onto-mcp 0.4.12 → 0.4.13

package/dist/core-runtime/discovery/synthesize-cert-judge.js

@@ -0,0 +1,340 @@
+/**
+ * The dedicated live judge system prompt (design §7/§9 note, live-wiring cut).
+ * A fixed, arm-blind lens: it sees the ORIGINAL frozen packet and one arm's raw
+ * output, never which arm produced it. Boundary judgement is deliberately
+ * scoped to the SEMANTIC characterization (character_before/after) the
+ * deterministic `reconcileBoundaries` step cannot judge — exact row-matching
+ * between output boundaries and packet seams is that separate deterministic
+ * step's job, not this judge's (§9 note: boundary↔reconcile).
+ */
+export const SYNTHESIZE_CERT_JUDGE_SYSTEM_PROMPT = "You are an INDEPENDENT judge for a spreadsheet-column semantic-synthesis benchmark. You are given the ORIGINAL frozen input packet (node_ref, format_clusters, value_shape_seams, child_summaries) and ONE candidate model's raw output (semantic_summary, boundaries) produced from that packet (or a corrupted variant of it — you never see which). Judge TWO metrics, each pass or fail, using ONLY the given original_packet as ground truth — never trust the output's own claims about itself.\n\n" +
+    "GROUNDING: does semantic_summary stay faithful to original_packet's format_clusters, value_shape_seams, and child_summaries — no hallucinated facts, no invented business meaning, no invented shape or child content the packet does not support? Any claim not traceable to the packet fails grounding.\n" +
+    "BOUNDARY: judge only the SEMANTIC CHARACTERIZATION of the output's boundaries — is character_before/character_after for each proposed boundary a plausible, coherent reading of original_packet's value_shape_seams (comparing against prev_shape/new_shape)? Do NOT judge exact row alignment or perform deterministic row-matching between output boundaries and seams — a separate deterministic reconciliation step owns that, outside your scope. If original_packet has NO value_shape_seams, boundary passes UNLESS the output proposes a boundary anyway (a spurious boundary with no supporting seam fails boundary).\n\n" +
+    "Reply with STRICT JSON only, no prose outside it, no markdown code fences: {\"grounding\": \"pass\"|\"fail\", \"boundary\": \"pass\"|\"fail\"}. No additional fields.";
+const VALID_VERDICT = new Set(["pass", "fail"]);
+/** Fail-closed total-enum guard for a judge realization's returned verdicts —
+ * a live LLM judge that emits anything outside {pass, fail} for either metric
+ * is a judge-plane failure, never a silently-coerced verdict. */
+export function assertSynthesizeCertJudgeVerdicts(verdicts) {
+    const record = verdicts;
+    const keys = Object.keys(record);
+    if (keys.length !== 2 || !("grounding" in record) || !("boundary" in record)) {
+        throw new Error(`synthesize-cert-judge: verdicts must be exactly {grounding, boundary}, got keys [${keys.join(", ")}] (fail-closed)`);
+    }
+    for (const metric of ["grounding", "boundary"]) {
+        const value = record[metric];
+        if (typeof value !== "string" || !VALID_VERDICT.has(value)) {
+            throw new Error(`synthesize-cert-judge: ${metric} verdict must be 'pass' | 'fail', got ${JSON.stringify(value)} (fail-closed)`);
+        }
+    }
+}
+/** Strips a markdown code fence if the model wrapped its JSON in one, despite
+ * the prompt's instruction not to (defensive — mirrors the synthesize
+ * author's own fence-tolerance). A no-op on already-bare JSON text. Shared by
+ * the judge response parser below AND the judge-replay reconstruction
+ * ({@link reconstructSynthesizeCertJudgeReplayInputs}), since a captured raw
+ * arm-output call needs the identical fence-tolerant un-wrap before
+ * `JSON.parse` — hence the provider-neutral name. */
+function stripLlmResponseFence(text) {
+    const trimmed = text.trim();
+    const fenced = /^```(?:json)?\s*([\s\S]*?)\s*```$/i.exec(trimmed);
+    return fenced?.[1]?.trim() ?? trimmed;
+}
+/**
+ * Pure parser: a live judge realization's raw response text → a TOTAL verdict
+ * pair, or a thrown Error (never a partial/coerced result) — no LLM touched,
+ * so this is unit-testable against fixture response strings. Reuses
+ * {@link assertSynthesizeCertJudgeVerdicts} as the single enum-shape authority
+ * (fail-closed: an out-of-enum or partial response is never silently
+ * coerced). The live dispatch wrapper (scripts side) calls this after
+ * receiving raw response text; any throw here is an untyped rejection that
+ * the coordinate loop classifies as `judge_error`.
