# Evaluator Search Ledger Render Spec

## Purpose

Operationalize Hard Rule 4. This layer owns render of the Evaluator Search Ledger. Writers are Frame Host retrieval hooks, Audit Method Engine (E2), and Blind-Spot Mapper (E5). The ledger lives at `state/evaluator/evaluator-search-ledger/<run-id>/` with ZERO overlap with RAM's `state/ram/ram-search-ledger/<run-id>/` in path, content, schema, record kinds, and writer set.

## Section 1 -- Ownership and Write Discipline

- **Render authority:** E4. Render-only; immutable snapshot per emission; does NOT append, mutate, or delete entries.
- **Writers:** `E3-hook`, `E2`, `E5`. Disjoint from RAM's `{S1, S2, S3, S7, S8}`. Non-writer attempts rejected at the state-manager wrapper.
- **Readers:** E7, E9.
- **Render-lock.** Post-lock writes enter the next snapshot; they do NOT retroactively mutate prior emissions.

## Section 2 -- Five Record Kinds (disjoint from RAM)

1. **`audit-query`** -- audit query issued by a writer. Fields: `query_id`, `run_id`, `question_id`, `writer`, `frame_id`, `frame_prefixed_formula_id`, `query_kind`, `query_text`, `rationale`, `timestamp_utc`.
2. **`audit-finding`** -- criterion-cited finding. Fields: `finding_id`, `query_id`, `level`, `criterion_cited`, `verdict`, `evidence_refs`, `diagnostic_metadata_for_E9`, `timestamp_utc`.
3. **`audit-null`** -- ledger-level calibrated-silence stamp (per-axis). Fields: `probe_id`, `frame_id`, `procedure_ref`, `calibration_harness_record_ref`, `zero_delta_reason`, `timestamp_utc`.
4. **`audit-refusal`** -- classified refusal. Fields: `refusal_reason`, `component`, `escalated_to`, `timestamp_utc`.
5. **`reopen-event`** -- reopen verdict; written by E7 through E4's render authority. Fields: `verdict_token`, `composite_trigger_fired`, `dwell_time_ms`, `bounded_count_current`, `bounded_count_ceiling`, `timestamp_utc`.

Zero record-kind intersection with RAM's `{every-query, every-accepted, every-rejected, every-skipped}`. Zero field-name collision: Evaluator `audit-*` / `reopen-*` vs RAM `every-*`.

## Section 3 -- Frame-Prefixed Formula ID Schema

Every `audit-query` and every `audit-finding` MUST carry a frame-prefixed formula ID matching the loaded Evaluator frame. Valid prefixes: `PRAG-*`, `PHEN-*`, `CONSTR-*`, `REAL-AC-*`, `HIST-*`, `DISC-*`, `CHILISA-*`. A `RAM-*` prefix (e.g., `RAM-S02`, `RAM-S03`, `RAM-S08`) is an automatic fail -- entry rejected, E-MIRROR alarm raised. The frame prefix is the primary structural guarantee that Evaluator calculus has not silently reached into RAM's instruments.

## Section 4 -- Render Procedure (Phase F)

1. Enumerate all ledger entries whose `run_id` matches the current emission.
2. Assert each `record_kind` is one of the five in Section 2; reject any other.
3. Assert each `audit-query` and `audit-finding` carries a valid frame prefix per Section 3.
4. Compute a SHA-256 provenance hash over the canonical-ordered list (sort by `timestamp_utc`, then `record_kind`, then primary ID).
5. Render the snapshot as the ledger-render section of the scored artifact; attach the hash.
6. Render-lock: mark immutable. Post-lock writes enter the next emission's snapshot.

## Section 5 -- Zero-Overlap Verification (Phase F pre-emit)

Run the overlap guard against RAM's Search Ledger manifest:

- **Path check.** Rendered path root is `state/evaluator/evaluator-search-ledger/`; reject any `state/ram/` path.
- **Record-kind check.** Zero intersection with RAM's record kinds.
- **Schema-field check.** Zero field-name collision across the two schemas. Collision -> E-LEDGER-LEAK.
- **Writer check.** Writer set is `{E3-hook, E2, E5}` plus E7 through render authority for `reopen-event`. Any RAM writer ID present trips E-LEDGER-LEAK.

Any failed check refuses emission, routes a structural alarm to Isolation Verifier, and does NOT self-heal. Ledger leak is a system-integrity failure, not a render defect.
