: false,
+    evidenceDecision: binding.evidenceDecision,
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  return deepFreeze({
+    ...core,
+    usageEvidenceDigest: hash(core.schema, core),
+  });
+}
+
+export async function verifyPmExplorationEffectCohortUsageEvidence(
+  verifier,
+  input,
+  expected,
+) {
+  exact(
+    input,
+    ["cohortSource", "cohort", "slotManifest", "binding", "usageEvidence"],
+    "PM cohort usage verification",
+  );
+  const evidence = snapshotEffectEvidence(
+    input.usageEvidence,
+    "PM cohort usage evidence",
+  );
+  const recreated = await buildPmExplorationEffectCohortUsageEvidence(
+    verifier,
+    {
+      cohortSource: input.cohortSource,
+      cohort: input.cohort,
+      slotManifest: input.slotManifest,
+      binding: input.binding,
+    },
+    expected,
+  );
+  if (canonical(recreated) !== canonical(evidence))
+    throw new Error("PM cohort usage differs from its signed sources");
+  return recreated;
+}
+
+/**
+ * Re-read both independent authorities and bind their results to the same
+ * frozen plan and preparation declaration. Provider evidence is partial, so
+ * this bundle must never upgrade the effect report's authentication decision.
+ */
+export async function buildPmExplorationEffectProviderEvidenceBundle(
+  verifier,
+  providerAdapter,
+  input,
+  expected,
+) {
+  exact(
+    input,
+    ["effectSource", "effectReport", "providerSource", "providerEvidence"],
+    "PM effect provider bundle source",
+  );
+  exact(
+    expected,
+    ["effect", "provider"],
+    "PM effect provider bundle registration",
+  );
+  // Capture all caller data before the first asynchronous receipt check.
+  const effectSource = snapshotEffectEvidence(
+    input.effectSource,
+    "PM effect provider bundle effect source",
+  );
+  const effectReport = snapshotEffectEvidence(
+    input.effectReport,
+    "PM effect provider bundle effect report",
+  );
+  const providerSource = snapshotEffectEvidence(
+    input.providerSource,
+    "PM effect provider bundle provider source",
+  );
+  const providerEvidence = snapshotEffectEvidence(
+    input.providerEvidence,
+    "PM effect provider bundle provider evidence",
+  );
+  const effectExpected = snapshotEffectEvidence(
+    expected.effect,
+    "PM effect provider bundle effect registration",
+  );
+  const providerExpected = snapshotEffectEvidence(
+    expected.provider,
+    "PM effect provider bundle provider registration",
+  );
+  if (
+    canonical(effectSource.plan) !== canonical(providerSource.plan) ||
+    canonical(effectSource.phaseUsage) !== canonical(providerSource.phaseUsage)
+  ) {
+    throw new Error("PM provider evidence differs from effect plan or phases");
+  }
+  let verifiedProvider = verifyPmExplorationPreparationProviderEvidence(
+    providerAdapter,
+    { source: providerSource, evidence: providerEvidence },
+    providerExpected,
+  );
+  const verifiedEffect = await verifyPmExplorationEffectEvidenceReport(
+    verifier,
+    { source: effectSource, report: effectReport },
+    effectExpected,
+  );
+  // Recheck receipt freshness, then read the durable provider artifact last.
+  await verifyEvolutionEvalReceipt(
+    verifier,
+    effectSource.receipt,
+    effectExpected.receiptContext,
+  );
+  verifiedProvider = verifyPmExplorationPreparationProviderEvidence(
+    providerAdapter,
+    { source: providerSource, evidence: providerEvidence },
+    providerExpected,
+  );
+  if (
+    verifiedEffect.planDigest !== verifiedProvider.planDigest ||
+    verifiedEffect.phaseUsageDigest !== verifiedProvider.phaseUsageDigest
+  ) {
+    throw new Error("PM provider evidence is not bound to the effect report");
+  }
+  const core = {
+    schema: PM_EXPLORATION_EFFECT_PROVIDER_EVIDENCE_BUNDLE_SCHEMA,
+    planDigest: verifiedEffect.planDigest,
+    phaseUsageDigest: verifiedEffect.phaseUsageDigest,
+    effectEvidenceReportDigest: verifiedEffect.evidenceReportDigest,
+    providerEvidenceDigest: verifiedProvider.evidenceDigest,
+    providerPhaseTotals: verifiedProvider.phaseTotals,
+    evidenceDecision: verifiedEffect.evidenceDecision,
+    blockingReasons: verifiedEffect.blockingReasons,
+    executionEvidenceAuthenticated: true,
+    providerCostsAuthenticatedForRegisteredRequests: true,
+    preparationEvidenceAuthenticated: false,
+    reportAuthenticated: false,
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  return deepFreeze({
+    ...core,
+    bundleDigest: hash(core.schema, core),
+  });
+}
+
+export async function verifyPmExplorationEffectProviderEvidenceBundle(
+  verifier,
+  providerAdapter,
+  input,
+  expected,
+) {
+  exact(
+    input,
+    [
+      "effectSource",
+      "effectReport",
+      "providerSource",
+      "providerEvidence",
+      "bundle",
+    ],
+    "PM effect provider bundle verification",
+  );
+  const bundle = snapshotEffectEvidence(
+    input.bundle,
+    "PM effect provider bundle",
+  );
+  const recreated = await buildPmExplorationEffectProviderEvidenceBundle(
+    verifier,
+    providerAdapter,
+    {
+      effectSource: input.effectSource,
+      effectReport: input.effectReport,
+      providerSource: input.providerSource,
+      providerEvidence: input.providerEvidence,
+    },
+    expected,
+  );
+  if (canonical(recreated) !== canonical(bundle))
+    throw new Error(
+      "PM effect provider bundle differs from authenticated sources",
+    );
+  return recreated;
+}
+
 /** Trusted dataset-author input; store the result outside the Actor workspace. */
 export function buildPmExplorationSuite(input) {
   exact(input, ["suiteId", "datasetVersion", "tasks"], "PM suite input");