+ */
+export function parseSynthesizeCertJudgeResponseText(text) {
+    const jsonText = stripLlmResponseFence(text);
+    let parsed;
+    try {
+        parsed = JSON.parse(jsonText);
+    }
+    catch (error) {
+        throw new Error(`synthesize-cert-judge: response is not valid JSON (fail-closed): ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`synthesize-cert-judge: response must be a JSON object, got ${JSON.stringify(parsed)} (fail-closed)`);
+    }
+    assertSynthesizeCertJudgeVerdicts(parsed);
+    return parsed;
+}
+/**
+ * Reconstructs judge-replay inputs for every row whose synthesize output is
+ * `ok`, by CONTENT-HASH identity rather than sequence position: a row's
+ * `output_sha256` is exactly what the original coordinate loop computed over
+ * the arm's projected output at capture time
+ * (`synthesizeCertOutputSha256`, synthesize-cert-loop.ts), so the ONE
+ * captured call (of the row's own arm role) whose raw text fence-strips +
+ * `JSON.parse`s + projects to that SAME hash IS the row's output — a content
+ * join, not a positional guess (a resumed run's capture can carry more calls
+ * per role than coordinates, and in no particular order).
+ *
+ * Judge input always pairs the arm's output with the row's ORIGINAL
+ * (never-mutated) frozen packet — `originalPacketsByInputId` must be keyed
+ * from the ORIGINAL packets only (e.g. the freeze checkpoint), never a
+ * negative-arm mutation, matching how the live coordinate loop itself always
+ * judges the negative arm against the original (§7 module doc above).
+ *
+ * Pure and realization-agnostic: `projectArmOutput`/`hashArmOutput` are
+ * caller-injected (mirrors this module's judge-fn injection style) so this
+ * stays a plain content join with no hard dependency on any one LLM-output
+ * projection — production callers pass the SAME single-source functions the
+ * original loop used (`projectSemanticMapSynthesisOutput`,
+ * `synthesizeCertOutputSha256`), so a mismatch can only mean a genuinely
+ * missing capture, never a divergent re-implementation of the hash.
+ *
+ * On a sha collision within one arm role (>1 captured call projects to the
+ * identical output — e.g. a resumed run's re-dispatch producing
+ * byte-identical text), the LOWEST-seq call is used deterministically; since
+ * colliding calls are content-IDENTICAL by construction, this only picks a
+ * canonical source and never changes the reconstructed output.
+ */
+export function reconstructSynthesizeCertJudgeReplayInputs(args) {
+    // role -> output_sha256 -> ascending-seq candidates.
