RSI proof 5/6: Make campaign lineage and budgets restart-safe

[w4ffl35]

Goal

Make a bounded multi-generation proof campaign restartable and auditable without duplicate model spending, lost lineage, or stale results changing a promotion decision.

Depends on

Task-result identity (#15), parent-relative comparison (#16), provider usage accounting (#17), and self-hosted/fixed worker modes (#18).

Current gap (v1.3.0)

The PostgreSQL queue has idempotency keys and fenced worker leases. The campaign archive in src/rsi/archive.ts is still a JSON read/modify/write file with atomic rename but no coordinator transaction or fencing. src/rsi/controller.ts checkpoints it while also accepting queue results. --max-runtime-ms checks adaptive follow-up admission; it does not stop an already-running job. A reliable multi-generation claim needs one authoritative record tying results, lineage, budgets, and promotion together.

Work

1. Add a versioned proof-campaign manifest: root commit, development/confirmation benchmark digests, fixed and self-hosted arm assignment, model/provider and settings, seeds, task order, per-attempt and root campaign budgets, acceptance rule, runtime image/dependency digests, and analysis version. Hash it before any live admission. A resume with changed identity must fail rather than silently start a different experiment.
2. Use PostgreSQL as the authoritative source for proof-campaign state, or add an equivalent single-writer transactional journal. Define planned -> running -> evaluated -> selected/rejected -> confirmed/finished transitions, with monotonic sequence/epoch and a unique (campaign, arm, generation, candidate, task, seed, attempt kind) identity. Queue lease fencing must extend to result import, evaluation attachment, and selection. Keep the existing JSON archive/report as a derived, recoverable view; do not silently discard malformed archives.
3. Admit the entire maximum possible model-call/token/spend reservation before starting each attempt. Count all retries, aborted attempts, descendants, fixed-control runs, and independent verifier jobs against root limits. Stop admitting work when a limit is reached; record unfinished cells as incomplete. A timeout must cancel or otherwise prevent further paid inference, not merely decline a future follow-up.
4. Bind each accepted result to the exact harness/snapshot/task/verifier/model/broker-usage/artifact digests. Verify artifact bytes before use. Preserve complete errors rather than only truncated previews. Refuse stale epochs, duplicate conflicting results, missing artifacts, and changed configuration. Report cleanup failures visibly.
5. Test kills/restarts before and after admission, broker dispatch, queue completion, artifact upload, verification, and promotion. On recovery, reuse completed cells, conservatively account uncertain spend, abort or retry unfinished cells within the original ceiling, and never promote from an incomplete comparison.

Acceptance criteria

• A fake-provider campaign survives repeated process restarts and yields the same terminal lineage and accounting as an uninterrupted run; it makes no duplicate paid-call admission.
• Stale/fenced workers, altered artifacts/manifests, concurrent coordinators, corrupt archive views, and exhausted root budgets cannot change selection or produce a success claim.
• A reviewer can reconstruct every promotion from manifest, paired task outcomes, broker usage, and hashes. Old v1/v2 archive entries remain readable as historical data but cannot masquerade as proof-campaign results.
• npm run typecheck, full npm test, PostgreSQL/RustFS integration tests, and applicable e2e tests pass. Document recovery commands.

Relationship to existing issues

The queue work overlaps the broad scheduler issue #5, and stronger signed evaluator provenance remains in #4. This issue is the scoped campaign-consistency gate required for the demonstration; it does not claim multi-host fleet qualification.