W1 transport gate: floors evidence base

[MaxGhenis]

W1 transport gate — floors + anchor evidence base (ceremony step 1)

Status: fixes round complete and verified (round-1 AMEND comment 4950451145 → fixes A–H comment 4950611796 → verification AMEND-text-only comment 4950670492). This body reflects the FIXED gate; every earlier description of the v1 surface is superseded.

DRAFT — the ceremony controls this PR; gates.yaml UNTOUCHED. The gate_w1 stub lives in design issue #151; the flip reads the committed artifact's machine-derivable thresholds, not this prose.

What W1 certifies

Generators ESTIMATED on PSID, DEPLOYED on the certified populace frame (bundle us-4.18.8, populace_us_2024 sparse-l0-refit-57k, sha-pinned), produce distributions matching targets observable without panel data. W1 certifies the TRANSPORT; the dynamics stay certified by gates 1/2a/2b/2c; frame choice verified right-with-named-scope in round 1 (break-even holds on-frame; s_corp_income the sole all-zero gated-adjacent column; self_employment_income_before_lsr guarded at a 0.03 populated-fraction floor — measured 6.30%, $419.6B).

Gate surface (65 gated / 67 report-only + 2 binary)

• Family A — CPS-observable joints: 53 gated / 52 report-only. 100-seed household-disjoint half-split floors on the frame's own weighted moments; tolerances round(mean+4σ,3) capped ln(1.5); heavy-tail guard (tolerance ≥ floor max) with the boundary bootstrap committed (B=5000, seed 91000; demote re-entry probabilities 0.761/0.718/0.552/0.461/0.396). Candidate surface PINNED: scored columns must be REGENERATED from transported generators — the identity candidate (copying frame columns) is caught by the surface rule + the per-cell max-per-draw dispersion disclosure (score 0 with dispersion exactly 0 → non-conformant). Coverage facts named: marital cells span 13/50 states of the underlying cross, dispersion cells 1/8. Report-only A′ published-value family (Census HH-4 person-level shares + AD-3 living-with-spouse, sha-pinned) accompanies the internal-consistency cells.
• Family B — SSA administrative anchors: 10 gated / 15 report-only. DE-CIRCULARIZED: the 14 claim-age cells are report-only with machine reason circular_under_v1_claiming_candidate (the deployed claiming module is calibrated FROM 6.B5.1 — scoring it against its own source passes by construction). Gated content = the 2 disability-conversion shares + 8 DI prevalence age-bands, both genuine transport margins REQUIRING M4-simulated dynamics: the frame's social_security_disability column is forbidden by the candidate protocol and the prohibition is binding-caught. Tolerances price the reference-period drift INSIDE the rule — round(2·resid_sd + |trend|·Δ + 0.05, 2) with Δ pinned (claim 2y, DI 1y) — so a faithful 2024-simulating candidate passes (di_prevalence.60-fra 2.14; 45-49 0.49; conversions 1.91/1.89). Full candidate protocol pinned (objects, population = full frame, K=20 stream 9200, pass rule).
• Family C — compression fingerprints: 2 gated (binary). The PPI↔NRA and elimination↔+2pp orderings must REVERSE to the anchor orderings; all four orders DERIVED from the committed anchor artifacts (replication_cost_ordering_v1.json, m2_pseudo_projection_v1.json) and bound; the candidate procedure (per-fingerprint statistic, encodings, engine pins) is pinned.

Protocol

K=20 mean-over-draws estimator from the start (family-A/B stream conventions pinned; fresh_run_artifact_schema with per-draw rates, undefined-draw invalidation, and per-cell max-per-draw |ln| dispersion disclosure). OC: faithful p_seed 0.922 / p_gate(≥4/5) 0.9481; training copy 0.8089×. Holdout-universe sha binding is ALWAYS-RUNNABLE (recomputes from the committed household-id universe without PSID or the frame staged).

Warts (fixed-round state)

Family A is internal consistency against the frame plus the A′ published-value report-only family — the calibration-coverage statement in the artifact says exactly which cell families populace's own calibration covers. Family B anchors are non-stationary (drift priced, not excluded). Heavy-tail demotes are boundary-fragile (bootstrap committed). Age top-code 85 named. Benefit-level cells await the transported AIME (report-only).