+    const byRole = new Map();
+    for (const call of args.capturedCalls) {
+        if (typeof call.text !== "string")
+            continue;
+        let output;
+        try {
+            const parsed = JSON.parse(stripLlmResponseFence(call.text));
+            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+                continue;
+            output = args.projectArmOutput(parsed);
+        }
+        catch {
+            continue; // unusable capture — never a join error, simply no candidate
+        }
+        const sha = args.hashArmOutput(output);
+        let shaIndex = byRole.get(call.role);
+        if (!shaIndex) {
+            shaIndex = new Map();
+            byRole.set(call.role, shaIndex);
+        }
+        const bucket = shaIndex.get(sha) ?? [];
+        bucket.push({ seq: call.seq, output });
+        shaIndex.set(sha, bucket);
+    }
+    const matched = [];
+    const unmatched = [];
+    for (const row of args.rows) {
+        if (row.candidate_output_status !== "ok")
+            continue; // no output to replay
+        const originalPacket = args.originalPacketsByInputId.get(row.input_id);
+        const bucket = row.output_sha256 ? byRole.get(row.arm)?.get(row.output_sha256) : undefined;
+        if (!originalPacket || !bucket || bucket.length === 0) {
+            unmatched.push(row);
+            continue;
+        }
+        const chosen = [...bucket].sort((a, b) => a.seq - b.seq)[0];
+        matched.push({ row, judgeInput: { original_packet: originalPacket, arm_output: chosen.output } });
+    }
+    return { matched, unmatched };
+}
+/** Parses the trailing `:<start>-<end>` row range off a child_summaries key
+ * (the `<sheet>#<col>:<start>-<end>` node-key convention) — end-anchored so
+ * a sheet name containing `:` is still handled safely. A key that doesn't
+ * match contributes no boundary (never throws): this verifier's job is
+ * grounding, not upstream packet-shape validation, which is owned
+ * elsewhere. */
+function parseChildKeyRowRange(key) {
+    const match = /:(\d+)-(\d+)$/.exec(key);
+    if (!match)
+        return null;
+    return { start: Number(match[1]), end: Number(match[2]) };
+}
+/**
+ * Deterministically verifies a summary's structural claims against the
+ * packet's OWN structural facts (value_shape_seams row positions AND
+ * child_summaries' own row-range keys — both packet-supplied, equally
+ * grounding) — never against format-label TEXT, never against the summary's
+ * prose. Pure, no I/O, no LLM. `grounded` is `violations.length === 0`.
+ *
+ * Two checks, both row-position-only:
+ *  - `fabricated_boundary_row`: a cited boundary row must be the region
+ *    start/end, a seam's row, a seam's row − 1 (the last row of the PRIOR
+ *    shape — summaries commonly cite the ending row, not only the row a new
+ *    shape begins; both are grounded in the SAME seam), or a child_summaries
+ *    entry's start/end row (a merge packet's child-partition boundary is a
+ *    packet fact the arm legitimately saw, exactly as grounding as a seam —
+ *    R7 Group A case 7).
+ *  - `fabricated_transition_row`: a cited transition's `at_row` must be
+ *    SOME seam's row exactly — a "transition" claim is specifically about a
+ *    format CHANGE point, which only a seam represents (a child-partition
+ *    row is a subtree split, not necessarily a shape change, so it does NOT
+ *    ground a transition claim the way it grounds a boundary claim).
+ *
+ * `cited_format_labels` and each transition's `from`/`to` text are NEVER
+ * compared against `packet.format_clusters` or seam shape names — label
+ * TEXT matching is out of this verifier's scope (see the module doc above:
+ * domain-agnostic-no-static-enums; format naming is an LLM-semantic
+ * residual, not a deterministic-code judgment).
