Entropy-seeded ordering is only as trustworthy as its provenance. A seed is not just a random number — it is a commitment. Before any orders are accepted, the operator publishes a hash of the seed (e.g., SHA-256) to a bulletin board. After the matching window closes, the preimage is revealed. Anyone can verify that hash(preimage) equals the earlier commitment, proving the seed was fixed before order flow arrived.

This is the same commit–reveal pattern used in cryptographic lotteries and in academic VDF (verifiable delay function) research. Without it, an operator could grind seeds until a favorable permutation emerged — a subtle form of front-running by the venue itself.

Commit phase: publish H(seed) at T-1
Freeze phase: accept orders until T0
Reveal phase: publish seed at T0+ε
Verify phase: any participant recomputes the permutation

Phase	Artifact	Who can tamper
Commit	H(seed)	Nobody (hash-bound)
Freeze	Order book snapshot	Venue (detectable)
Reveal	Seed preimage	Nobody (hash check)