search: Phase 4 federation merge + ACL post-filter + 21 tests

fedIndex merges per-peer inverted indices (union posting lists per term) after
relabelling local DocIds to global gid = peer*1000 + local — dedupe by
(peer,doc-id) is automatic and positions survive, so ranking runs once over the
merge and interleaves peers by score. ACL is a post-rank filter over an injected
permit predicate (searchTfIdfAcl/topNTfIdfAcl/searchBm25Acl). Roadmap complete,
122/122.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/search-on-sx.md

@@ -10,7 +10,7 @@ extension that merges per-peer indices.
 
 ## Status (rolling)
 
-`bash lib/search/conformance.sh` → **101/101** (Phases 1–3 complete)
+`bash lib/search/conformance.sh` → **122/122** (Phases 1–4 complete)
 
 ## Ground rules
 
@@ -99,13 +99,24 @@ lib/search/index.sx                     lib/search/eval.sx
 
 ## Phase 4 — ACL filter + federation
 
-- [ ] post-filter — each candidate result tested via `(acl/permit? viewer :read doc)`
-- [ ] federated query — fan out to peer instances via fed-sx, merge results
-- [ ] merge policy — interleave by rank, dedupe by `(peer, doc-id)`
-- [ ] `lib/search/tests/integration.sx` — federated search with ACL filter
+- [x] post-filter — `aclFilter`/`searchTfIdfAcl`/`topNTfIdfAcl`/`searchBm25Acl` take an
+  injected `permit :: DocId -> Bool` predicate, applied post-rank (never in the index)
+- [x] federated query — `fedIndex :: [(PeerId, Index)] -> Index` merges per-peer
+  inverted indices (union posting lists per term); rank/search run once over the merge
+- [x] merge policy — relabel local DocIds to global `gid = peer*1000 + local`
+  (bijection ⇒ dedupe by (peer,doc-id) is automatic); ranking interleaves peers by score
+- [x] `lib/search/tests/integration.sx` — 21 cases: index merge, cross-peer df/lookup,
+  position preservation, boolean/phrase over the merge, ACL filter + top-N + bm25
 
 ## Progress log
 
+- **Phase 4 complete — federation + ACL (122/122 total). Roadmap done.** `fedIndex`
+  merges per-peer inverted indices (union posting lists per term) after relabelling
+  local DocIds to global `gid = peer*1000 + local` — the bijection makes (peer,doc-id)
+  dedupe automatic and keeps positions, so ranking runs once over the merge and
+  interleaves peers by score (rank-correct). ACL is a post-rank `filter` over an
+  injected `permit :: DocId -> Bool` (viewer baked in by the caller) — never in the
+  index; `searchTfIdfAcl`/`topNTfIdfAcl`/`searchBm25Acl`. 21 integration tests.
 - **Phase 3 complete — ranking (101/101 total).** TF-IDF (`rankTfIdf`) and BM25
   (`rankBm25 k1 b`) over the candidate set (docs containing any query term), scores
   as floats with deterministic DocId-ascending tiebreak; `topNTfIdf`/`topNBm25` via