+ */
+export function verifyStructuralGrounding(args) {
+    const violations = [];
+    const validBoundaryRows = new Set([args.regionStart, args.regionEnd]);
+    for (const seam of args.packet.value_shape_seams) {
+        validBoundaryRows.add(seam.row);
+        validBoundaryRows.add(seam.row - 1);
+    }
+    for (const child of args.packet.child_summaries) {
+        const range = parseChildKeyRowRange(child.key);
+        if (!range)
+            continue;
+        validBoundaryRows.add(range.start);
+        validBoundaryRows.add(range.end);
+    }
+    const seamRows = new Set(args.packet.value_shape_seams.map((seam) => seam.row));
+    for (const row of args.claims.cited_boundary_rows) {
+        if (!validBoundaryRows.has(row)) {
+            violations.push({
+                code: "fabricated_boundary_row",
+                message: `cited boundary row ${row} matches no packet seam (row or row-1), no child_summaries start/end, nor the region start/end (fail-closed)`,
+            });
+        }
+    }
+    for (const transition of args.claims.cited_transitions) {
+        if (!seamRows.has(transition.at_row)) {
+            violations.push({
+                code: "fabricated_transition_row",
+                message: `cited transition at row ${transition.at_row} matches no packet seam row (fail-closed; label text is not checked)`,
+            });
+        }
+    }
+    return violations;
+}
+// ── SG2 — extracted-claim schema + extractor honesty guard ──────────────────
+//
+// The extractor (SG3, an independent LLM lens — opus in production) runs at
+// LOW privilege: it may only pull out what the summary text LITERALLY says,
+// never infer or evaluate. `assertClaimsGroundedInText` is the boundary that
+// enforces that privilege split deterministically — an extraction that cites
+// a row/label absent from the summary's own text is an EXTRACTION failure
+// (the extractor invented something), a category error distinct from the
+// packet-grounding violations {@link verifyStructuralGrounding} reports.
+/** The extractor's raw response failed to parse as JSON, or parsed to the
+ * wrong shape — an EXTRACTION-plane failure (§ orchestrator classifies
+ * `parse_error`), distinct from a grounding violation. */
+export class SynthesizeCertClaimParseFail extends Error {
+}
+/** The extractor cited a row/label absent from the summary text it was
+ * extracting from — an EXTRACTION-plane honesty failure (orchestrator
+ * classifies `honesty_violation`), distinct from a grounding violation
+ * (which compares claims against the PACKET, not the summary text). */
+export class SynthesizeCertClaimHonestyViolation extends Error {
+}
+/** Fail-closed: every number the claims cite as a boundary/transition row,
+ * and every format label they cite, must appear verbatim in `summaryText`
+ * (rows as a digit substring, labels case-insensitively) — else the
+ * extractor fabricated something not present in the text it was extracting
+ * from. Throws {@link SynthesizeCertClaimHonestyViolation} (never silently
+ * drops) on the first violation found. */
+export function assertClaimsGroundedInText(claims, summaryText) {
+    const citedRows = new Set([
+        ...claims.cited_boundary_rows,
+        ...claims.cited_transitions.map((t) => t.at_row),
+    ]);
+    for (const row of citedRows) {
+        if (!summaryText.includes(String(row))) {
+            throw new SynthesizeCertClaimHonestyViolation(`synthesize-cert-judge: extractor cited row ${row} which does not appear in the summary text (fail-closed — extraction, not grounding, failure)`);
+        }
+    }
+    const lowerText = summaryText.toLowerCase();
+    const citedLabels = new Set([
+        ...claims.cited_format_labels,
+        ...claims.cited_transitions.flatMap((t) => [t.from, t.to]),
+    ]);
+    for (const label of citedLabels) {
+        if (!lowerText.includes(label.toLowerCase())) {
+            throw new SynthesizeCertClaimHonestyViolation(`synthesize-cert-judge: extractor cited format label '${label}' which does not appear in the summary text (fail-closed — extraction, not grounding, failure)`);
+        }
+    }
+}
+// ── SG3 — structural-claim extraction prompt + response parser ──────────────
+//
+// The extractor is deliberately NOT a judge: it is told so explicitly, and
+// its prompt asks for verbatim extraction only (no inference, no
+// evaluation). Live dispatch (scripts side) mirrors the judge's dispatch
+// shape exactly — a raw callLlm with this dedicated prompt, parsed by the
+// pure parser below.