Evidence: full rebuild bit-identical (mod elapsed + sha pins); 14/14 substantive mutations caught; verification re-derived every tolerance, partition reason, OC, and the A′/bootstrap blocks independently.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
social-security-model	Ready	Preview, Comment	Jul 12, 2026 9:25am

[MaxGhenis]

Verdict: AMEND BEFORE LOCK.

Round-1 adversarial review of the gate-W1 floors evidence base (8e1512c). Reproduction anchor: (i) a full rerun of scripts/build_gate_w1_floors.py in the recorded env (policyengine.py .venv, pandas 2.3.2 / pytables 3.11.1 / hf 0.34.4) reproduces runs/gate_w1_floors_v1.json bit-identically except elapsed_seconds and the two git sha pins; the certified pin reproduces from pe.us.model.release_bundle (policyengine 4.18.8) field-for-field and the resolved h5's sha256 recomputes to c2065b64…39c5. (ii) A fully independent recompute — my own h5 load, my own weighted-quantile and cell constructions written from the committed descriptions, and my own splitter written only from holdout_ids.numpy_generator — reproduces all 105 reference moments bit-exactly (weighted and unweighted rates, num_wt/den_wt, and every n_events), all 5 holdout household-id sha256s, all 5 gate seeds × 105 per-seed cells at 0.0 error, and all 104 floored cells × 100 seeds to <1e-9; all 53 tolerances re-derive as round(mean+4·sd,3), the 53/52 partition and every machine reason string re-derive under my own implementation of the events/cap/heavy-tail rules (exactly 5 floor_max_exceeds_tolerance demotes, as claimed), the OC recomputes to 0.922/0.9481, and the training copy confirms 5/5 at max 0.8089× tol (marital_share.married.35-44|female, seed 2). (iii) Family B verifies byte-for-byte against the archived raw source (~/PolicyEngine/dynasim-refs/ssa_supplement_2023_6b.txt): my own parser of the era-dependent 6.B5.1 layout matches the staged JSON on 600/600 raw columns and 400/400 collapsed categories (25 years × 2 sexes), all 8 benefit-level headline anchors appear verbatim in the archive, the DI ASR T19 parse cross-checks (2023: 7,366k workers, 60–FRA 45.4, avg 55.9), and all 24 vintage tolerances re-derive from my own OLS detrend under the stated round(2·resid_sd+0.05,2) rule with the same gate/report split. (iv) Family C's before-orderings match the committed m2_pseudo_projection_v1.json F4/F2 result_orders, and I verified the required orderings against the committed anchor values (Mermin payroll-pct 0.68 / −0.14 / −0.50 / −1.12 ⇒ PI > PPI > NRA > COLA; Smith deltas +21/+18/+5/+1 in the committed F2 forecast ⇒ elim > +2pp > +1pp > cap); both reversals are exactly one adjacent transposition; and the C2 mechanism quantity verifies on the pinned frame itself: payroll share above the 2024 base ($168,600) = 18.2% wage-only / 17.8% incl. self-employment > the 16.1% break-even, so the required C2 reversal is reachable on this exact deployment frame. (v) Tier counts verify by live collection (187 unit / 623 artifact / 2,249 total); the always-runnable suite is green (57 passed); the certified-frame seed-0 pin passes in the pe.py env. The frame-choice worst case was hunted and mostly not found: among the 222 carried person columns only s_corp_income is all-zero, the family-A columns are genuinely populated, and the frame's totals recompute to the issue's claims (employment $9.711T, OASI $1.112T, DI $147.1B). The family-A machinery and the family-C commitments are sound. The contract drafted around them is not lockable in this form: family B's gated cells, as specified, cannot measure the transport — one family is sampled from its own anchor by the committed v1 candidate and the other is priced by a tolerance that excludes exactly the error a faithful candidate must commit under the unpinned reference period — and family A's certification content rests entirely on a candidate-side convention the protocol never states.

