EXP 009: Unload leaves no trace, the results

Measured. P1 refuted: 1 of 400 H1 trials diverged from R0 (95% Wilson upper bound 1.40%). P2 supported: 0 silent-inert and 0 false-inactive kernel configurations of 120. All 5 validity gates passed, so the record is informative. The counted run was 40 window-held blocks from 2026-10-08T13:06:23.112Z to 2026-10-09T05:24:34.706Z, judged against the pre-registration with its frozen analysis, unchanged.

The kernel is our kernel implementing Cordis semantics: a small subset, written here, that uses Cordis (github.com/cordiverse/cordis) as the semantic reference only. It is not a dependency, and nothing here claims Cordis's guarantees. The kernel is pinned by sha256 in the file map.

The verdict per claim

If any gate fails, the result is published as uninformative, never as a pass. The verdict words are the frozen analysis's own (analysis/analyse.mjs): supported, refuted, underpowered or uninformative.

P1, equivalence in time

1 of 400 H1 trials had at least one divergence from R0; the 95% Wilson upper bound on the divergence rate is 1.40% (0.014023). The record's rule is "Any single divergence.", so P1 is refuted. Every divergent trial, as recorded:

• Block 29, trial 291: 2 divergence(s).
  • step 7, decision: {"item":"c058","h1":{"yesno":{"decision":"REJECT","p":0.5}},"r0":{}}
  • step 8, decision: {"item":"c021","h1":{"yesno":{"decision":"REJECT","p":0.592667}},"r0":{}}

Diagnosis of the one divergent trial (block 29, trial 291), not a re-classification: the pre-registered verdict stands. What the records show. Reconstructed from the seed, trial 291 enters with memo-cache (maxEntries 256), yesno-gate and mlx.model on pin B, in that load order; step 5 swaps mlx.model to pin A; steps 6, 7 and 8 evaluate c024, c058 and c021 on that unchanged set. H1 answered all three through yesno-gate. For c024, R0's fresh process (cache key 3f0dfcf0c8aa…, written 01:03:50.79Z) had every loaded component active and answered REJECT, p = 0.651355, matching H1. For c058 (e12c56e6e725…, 01:03:51.98Z) and c021 (b99d4a820b1f…, 01:03:52.24Z), on the same loaded set, R0's fresh process ended with mlx.model not active, memo-cache and yesno-gate inactive behind it (both inject mlx), no mlxPin and no decisions; that is the recorded R0 output of {}. H1 had passed its own activation of mlx.model at the step-5 swap. So the two arms judged activation at different instants and only R0's attempt failed: on these two steps R0 is not a valid reference, rather than H1 carrying a state a fresh process would not. Bounded. Over the whole run, 10 of the 13,627 cached R0 outputs with mlx.model in the loaded set have it not active, all inside block 29 between 01:03:18Z and 01:04:52Z. The other 8 had no yesno-gate loaded, so their decisions (lint and grep only) could not differ, and eval steps compare decisions only. None of the 10 keys fell in the seeded 10% R0 re-run or the restart pick (a fact of the draw, not a gate failure). Why it failed is inferred, not recorded: R0 prints the kernel projection, which reports a failed component as inactive and drops its reason, and exits 0, so the failure was cached as an answer. The failed outputs were written 0.13 to 0.25 s apart, against a median of 2.7 s (n = 8,008) before a fresh R0 output for an evaluation through yesno-gate and mlx.model, which puts the failure before the MLX child started. All 10 are on pin A (llama-3.2-3b, the larger model), and each of the three clusters (01:03:18Z, 01:03:51Z, 01:04:52Z) begins right after a fresh R0 process had loaded pin A successfully and exited. That is most consistent with the memory gate in mlx.model's apply refusing while the memory of the previous R0 process's child was not yet reclaimed, beside H1's own resident pin-A child. Block 29's lease sidecar (21 samples, 0 breaches) read 53%, 56% and 56% free at 01:01:59Z, 01:03:01Z and 01:04:03Z, near the gate's 50% floor. Undetermined from the records: the gate's reading and its refusal at those instants, which no record kept.

P2, soundness in space

P2 pre-computed before registration: a disclosure, not a prediction.