+export const SYNTHESIZE_CERT_STRUCTURAL_CLAIM_EXTRACTION_SYSTEM_PROMPT = "You are a STRUCTURAL CLAIM EXTRACTOR, not a judge. You are given ONE semantic-summary text describing a spreadsheet column region. Extract ONLY what the text LITERALLY states — never infer, never evaluate, never add a row number or label the text does not contain, and never judge whether the summary is correct.\n\n" +
+    "Extract exactly:\n" +
+    "(a) cited_boundary_rows: every row number the text presents as a region boundary or transition point.\n" +
+    "(b) cited_format_labels: every format/type label the text names (e.g. INT, DEC, ISO_DATE).\n" +
+    "(c) cited_transitions: every {at_row, from, to} transition the text describes, where at_row is the row number and from/to are the two format labels named as changing at that row.\n\n" +
+    "Reply with STRICT JSON only, no prose outside it, no markdown code fences: " +
+    '{"cited_boundary_rows": [integer, ...], "cited_format_labels": [string, ...], "cited_transitions": [{"at_row": integer, "from": string, "to": string}, ...]}. ' +
+    "Empty arrays are honest and acceptable when the text cites nothing of that kind. No additional fields.";
+/** Fail-closed total-shape guard for an extractor realization's returned
+ * claims — anything outside {cited_boundary_rows: number[],
+ * cited_format_labels: string[], cited_transitions: {at_row:number,
+ * from:string, to:string}[]} is an extraction-plane failure, never a
+ * silently-coerced result. Throws {@link SynthesizeCertClaimParseFail}. */
+export function assertSynthesizeCertStructuralClaims(claims) {
+    const record = claims;
+    const keys = Object.keys(record);
+    if (keys.length !== 3 ||
+        !("cited_boundary_rows" in record) ||
+        !("cited_format_labels" in record) ||
+        !("cited_transitions" in record)) {
+        throw new SynthesizeCertClaimParseFail(`synthesize-cert-judge: claims must be exactly {cited_boundary_rows, cited_format_labels, cited_transitions}, got keys [${keys.join(", ")}] (fail-closed)`);
+    }
+    const rows = record.cited_boundary_rows;
+    if (!Array.isArray(rows) || !rows.every((r) => typeof r === "number" && Number.isFinite(r))) {
+        throw new SynthesizeCertClaimParseFail("synthesize-cert-judge: cited_boundary_rows must be an array of numbers (fail-closed)");
+    }
+    const labels = record.cited_format_labels;
+    if (!Array.isArray(labels) || !labels.every((l) => typeof l === "string" && l.length > 0)) {
+        throw new SynthesizeCertClaimParseFail("synthesize-cert-judge: cited_format_labels must be an array of non-empty strings (fail-closed)");
+    }
+    const transitions = record.cited_transitions;
+    const validTransition = (t) => {
+        if (typeof t !== "object" || t === null || Array.isArray(t))
+            return false;
+        const obj = t;
+        if (Object.keys(obj).length !== 3)
+            return false;
+        const atRow = obj.at_row;
+        const from = obj.from;
+        const to = obj.to;
+        return (typeof atRow === "number" &&
+            Number.isFinite(atRow) &&
+            typeof from === "string" &&
+            from.length > 0 &&
+            typeof to === "string" &&
+            to.length > 0);
+    };
+    if (!Array.isArray(transitions) || !transitions.every(validTransition)) {
+        throw new SynthesizeCertClaimParseFail("synthesize-cert-judge: cited_transitions must be an array of {at_row:number, from:string, to:string} (fail-closed)");
+    }
+}
+/**
+ * Pure parser: an extractor realization's raw response text → TOTAL claims,
+ * or a thrown {@link SynthesizeCertClaimParseFail} (never a partial/coerced
+ * result) — no LLM touched, so this is unit-testable against fixture
+ * response strings. Reuses {@link stripLlmResponseFence} (shared with the
+ * judge parser) and {@link assertSynthesizeCertStructuralClaims} as the
+ * single shape authority.