---

1. BLOCKER — family B's claim-age cells are circular under the committed v1 candidate; nothing discloses it. The design (#151, #113 hard-part-4) pins the v1 candidate as "mechanical (claiming from the calibrated distribution)". The calibrated distribution is the anchor: populace_dynamics/claiming.py is a lookup-sampler of Table 6.B5.1 — draw_claim_ages draws from the 6.B5.1 category shares for (sex, entitlement year), and the nearest-year rule snaps any year > 2022 to 2022, the anchor vintage itself. So a conformant v1 candidate deployed on the 2024 frame draws its claim ages from the exact table the 16 gated cells are scored against. Consequence, by arithmetic: the 14 non-conversion cells equal anchor_share × (1−conv_sim)/(1−conv_anchor) in expectation — they can deviate only through the simulated disability-conversion share, and weakly (a 3pp conversion-share error moves claim_age.age62|female by 25.6×3/85.9 ≈ 0.89pp vs tol 2.10). Monte-Carlo noise is the only other deviation channel and any K=20-style mean suppresses it (≈0.30pp on the largest cell at n≈1,000 claimants/sex). The 16-cell family therefore carries ≈ one effective degree of freedom per sex — the M4-deployed conversion share against 14.5/14.1 ± ~1.5pp — and cannot fail for any transport defect in earnings, demographics, or household structure. No wart names this; the PR's framing ("admin margins PSID never sees") is literally true and materially misleading — PSID never sees them, but the deployed claiming module samples from them. The 2b/2c standard (description_claims_exactly_the_scored_surface) forbids headlining these as external-validity cells. Required fix A.

2. BLOCKER — family B has no candidate protocol, and the unpinned reference period is worth up to 1.9× tolerance on the disclosed trends alone. Family A gets a full protocol block (population, splits, K=20 stream, statistic, pass rule, fresh-run schema). Family B gets none: no statement of the simulated object (claim-age is a 2022-entitlement-year award flow; DI T19 is a December-2023 stock — a 2024 cross-sectional frame naturally yields neither), no population rule (full frame vs per-seed holdouts), no draw/estimator rule, no pass rule (conjunction? k-of-24?), and no rule barring the candidate from reading the frame's own social_security_disability column (populated, $147.1B — a candidate that reads it tests populace's calibration, not the transport). The pricing makes this quantitative: the tolerance is the detrended residual sd — it deliberately excludes the trend — while the disclosed trends × the unpinned anchor-vintage-vs-frame-year gap exceed tolerance on 7 of 24 gated cells: di_prevalence.60-fra drifts +1.405pp/yr vs tol 0.74 (1.90× for the one-year Dec-2023→2024 gap), claim_age.age70plus|female 1.36pp/2yr vs 0.73 (1.86×), claim_age.age62|female 3.70pp/2yr vs 2.10 (1.76×), age70plus|male 1.68×, age62|male 1.46×, age67_69|female 1.18×, di_prevalence.45-49 1.13×. So as committed the family is unfalsifiable-or-miscalibrated in both directions: the circular v1 candidate (finding 1) passes trivially at the 2022 vintage, while any future behavioral claiming/DI module simulating the frame's own 2024 period fails those cells for being faithful. Wart 4's "the tolerance prices the year-to-year NOISE, not the trend" is exactly backwards for an unpinned reference period: the noise is what a candidate never realizes, the trend is what it must. Required fix A.

3. MAJOR — family A's certification content rests on an unpinned regenerated-surface convention; under the natural anchored-transport reading its score is identically zero. Unlike 2a/2b/2c — whose candidates simulate outcomes the holdout withholds — the W1 candidate receives the very columns family A scores (the holdout households' age, is_female, earnings, A_MARITL, household ids are its deployment input). A transport that anchors on the observed 2024 cross-section and generates histories around it (the most natural reading of #113's "the certified generators already produce person-year histories; deployment on the panel is transport") reproduces every scored cell exactly: 53/53 cells at score 0 on every seed, and family A certifies nothing about the generators. The protocol's "its K=20 deployed draws of the holdout" implies stochastic regeneration but never says of what; varies_per_seed inherits "the candidate's fit complement" from gate-2, which has no referent for a PSID-estimated candidate (nothing refits per seed unless the frame-calibrated layers do — unstated). The 2c precedent priced an unpinned candidate convention at up to 4.9 tolerances; here it is worth the entire family — identity vs regeneration is score 0 vs floor-scale. The training-copy interpretation ("the memorisation defence is procedural") does not cover this: a copy is not an attack here, it is the default conforming behavior. Required fix B.

