2026-07-31 · ← ledger · ← iter 5 · PR #686 · LEDGER row 0v
The last three could not change a verdict. They change what can be reproduced and audited about one — which is why they were queued last, and why they still had to be done.
One serial RNG, with consumption that depended on the data in three places: len(sweep) varies; the ladder's continue conditionally skips a p-value's worth of draws, so the stream position entering Y_delta depended on how many of Y_cost's rungs were skipped; and L is itself RNG-derived.
Nothing was non-deterministic end to end. But no single cell could be re-run and reproduce its own numbers — which is the entire point of a frozen seed — and the work could not be parallelised.
Streams are now a pure function of (SEED, label). Derived by hash rather than SeedSequence.spawn, deliberately: spawn order is itself a sequence dependency, i.e. the property being removed. Order-independence has its own test.
getrusage(RUSAGE_SELF) excluded the clickhouse-client subprocesses and the ClickHouse server — the dominant consumer, and exactly the one the cap exists to bound.
So the telemetry could not supply the measurement its own gate demands: AXIS2-ENVELOPE.json requires the ceiling validated by measurement before SEAL′ may fire.
Now self + RUSAGE_CHILDREN + a server peak from system.query_log, verified readable under readonly=2. Two deliberate choices: peak_rss_mib takes the max, not the sum, because ru_maxrss is a per-process high-water mark and the two need not peak together; and an unavailable server figure reports None with a note rather than 0, because not measured and measured zero are different claims.
Seven frozen numbers inlined with no binding — N_SIZE, B_OUTER_SIZE, B_INNER, B_OUTER_FWER, LOOKAHEAD_LADDER, POWER_GRID, SEED — each shaping a published result. Now bound to SEAL-BUDGET.json, with the harness failing closed and loudly if it cannot read it.
The more important half: axis2_self_test's T4 — the check that exists precisely to catch inlined numbers — scanned only ch_concurrency.py and axis2_seal_kernel.py. seal_prime_controls.py, the worst offender by a wide margin, was invisible to it.
N_SIZE = 3000 reintroduced -> FAIL T4 HARDCODED: ['seal_prime_controls.py:N_SIZE inlined']
*** 1 of 12 checks FAILED — the campaign must not fire.
restored -> PASS T4 clean (3 modules scanned incl. seal_prime_controls.py)
A guard with a blind spot over the biggest offender is the failure mode T4 is for.
| suite | result |
|---|---|
tests/test_axis2_seal_controls.py | 72 passed, 1 skipped (9 at iter 0) |
axis2:self-test | 12/12 — T4 now scans 3 modules |
ch_concurrency_smoke_test.py — live | 9/9 |
The defect queue is empty. D10–D27 are closed or retired; D1–D9 predate this loop and were closed before it began.
SEAL′ still does not fire, but the reason has changed category. It is no longer refusing because the machinery is broken. It is refusing because of a missing measurement: attention A2. The 2.5 GiB per-query ceiling is enforced — measured through the real shim in iter 2 — but not validated. Nobody has shown the worst cell this campaign touches survives at it.
Next firing runs that sweep: the 2026-07-27 feasibility sweep at max_memory_usage = 2 684 354 560 against the worst cell, artifact committed under evaluation/evidence/, then _validation_status closed. A Code 241 there is evidence, not failure — the campaign serialises to one query at a time. The cap is not raised in either branch.
That is real work rather than repair — the first time that has been true since this loop began.