+ */
+export function parseSynthesizeCertStructuralClaimsResponseText(text) {
+    const jsonText = stripLlmResponseFence(text);
+    let parsed;
+    try {
+        parsed = JSON.parse(jsonText);
+    }
+    catch (error) {
+        throw new SynthesizeCertClaimParseFail(`synthesize-cert-judge: structural-claim extraction response is not valid JSON (fail-closed): ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new SynthesizeCertClaimParseFail(`synthesize-cert-judge: structural-claim extraction response must be a JSON object, got ${JSON.stringify(parsed)} (fail-closed)`);
+    }
+    assertSynthesizeCertStructuralClaims(parsed);
+    return parsed;
+}

package/dist/core-runtime/discovery/synthesize-cert-loop.js

@@ -0,0 +1,234 @@
+/**
+ * S5 — failure-preserving coordinate loop for the B4 `synthesize-cert/v1`
+ * bench (design 20260706-b4-r8-harness-design v3 §8/§15.5, R8).
+ *
+ * The expected universe is frozen packets × declared_reps × the three arms.
+ * EVERY coordinate yields exactly one judgement row — a failed synthesize, a
+ * failed judge, and a soft-abort remainder are all rows (never silent drops),
+ * with the synthesize OUTPUT plane and the judge EXECUTION plane recorded
+ * independently and metrics `not_judged` on any failure. Each arm's execution
+ * is a SINGLE synthesize call on the frozen packet (negative: the
+ * `input_corruption/v1` mutation of it, computed once per input BEFORE any
+ * dispatch so a leverless input fails pre-spend); there is no per-arm subtree
+ * walk (owner decision 2a).
+ *
+ * Resume/re-run semantics (§8): prior rows are keyed by coordinate; a decisive
+ * prior row is kept without re-dispatch, a non-decisive one is re-executed and
+ * OVERWRITTEN with `attempts` incremented — the published judge_failure_rate's
+ * residual-only nature stays visible. The caller re-binds the run to the
+ * frozen manifest (S2 facts binding + S7 record assembly); the loop never
+ * shrinks or extends the universe it is handed.
+ *
+ * Realization error classification: an arm realization SHOULD throw the typed
+ * errors below so §6.2-1's parse/structural zero-tolerance is attributable;
+ * any untyped rejection is an honest transport loss (`not_run`). A judge
+ * rejection classifies as `timeout` only via its typed error, else
+ * `judge_error`. An output that fails the source-safe envelope or verdicts
+ * outside the total enum are structural failures of the respective plane.
+ */
+import { createHash } from "node:crypto";
+import { assertSynthesisOutputBounded, } from "../reconstruct/comprehension-semantic-map.js";
+import { assertSynthesizeCertJudgeVerdicts, } from "./synthesize-cert-judge.js";
+import { applyInputCorruptionV1, } from "./synthesize-cert-mutation.js";
+import { isDecisiveRow, SYNTHESIZE_CERT_ARMS, } from "./synthesize-cert-record.js";
+/** The realization parsed no output from the provider response. */
+export class SynthesizeCertParseFail extends Error {
+}
+/** The realization parsed output of the wrong shape. */
+export class SynthesizeCertStructuralFail extends Error {
+}
+/** The judge realization timed out. */
+export class SynthesizeCertJudgeTimeout extends Error {
+}
+/** Canonical identity of one arm output — capsule per_row binding material
+ * (§18) and the optional honesty field on ok rows. */
+export function synthesizeCertOutputSha256(out) {
+    return createHash("sha256")
+        .update(JSON.stringify({
+        semantic_summary: out.semantic_summary,
+        boundaries: out.boundaries.map((b) => ({
+            row: b.row,
+            character_before: b.character_before,
+            character_after: b.character_after,
+        })),
+    }))
+        .digest("hex");
+}
+const DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;
+/** Canonical coordinate identity (packet input_id × rep × arm) — the SINGLE
+ * source both this loop's own priorRows dedup-guard and the orchestrator's
+ * --resume progress fold ({@link foldSynthesizeCertProgressRows}) key against,
+ * so the two can never drift into disagreeing key formats. */
+export const coordinateKey = (inputId, rep, arm) => `${inputId} ${rep} ${arm}`;
+/**
+ * Folds RAW progress rows — e.g. read line-by-line from an incremental
+ * `onRowComplete` sidecar, which can carry more than one line for the same
+ * coordinate across a single run's own re-attempts — into one row per
+ * coordinate, LAST WRITE WINS. This is the only normalization a --resume
+ * caller needs before handing the result to `runSynthesizeCertLoop` as
+ * `priorRows`: the loop ITSELF already throws (see above) if `priorRows`
+ * still carries a duplicate coordinate, so this function does not duplicate
+ * that (or any other) validation — dedup is its only job.