4. MAJOR — the sparse-frame guard does not cover the earnings concept it certifies. Wart 8 and the PR define family-A earnings as employment + self-employment before LSR, and load_certified_persons adds self_employment_income_before_lsr (populated on this revision: 6.30% non-zero, $419.6B weighted — verified). But REQUIRED_SOURCE_COLUMNS omits it, estimand.populated_source_fractions omits it, wart 1's verified-columns list omits it — and the loader defaults a missing column to zeros via person.get(...), silently. A future certified revision that zeroes or drops self-employment mutates the gated earnings concept with no loud failure — precisely the failure mode wart 1 claims foreclosed ("the builder fails loudly on any zeroed source column" is false for one of the two earnings source columns). Same class, forward-looking: the columns the candidate's generators condition on (beyond family A's five) are nowhere enumerated or support-checked, which is the actual $0-reform-shaped risk on a zeroing frame. Required fix C.

5. Adjudication of the frame choice (question 1): right frame, with named scope — verified, two repairs. The sparse-57k file is the production default the release bundle serves; certifying transport on the dense parent would certify a frame nothing deploys on. Measured on the pinned artifact: only s_corp_income is all-zero among 222 carried person columns; every family-A source column is genuinely populated; the C2 break-even quantity holds on-frame (17.8–18.2% of payroll above the base > 16.1%), so neither fingerprint anchor is unreachable by sparseness. The scope claim in wart 1 ("cells on a zeroed column are out of scope by construction") is honest given fix C. Two residuals: the guard-coverage gap (finding 4), and one undisclosed frame property — age is top-coded at 85, so the 65+ marital/coresidence bands pool 65–85+ (internal consistency unaffected; the estimand disclosure should carry it). Fold into fixes C/H.

6. Adjudication of family A's construct (question 2): the wart is honest, the division of labor is coherent, but the certificate's outer face needs one disclosure. Family A is internal transport-consistency and says so (wart 3). What a pass certifies beyond the identity — given fix B — is that stochastic regeneration through the deployed generators does not distort the cross-section beyond CPS sampling noise: a real, falsifiable, useful property (my checks: a global sex-swapped candidate is caught decisively on 7 gated pairs; age-band swaps are caught by the steep gradients; per-pair sensitivity is bounded by tol = 8–48% relative, and 15 of 22 gated m/f pairs would individually pass a within-pair swap — a floor, not a microscope, which is what it claims to be). The gap is upstream: "the frame's fidelity to admin margins is populace's calibration certification" is true for the calibrated totals (earnings/OASI/DI land on national aggregates — I verified), but the marital×age×sex and household-size joints family A certifies against are not plausibly in the calibration loss — they are CPS joints as reweighted by an L0 refit with Kish n_eff ≈ 14.3k of 166k nominal. Nothing in either institute's ceremony cross-checks those joints against a published table. Before the flip, the artifact should state which family-A cell families are covered by populace's calibration targets and which ride uncertified, and SHOULD (2b fix-F pattern) bundle a report-only published-value comparison (CPS/ACS marital status by age×sex; household size) so the transport target's own quality is visible. Required fix D (disclosure required; A′ report block recommended).

