By the time I wrote this, twenty numbered attempts at one Phebs scale gate had been consumed. None had established the full claim.
That does not mean I ran the same experiment twenty times. Some attempts stopped during plan review or preflight. Some ran for hours. Some produced a signed, source-free receipt; others found that the evidence pipeline itself could not make a trustworthy record, so they sealed nothing and retired the identifier.
Take 18 completed the two-million-file structural profile for the first time. The semantic profile failed, so the overall result remained unclassified. That distinction is the reason I run ceremonies.
The claim is bigger than a test
Phebs builds evidence-backed contract intelligence for service fleets. Its scale gate exercises the ordinary server and pinned helpers against two deterministic repositories: a structural profile with 2,000,002 physical file owners, and a semantic profile with 262,144 unique Go blobs plus 32,768 IDL inputs.
The run must do more than index them. It moves through cold convergence, warm no-op, change and return, interruption, stale-worker recovery, resource pressure, archive and restore, collection, authorized query, and teardown. Deadlines, resource ceilings, allowed outcomes, and the evidence schema are fixed before execution.
A test can assert pieces of that behavior. A ceremony tries to establish the composed claim in a form a skeptical reviewer can audit without trusting the operator.
Four rules make the difference.
Freeze the inputs. The execution commit is fixed before the giant repositories are authored. Corpus profiles, helper binaries, toolchain identities, limits, and decision rules are digest-bound. A result cannot be rescued by quietly changing its environment.
Close the decisions in advance. The plan defines the possible outcomes and the rules that select them before the run starts. Anything those rules cannot classify is unclassified, which authorizes nothing. A persuasive story told afterward is not a result.
Retain evidence, not custody. A successful evidence path produces a signed package of closed enums and scalars: timings, resource observations, partition counts, and typed failure classes. It excludes source, repository names, paths, query text, responses, and raw errors. The signing key is single-use, and teardown destroys the working repositories and private material.
Treat stops honestly. No threshold or production constant may be changed after measurement to turn a stop into a pass. A correction needs a reviewed change and a new attempt. The old identifier is never reused.
How a take runs
A take has two separate authorizations. First, freeze and review the commit, plan, toolchain, profiles, and signing material. Then authorize execution. This separation has caught defects before custody was created, which is cheaper and safer than discovering them eight hours later.
Once execution begins, ordinary workers drive the phases. The harness observes typed public state rather than reaching into private implementation details. The take stops on a closed decision, a deadline, or an evidence failure. Independent review then checks the result, the package, the teardown record, and the proposed disposition.
If the evidence cannot support the classification, the answer is not "probably passed." It is unclassified, or no sealed receipt at all.
What the ledger taught me
The full public ceremony ledger is deliberately more detailed than this essay. A few attempts show why the process earns its cost.
The instrument has to prove itself
Take 1 stopped in plan review because the plan did not bind the host executables. Take 2 found that an operator-created archive had included the private signer; the key was retired, and the transfer rule was narrowed to the generated source-free package. Take 7 was signed against the wrong source commit and was permanently consumed without execution.
These were not product-scale results. They were protocol failures. Counting them as equivalent runs would hide the first lesson: before a ceremony can establish a software claim, its own chain of custody and evidence must be trustworthy.
Scale finds seams
Take 14 stopped after three index attempts even though the child process had indexed 2,000,002 files in 78.54 seconds. A 250 ms synchronization poll had been used to derive an 83 ms heartbeat deadline, cancelling healthy workers. The correction introduced an independently justified five-second floor.
Take 15 reached a valid publication pointer, then its public observation became an HTTP 500. A defensive copy had converted a valid non-nil empty unsupported_reasons slice into nil, which the validator correctly refused. The evidence proved complete member and observation validation; it did not prove that the final 64-of-64 schedule had settled.
Both defects lived between components whose local tests passed.
A frozen contract can be wrong
Take 16 made a contradiction measurable. Two million records at 396 bytes each required 792,000,000 bytes of aggregate candidate input, but the frozen contract allowed only 67,108,864 bytes. The limit had been derived from an output population and applied to an input population. No conforming implementation could satisfy both facts.
The rule against raising constants to obtain a pass forced the useful question: which population should define this bound? The correction versioned a one-GiB input limit while preserving the separate output bounds. That is a contract repair with a derivation, not a larger number chosen because the old one failed.
Instrumentation can expose performance
Take 17 exhausted a 32-transition evidence envelope after about 87 minutes of healthy typed progress. The envelope had been designed around sparse failure timelines, not successful work. Timing review then showed that source acquisition consumed 99.587% of aggregate extraction time because the same 792,000,000-byte candidate set was being validated for every partition.
A generation-scoped strict-open correction moved median partition time from 97,899 ms to 434 ms — roughly 225×. That is a diagnostic comparison at the measured commits, not an SLO, a release claim, or a ceremony pass.
Partial success is still partial
Take 18 was the first attempt to complete the structural cold profile: all 1,956 extraction partitions completed, no structural failure or refusal was observed, and relationship authority published in 3,910,284 ms. But the semantic profile failed during observation planning and waited until its deadline. The overall ceremony stopped unclassified.
retained record · take 18 · stopped / unclassified
──────────────────────────────────────────────────
structural-2m-v1 · converged 3,910,284 ms · extraction 1,956/1,956
relationship published · peak process-tree RSS 3,353,821,184 bytes
semantic profile · deadline · planning failed
package sha256: 55806721e91b5d46ed6544cc8db49a94b0e3b3bcc61237233c37c11f62e150b7
The retained Take 18 findings support both statements: structural convergence happened, and the gate did not pass. Reporting only the first would turn evidence into marketing.
Takes 19 and 20 reached a later Caller Map boundary, but each exposed a different gap in the evidence path. One could not validate the terminal outcome; the other sealed a stopped observation but could not construct the final receipt. Teardown destroyed custody in both cases. Corrected code cannot retroactively manufacture the missing records.
What a ceremony buys
The obvious return is defect discovery: timing couplings, nil-versus-empty projections, unsatisfiable bounds, routing dead ends, and evidence gaps that ordinary component tests did not expose.
The less obvious return is epistemic discipline. A stop can be useful without being renamed a pass. A structural profile can converge without proving the full gate. A performance improvement can be real without becoming a blanket scalability claim. And an attempt with no valid receipt can still improve the next instrument without pretending to prove the product.
Ceremonies also compound. Every opaque stop creates pressure for a typed public signal. Every ambiguous decision tightens the next plan. Every custody mistake narrows what may survive teardown. The measurement system becomes a maintained part of the product rather than a one-off benchmark script.
Why not just write more tests?
I do. Tests are cheap, repeatable, and good at checking implementation properties we already know to question. They should run constantly.
A ceremony is rarer and more expensive. It exists for a consequential claim whose meaning depends on real scale, real timing, multiple subsystems, resource ceilings, recovery behavior, evidence handling, and a decision made under rules fixed beforehand. It asks whether the whole claim survived contact with its own constraints.
Neither replaces the other. Tests make change affordable. Ceremonies make certain claims defensible.
The full Phebs gate had not passed when I wrote this. That is a result, not an embarrassment. If it eventually passes, the pass will mean something because the earlier stops were recorded without being softened, reinterpreted, or erased.
The ceremony ledger is active. This essay covers the first twenty consumed identifiers; the public ledger remains the authority for current status.
Phebs is open source (a single Go binary — github.com/bmeddeb/phebs). If this kind of evidence-first engineering appeals to you, the repo is where to start. Originally published at ben.meddeb.me.