+ *
+ * Generic over any row shape carrying the three coordinate fields (not just
+ * {@link SynthesizeCertJudgementRow}): sibling progress sidecars — e.g. the
+ * rejudge and structured-grounding cuts' own per-coordinate progress rows —
+ * reuse this SAME fold instead of re-implementing coordinate dedup.
+ */
+export function foldSynthesizeCertProgressRows(rows) {
+    const byCoordinate = new Map();
+    for (const row of rows) {
+        byCoordinate.set(coordinateKey(row.input_id, row.rep, row.arm), row);
+    }
+    return [...byCoordinate.values()];
+}
+export async function runSynthesizeCertLoop(args) {
+    const maxConsecutive = args.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;
+    if (!Number.isSafeInteger(args.declaredReps) || args.declaredReps < 1) {
+        throw new Error(`synthesize-cert-loop: declaredReps must be a positive safe integer, got ${args.declaredReps}`);
+    }
+    if (!Number.isSafeInteger(maxConsecutive) || maxConsecutive < 1) {
+        throw new Error(`synthesize-cert-loop: maxConsecutiveFailures must be a positive safe integer`);
+    }
+    const seenInputIds = new Set();
+    for (const p of args.packets) {
+        if (seenInputIds.has(p.input_id)) {
+            throw new Error(`synthesize-cert-loop: duplicate packet input_id ${p.input_id}`);
+        }
+        seenInputIds.add(p.input_id);
+    }
+    // Pre-spend mutation of EVERY input (§6 lever guarantee): a leverless input
+    // throws here, before any dispatch — never mid-run after paid calls.
+    const mutationsByInputId = new Map();
+    for (const p of args.packets) {
+        mutationsByInputId.set(p.input_id, applyInputCorruptionV1(p.packet, { seed: args.mutationSeed }));
+    }
+    const priorByCoordinate = new Map();
+    for (const prior of args.priorRows ?? []) {
+        const key = coordinateKey(prior.input_id, prior.rep, prior.arm);
+        if (priorByCoordinate.has(key)) {
+            throw new Error(`synthesize-cert-loop: priorRows carry coordinate ${key} more than once`);
+        }
+        priorByCoordinate.set(key, prior);
+    }
+    const rows = [];
+    const emit = async (row) => {
+        rows.push(row);
+        await args.onRowComplete?.(row);
+    };
+    let consecutiveFailures = 0;
+    let aborted = null;
+    let synthesizeCalls = 0;
+    let judgeCalls = 0;
+    for (const frozen of args.packets) {
+        const mutation = mutationsByInputId.get(frozen.input_id);
+        for (let rep = 1; rep <= args.declaredReps; rep += 1) {
+            for (const arm of SYNTHESIZE_CERT_ARMS) {
+                const isNegative = arm === "negative_control";
+                const rowBase = {
+                    row_id: `${frozen.input_id}.r${rep}.${arm}`,
+                    fixture_id: frozen.fixture_id,
+                    input_id: frozen.input_id,
+                    input_sha256: isNegative ? mutation.mutated_input_sha256 : frozen.input_sha256,
+                    rep,
+                    arm,
+                    stratum: { seam: frozen.stratum.seam, merge: frozen.stratum.merge },
+                    ...(isNegative ? { source_input_id: frozen.input_id } : {}),
+                };
+                const prior = priorByCoordinate.get(coordinateKey(frozen.input_id, rep, arm));
+                if (prior && isDecisiveRow(prior)) {
+                    await emit(prior); // resume: a decisive coordinate is never re-spent.