7. Adjudication of the heavy-tail guard (question 3): principled in form, conservative in direction, fragile at its boundary — disclose, don't redesign. The guard is stated generally (tolerance must cover the committed floor's own 100-seed max), machine-derived from the floor alone before any candidate exists (no run's verdict changes; no_self_rescue is satisfied), genuinely bound (disabling it fails partition reconstruction — M6), and conservative in direction (it demotes cells rather than widening tolerances; k stays 4). My recomputation confirms it demotes exactly 5 cells and that it is not load-bearing for the gate-level copy pass: guard-off, the training copy still passes 4/5 (seed 0 fails only earnings_p90p50.25-34|male at 1.25×) — it is load-bearing only for the cleaner "5/5 at ≤1×" precedent property, and under it the committed floor passes all 53 gated cells on all 100 seeds by construction, making the 0.922/0.948 OC conservative against the empirical floor. Perturbation results: at k=5, 4 of the 5 demotes re-enter but 6 other cells fall past the T_max cap — the guard is a targeted size fix, not a hidden k bump. Two properties the artifact must carry: (a) boundary fragility — bootstrap over the committed 100 floor values (B=5,000): the 5 demotes flip back to gated with P = 0.77 (coresident_spouse.25-34|male, max/tol 1.01), 0.71 (marital_share.married.55-64|female, 1.02), 0.53, 0.47, 0.39; six gated cells flip out at P = 0.12–0.31 (worst earnings_profile.18-24|female, 0.31). The lock freezes the partition, so this is disclosure, not defect — but 2b(7c)/2c(8ii) both carried it and this artifact does not. (b) Seed-count dependence — the criterion binds on an in-sample max, so it mechanically tightens with more floor seeds (at 1,000 seeds it would demote every mildly heavy-tailed cell); the rule is well-defined only relative to the committed 100-seed convention, and should say so. Required fix G.

8. Adjudication of family C (questions 5): sound, with a binding gap and one protocol residual. The binding is to the anchor orderings, verified independently against the committed Mermin/Smith values (see reproduction anchor iv), the before-orders match the committed F4/F2 results, the single-adjacent-swap property is tested, and "records, not runs" is honestly worded (wart 6; the gate_partition commits the two cells forward without claiming a current pass). Two repairs: (a) the builder↔artifact binding covers only c1.required and c2.psid — mutating the builder's C2 required_representative_order (the actual gate binding) passes all 57 always-runnable tests (M10), and the required orders are bound to no committed anchor artifact anywhere in the suite (I verified them manually); (b) the C-candidate procedure at reversal time (statistic per fingerprint — F4's outlay ordering vs F2's exhaustion-delay ordering — the committed #115/#117 encodings, engine pins) is unstated, the same protocol-void class as finding 2 at lower stakes. Required fixes E/F.

9. MINOR — protocol/text drift against the locked K=20 contract. The W1 fresh_run_artifact_schema inherits the ratified per-draw commitments except one: the locked gate-2 per_draw_dispersion_disclosure requires both the per-cell across-draw sd and max_per_draw_abs_ln_per_cell (the worst single-draw excursion); W1 commits only the sd. Notably the max-excursion field is the disclosure that would expose an identity candidate (across-draw sd exactly 0) — restoring it partially services finding 3. Stream base 9100 is correctly distinct from 2a's 5200/4200; mean-of-rates-not-scores, undefined-draw invalidation, and the basis note carry without drift. Required fix E.

10. MINOR — record accuracy and bindings (perturbation results). (i) revision_pins.base_sha = 8592a9b, the parent master commit, which contains neither the builder nor the module — the 2b-8(iii) chicken-and-egg; 2c documented the convention in build_commit_note, this artifact does not. (ii) The holdout sha256 commitments are bound by no test at any tier — corrupting one passes the full suite including the certified-frame repro (A6); they are rebuild-bound only (my recompute verified all 5; the repro test should recompute them). (iii) The certified repro pin skips in the repo's own .venv-gate (no huggingface_hub/tables) even on a machine holding the cached h5 — the only data-bound test is invisible to both CI and the default env; the ceremony record needs the full-rebuild attestation (provided here) and the env note. (iv) uprating_context_tolerance_pct: 6.0 on the report-only benefit levels is a named but underived knob (no machine rule, no series) — derive it or strip it before a fixes round promotes it. (v) Family-A coverage facts worth stating where the PR summarizes the surface: the marital family gates 13 of 50 cells (33 demoted at the cap — widowed/divorced/separated are report-only almost everywhere), and lower-tail dispersion gates 1 of 8 (earnings_p50p10.25-34|female only) — the gate's dispersion content is thin and should be named in the PR text, not discoverable only from the partition. Required fix H.