Kernel census on the 120 blind-authored configurations (60 faulty): 0 silent-inert, 0 false-inactive, 0 mislabelled; correct on 120 of 120. The unchanged baseline filter: correct on 60 of 120, with 44 silent-inert, 16 silent-dropped and 0 false-inactive. McNemar on kernel-correct against baseline-correct: b = 60, c = 0, exact two-sided p = 1.734723475976807e-18 (secondary; it decides nothing). P2 is supported.

P2 has no seed and is deterministic, so its outcome was computable before this record. It was computed once, before registration: while validating the pipeline on the real corpus, the instrument author ran it a single time, with output to the terminal only and nothing committed. P2 is registered for the record. Its evidential weight rests on the blind authorship of the 120 configurations (written by a history-free agent from the corpus spec alone, fence audit above) and on the real, unmodified filter baseline, not on any claim about an unseen outcome. Only P1 (seeded from the merge commit of this record) and the validity gates are predictive: they test outcomes that are unknown when this record is frozen.

Secondary, deciding nothing

• S1. 0 of 400 H2 trials left residue (share 0): H2 leaves residue in < 10% of trials. H2's decision mismatches against R0, expected by design: 356 of 400 trials.
• S2. K1 detected 12 of its 12 planted leaks; K2 left 0 residue probes.
• S3. Not measured (no per-arm time to ready was recorded): see the disclosures.

Secondary results decide nothing; they are reported as they come out. P1 and P2 only; S1-S3 decide nothing.

Validity gates

Disclosures

• Each block's long-lived kernel first loads the set its first trial enters with, as a prelude compared with R0 like any step and never counted as a trial: 39 preludes (0 with a divergence); 1 block(s) (00) entered with an empty set and needed none.
• Items: the record's 200-item corpus (sha256 4d0273836696f751272276fe1004ebfc8312d5397fbdaa09ee58232ac48c5acd). Pins A and B: A = llama-3.2-3b, B = qwen3-1.7b, the record's mlx.model swapped by reconfigure.
• Attempts: 40 started, 40 complete, 0 error. A crashed attempt would be kept on disk and excluded from the analysis; there were 0.
• S3 (time to ready) is not measured. The frozen arms record only a trial's wall time, not a per-arm time-to-ready, and no instrumentation was added after the freeze: an instrument gap, disclosed. S3 decides nothing.
• P2 pre-computed before registration: a disclosure, not a prediction. P2 has no seed and is deterministic, so its outcome was computable before this record. It was computed once, before registration: while validating the pipeline on the real corpus, the instrument author ran it a single time, with output to the terminal only and nothing committed. Seen then: kernel correct on 120 of 120, McNemar b = 60, c = 0. Measured in the counted run: kernel correct on 120 of 120, McNemar b = 60, c = 0. Only P1 (seeded from the merge commit of this record) and the validity gates are predictive: they test outcomes that are unknown when this record is frozen.
• Memory-window breaches (free < 50% or load1 ≥ 12 during a block: recorded, never acted on), counted from the committed lease sidecars: 10 breach sample(s) in 6 block(s) (b01: 1, b02: 1, b05: 1, b08: 5, b10: 1, b20: 1). They exclude S3 timings only, and S3 is not measured.
• Wall time per counted H1 trial (as arms/run.mjs records it): median 103.208 s, p90 (nearest rank) 147.375 s, max 275.633 s over 400 trials, against the frozen practice p90 of 199 s; 8 trial(s) took longer than 199 s.
• Not-before honoured: the record was published at 2026-10-07T11:34:15Z (odin-rnd #28, merge 91de325de980493291d17237387aac6d2c656b7c), so no attempt could start before 2026-10-08T11:34:15Z; the first attempt started at 2026-10-08T13:06:23.112Z and the first complete one at 2026-10-08T13:06:23.112Z, and 0 of 40 attempts started at or before it.
• Every block held its memory-window lease: 40 of 40 complete blocks, each with its committed sidecar (40 sidecars), the block's own label, a close with exit 0, and the attempt's start inside the lease.
• Gate aggregation over 40 blocks: K1 counts a planted leak as detected only if every block detected it (12 of 12 leaks in all blocks); K2 sums residue probes over every block; the R0 re-run counts a skipped key as not identical (0 skipped); the restart gate needs every block's pair identical.
• 182 of 400 H2 trials recorded at least one evaluation error. S1 counts residue only, as the frozen analysis defines it; H2 is secondary and decides nothing.
• Diagnosis of the one divergent trial (block 29, trial 291), not a re-classification: the pre-registered verdict stands. What the records show. Reconstructed from the seed, trial 291 enters with memo-cache (maxEntries 256), yesno-gate and mlx.model on pin B, in that load order; step 5 swaps mlx.model to pin A; steps 6, 7 and 8 evaluate c024, c058 and c021 on that unchanged set. H1 answered all three through yesno-gate. For c024, R0's fresh process (cache key 3f0dfcf0c8aa…, written 01:03:50.79Z) had every loaded component active and answered REJECT, p = 0.651355, matching H1. For c058 (e12c56e6e725…, 01:03:51.98Z) and c021 (b99d4a820b1f…, 01:03:52.24Z), on the same loaded set, R0's fresh process ended with mlx.model not active, memo-cache and yesno-gate inactive behind it (both inject mlx), no mlxPin and no decisions; that is the recorded R0 output of {}. H1 had passed its own activation of mlx.model at the step-5 swap. So the two arms judged activation at different instants and only R0's attempt failed: on these two steps R0 is not a valid reference, rather than H1 carrying a state a fresh process would not. Bounded. Over the whole run, 10 of the 13,627 cached R0 outputs with mlx.model in the loaded set have it not active, all inside block 29 between 01:03:18Z and 01:04:52Z. The other 8 had no yesno-gate loaded, so their decisions (lint and grep only) could not differ, and eval steps compare decisions only. None of the 10 keys fell in the seeded 10% R0 re-run or the restart pick (a fact of the draw, not a gate failure). Why it failed is inferred, not recorded: R0 prints the kernel projection, which reports a failed component as inactive and drops its reason, and exits 0, so the failure was cached as an answer. The failed outputs were written 0.13 to 0.25 s apart, against a median of 2.7 s (n = 8,008) before a fresh R0 output for an evaluation through yesno-gate and mlx.model, which puts the failure before the MLX child started. All 10 are on pin A (llama-3.2-3b, the larger model), and each of the three clusters (01:03:18Z, 01:03:51Z, 01:04:52Z) begins right after a fresh R0 process had loaded pin A successfully and exited. That is most consistent with the memory gate in mlx.model's apply refusing while the memory of the previous R0 process's child was not yet reclaimed, beside H1's own resident pin-A child. Block 29's lease sidecar (21 samples, 0 breaches) read 53%, 56% and 56% free at 01:01:59Z, 01:03:01Z and 01:04:03Z, near the gate's 50% floor. Undetermined from the records: the gate's reading and its refusal at those instants, which no record kept.