+                    continue;
+                }
+                const attempts = prior ? (prior.attempts ?? 1) + 1 : 1;
+                if (aborted) {
+                    await emit({
+                        ...rowBase,
+                        candidate_output_status: "not_run",
+                        judge_status: "not_run",
+                        metrics: { grounding: "not_judged", boundary: "not_judged" },
+                        attempts,
+                    });
+                    continue;
+                }
+                // ── synthesize plane: ONE call on the frozen (or mutated) packet.
+                let output = null;
+                let outputStatus = "ok";
+                synthesizeCalls += 1; // attempt-counted at dispatch
+                let raw = null;
+                try {
+                    raw = await args.arms[arm](isNegative ? mutation.mutated : frozen.packet);
+                }
+                catch (error) {
+                    outputStatus =
+                        error instanceof SynthesizeCertParseFail
+                            ? "parse_fail"
+                            : error instanceof SynthesizeCertStructuralFail
+                                ? "structural_fail"
+                                : "not_run"; // untyped rejection = honest transport loss
+                }
+                if (raw !== null) {
+                    try {
+                        assertSynthesisOutputBounded(raw); // envelope: parsed but wrong shape
+                        output = raw;
+                    }
+                    catch {
+                        outputStatus = "structural_fail";
+                    }
+                }
+                // ── judge plane: original packet reference, negative included (§7).
+                let judgeStatus = "not_run";
+                let metrics = {
+                    grounding: "not_judged",
+                    boundary: "not_judged",
+                };
+                if (output !== null) {
+                    judgeCalls += 1; // attempt-counted at dispatch
+                    try {
+                        const verdicts = await args.judge({
+                            original_packet: frozen.packet,
+                            arm_output: output,
+                        });
+                        assertSynthesizeCertJudgeVerdicts(verdicts);
+                        judgeStatus = "ok";
+                        metrics = { grounding: verdicts.grounding, boundary: verdicts.boundary };
+                    }
+                    catch (error) {
+                        judgeStatus = error instanceof SynthesizeCertJudgeTimeout ? "timeout" : "judge_error";
+                    }
+                }
+                const row = {
+                    ...rowBase,
+                    candidate_output_status: outputStatus,
+                    judge_status: judgeStatus,
+                    metrics,
+                    ...(output !== null ? { output_sha256: synthesizeCertOutputSha256(output) } : {}),
+                    attempts,
+                };
+                await emit(row);
+                if (outputStatus === "ok" && judgeStatus === "ok") {
+                    consecutiveFailures = 0;
+                }
+                else {
+                    consecutiveFailures += 1;
+                    if (consecutiveFailures >= maxConsecutive) {
+                        aborted = {
+                            reason: `soft-abort: ${consecutiveFailures} consecutive failed coordinates (threshold ${maxConsecutive})`,
+                            at_coordinate: row.row_id,
+                        };
+                    }
+                }
+            }
+        }
+    }
+    return {
+        rows,
+        negative_mutations: new Map([...mutationsByInputId].map(([inputId, m]) => [
+            inputId,
+            { mutated_input_sha256: m.mutated_input_sha256, levers_applied: m.levers_applied },
+        ])),
+        aborted,
+        synthesize_calls: synthesizeCalls,
+        judge_calls: judgeCalls,
+    };
+}