fix(review): harden release and maintenance determinism

Author: Coding-Dev-Tools

BENCHMARKS.md

@@ -9,14 +9,14 @@ For the locked operator sequence for a public canonical run, see
 ### Public numeric evidence registry
 
 Every exact public aggregate retained below comes from the checked-in, public-safe
-[`offline-fixtures-v4.json`](docs/benchmark-evidence/offline-fixtures-v4.json) artifact. Its
+[`offline-fixtures-v8.json`](docs/benchmark-evidence/offline-fixtures-v8.json) artifact. Its
 SHA-256 is
-`530c2620297de6fadd5e8256fe33c7fb15f6d53e3d1353569e56ddb77532e3cf`, also recorded in the
+`f48f4aa3b4bde802c1b2f008820ee1fc45faee1901e876e0725a4b77964e44c2`, also recorded in the
 adjacent `.sha256` file. The artifact contains no raw questions, answers, prompts, customer data,
 or per-record content fingerprints.
 
 The fixture-suite digest is
-`06bfa81307dac71ef82ac4c30c782426498ab8ff4699a990d22720d30fc2e563`. The artifact defines
+`34312952681809212ada5fd5f1fa608ff8723491d770c8482fd1b0a9e8e87942`. The artifact defines
 the digest algorithm and records the SHA-256 of every suite and dataset file. Each evidence ID
 also binds its exact command through `sha256(UTF-8 exact command)`:
 

README.md

@@ -77,9 +77,9 @@ its counting boundary explicit.
 | Packed prompt-context usage in the same 26-question CodeMem sample pass | Hard budget: **1,500** tokens; observed mean: **85.38**; observed maximum: **108** | A hard cap prevents a recall from exceeding its configured context budget | This is usage accounting, not a before/after savings comparison |
 
 These values are evidence IDs `offline-chunking` and `offline-performance` in
-[`offline-fixtures-v4.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v4.json),
+[`offline-fixtures-v8.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v8.json),
 SHA-256
-`530c2620297de6fadd5e8256fe33c7fb15f6d53e3d1353569e56ddb77532e3cf`.
+`f48f4aa3b4bde802c1b2f008820ee1fc45faee1901e876e0725a4b77964e44c2`.
 [`BENCHMARKS.md`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/BENCHMARKS.md#public-numeric-evidence-registry)
 records the matching suite digest, exact commands, and per-command config digests. External,
 model-dependent, consolidation, productivity, and latency results remain unpublished until the

docs/REWORK_EXECUTION.md

@@ -161,7 +161,7 @@ scope/time regression coverage. Original user edits were not rewritten.
 | Capacity acceptance | Lifecycle RSS includes startup, backlog is sampled and recomputed, and the complete matrix validator enforces prebound hosts, WAL/FULL, all scheduled outcomes, RAM and the required 100k latency limits. | No primary 48-cell matrix was executed. The separate 16 GiB reference host remains necessary. |
 | Installed journeys | A packaged stdlib runner performs actual MCP/HTTP writes, restart recall, correction and historical reads. PR CI and release jobs cover Windows, macOS and Linux, with artifact/dependency identities retained. | Cached Windows source semantic startup passed in four fresh processes, taking 20-23 seconds. This is not semantic qualification of all installed platforms. |
 | Evidence and publication | Candidate ledger validation checks identities, hashes, dependencies, outcomes and selected evaluation booleans. All four publication/repair writes require [owner qualification](RELEASE_QUALIFICATION.md). | Owner-protected environment/authority setup, final approval and all missing mandatory evidence remain open. |
-| Public claims | Fresh [offline fixture evidence](benchmark-evidence/offline-fixtures-v4.json) reproduces retained public aggregates and binds the current engine/eval source. Historical v1 evidence is preserved. | Planner variants still require successful promotion gates; no retrieval default or leadership claim is promoted. |
+| Public claims | Fresh [offline fixture evidence](benchmark-evidence/offline-fixtures-v8.json) reproduces retained public aggregates and binds the current engine/eval source. Historical v1 evidence is preserved. | Planner variants still require successful promotion gates; no retrieval default or leadership claim is promoted. |
 | Website contract | Active commercial/MCP/install guidance is generated and checked against a selected shipped public contract in the website candidate. | The live portal, authenticated provider journeys and combined deployed identities require attended acceptance. |
 
 Final commits, distributions, dependency inventories, raw execution results and gate

docs/benchmark-evidence/offline-fixtures-v8.json

@@ -0,0 +1 @@
+f48f4aa3b4bde802c1b2f008820ee1fc45faee1901e876e0725a4b77964e44c2  offline-fixtures-v8.json

docs/benchmark-evidence/offline-fixtures-v8.json.sha256

@@ -1697,9 +1697,22 @@ def _build_digest_content(
 ) -> tuple[str, str, bool, dict[str, Any]]:
     """Build deterministic content and an optional bounded provider summary."""
     subject = ", ".join(_common_tokens(cluster)) or "recurring episode"
+    # Memory ids are time-sortable only to the millisecond and intentionally carry
+    # random suffixes. A cluster built from records written at different clock
+    # resolutions must therefore not use timestamp or id order to choose its bounded
+    # quote set: that would make compaction accounting and the digest body vary across
+    # otherwise identical runs.
+    quote_cluster = sorted(
+        cluster,
+        key=lambda memory: (
+            memory.content,
+            memory.title,
+            memory.id,
+        ),
+    )
     quotes = [
         memory.content.strip().replace("\n", " ")[:300]
-        for memory in cluster[:DIGEST_QUOTES]
+        for memory in quote_cluster[:DIGEST_QUOTES]
     ]
     content = (
         f"Recurring pattern ({len(cluster)} occurrences): {subject}.\n"

docs/images/context-efficiency.svg

@@ -10,11 +10,16 @@
 from __future__ import annotations
 
 import secrets
+import threading
 import time
 from typing import Optional
 
 _CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"  # excludes I, L, O, U
 _MAX_TIMESTAMP_MS = 1 << 48
+_MAX_RANDOM = (1 << 80) - 1
+_ULID_LOCK = threading.Lock()
+_LAST_TIMESTAMP_MS = -1
+_LAST_RANDOM = -1
 
 
 # Canonical prefixes for each entity kind.
@@ -45,7 +50,7 @@ def _encode(value: int, length: int) -> str:
 
 
 def ulid(timestamp_ms: Optional[int] = None) -> str:
-    """Return a 26-char, lexicographically sortable ULID."""
+    """Return a 26-char ULID that is monotonic within one process and timestamp."""
     if timestamp_ms is None:
         ts = int(time.time() * 1000)
     elif isinstance(timestamp_ms, bool) or not isinstance(timestamp_ms, int):
@@ -54,7 +59,16 @@ def ulid(timestamp_ms: Optional[int] = None) -> str:
         ts = timestamp_ms
     if not 0 <= ts < _MAX_TIMESTAMP_MS:
         raise ValueError("timestamp_ms must be an integer in range [0, 2**48)")
-    rand = secrets.randbits(80)
+    global _LAST_RANDOM, _LAST_TIMESTAMP_MS
+    with _ULID_LOCK:
+        if ts == _LAST_TIMESTAMP_MS:
+            if _LAST_RANDOM >= _MAX_RANDOM:
+                raise RuntimeError("ULID entropy exhausted within one millisecond")
+            rand = _LAST_RANDOM + 1
+        else:
+            rand = secrets.randbits(80)
+        _LAST_TIMESTAMP_MS = ts
+        _LAST_RANDOM = rand
     return _encode(ts, 10) + _encode(rand, 16)