What this does not establish

• n = 400 supports "at most 1% of trials" (95% Wilson upper bound 0.95% at zero divergences), not zero.
• One kernel, one language, one Mac.
• Equivalence says nothing about accuracy.
• The P2 corpus is synthetic, written from a spec whose fault classes we chose; the real filter keeps exactly the spec-enabled set in all 120 configurations, which shows the spec models its enable rule, not that the classes are representative.
• The baseline filter has no notion of needs, so it is the no-census condition, not a competing census.
• P2's outcome was computed once before registration (see the P2 disclosure): P2 is registered for the record, its weight rests on the blind authorship and the real filter baseline, and only P1 and the validity gates are predictive.

Provenance

This page is rendered from results.json, the committed results record at results/composable-harness/results.json, whose sha256 is 75f8ca56012e0765c33f50af9b72f5b0ead0b89a051ca28d20e88a47ae907951. That record is the output of the frozen experiments/composable-harness/analysis/analyse.mjs (sha256 436b434ff3ef59fa082ea1f991a1e52181a2e1480ec7e55c2e086354cea0394d) over the 50 committed raw files under runs/composable-harness/counted/, each listed in it with its sha256. A repository check recomputes it from those files and refuses any difference, and binds the raw files to the manifest taken after the last block (digest 5331ac78cd575a41d986b50642474d59477fe936746a449c099b1d39f0e09d81). The pre-registration it is judged against is experiments/composable-harness/preregistration.json (sha256 d25f7f3fe9f802b19ed5caa9a437126109b20f83fe993086854a20bb902e7e7e), published by merge 91de325de980493291d17237387aac6d2c656b7c; seed 32e343ca3a4e46c007abbdd09ee5e406a1cb4e7f452aad67587812f36b96a7c5.