---

Required fixes (executable without interpretation):

• A (findings 1–2). Give family B what family A has, in the artifact and W1 transport gate: design #151: (i) a per-anchor candidate computation rule — simulated object (2022-entitlement-year award flow for 6.B5.1; December-2023 disabled-worker stock for T19), population, draw/estimator rule, and pass rule; (ii) a reference-period rule — either the candidate simulates the anchor vintage, or the tolerance becomes round(2·resid_sd + |trend|·Δyears + 0.05, 2) with Δyears pinned; (iii) the no-frame-DI-column rule (the candidate must derive DI status from the deployed M4 dynamics, not read social_security_disability); (iv) resolve the claim-age circularity honestly — while the v1 candidate claims from the calibrated 6.B5.1 distribution, the 14 non-conversion claim-age cells are report-only with the circularity named in a wart, and the gated content is the conversion share (the real M4-transport margin) — or commit a behavioral/covariate-conditional claiming candidate and keep them gated. Cross-posted to W1 transport gate: design #151 since the pricing lives in the design.
• B (finding 3). Pin the family-A regenerated surface in the protocol block: per cell family, the candidate must emit generated values (which columns are re-drawn per deployment draw), copying a scored column is non-conformant, and what (if anything) refits per seed replaces the inherited "fit complement" language. If the intended v1 transport anchors on observed 2024 values for some families, re-scope those cells to report-only and say so.
• C (findings 4–5). Add self_employment_income_before_lsr to REQUIRED_SOURCE_COLUMNS (floor ~0.03), remove the silent .get(...) zero-default (missing column must raise), add its fraction to populated_source_fractions, and require the eventual candidate registration to enumerate its conditioning columns with the same populated-support check.
• D (finding 6). State in the artifact which family-A cell families are covered by populace's calibration targets and which are not; recommended: a report-only published-value block (CPS/ACS marital×age×sex, household size) before the flip, 2b fix-F pattern.
• E (findings 8b–9). Restore max_per_draw_abs_ln_per_cell to the dispersion disclosure; pin the C-candidate procedure (per-fingerprint statistic, committed encodings, engine pins); replace or ground the "fit complement" text.
• F (finding 8a). Bind all four family-C order fields through the builder (extend test_family_c_block_recomputes), and bind the two required orders to the committed anchor artifacts (Mermin payroll-pct values; the Smith deltas in F2) so the anchor itself is machine-checked.
• G (finding 7). Add the boundary-fragility bootstrap block (the P(flip) numbers above, or a committed re-derivation) and the guard's seed-count-dependence note to the artifact.
• H (findings 5/10). Record fixes: document the parent-commit pin convention in build_commit_note; disclose the age-85 top-code in the estimand; correct wart 1's verified-columns list (add self-employment per fix C); recompute the holdout sha256s inside the certified repro test; note the .venv-gate skip; derive or drop the 6.0% uprating knob; add the marital/dispersion coverage sentence to the PR text.

---

Perturbation / mutation table (always-runnable tier = the three W1 test files in the repo gate venv, certified repro auto-skipped = CI conditions; baseline 57 passed, 1 skipped):

perturbation	expected	result
M1 builder T_MAX ln(1.5)→ln(1.51)	caught	FAILS constant pin
M2 MIN_EVENTS_FOR_GATE 20→19	caught	FAILS constant pin
M3 DRAFT_K 4→5	caught	FAILS constant pin
M4 CANDIDATE_DRAWS 20→19	caught	FAILS constant pin
M5 DRAW_STREAM_BASE 9100→8100	caught	FAILS constant pin
M6 heavy-tail guard disabled	caught (the new rule must be bound)	FAILS partition reconstruction
M7 SPLIT_FRACTION 0.5→0.55	?	invisible in CI (57 pass); certified repro FAILS (0.9s)
M8 K_VINTAGE 2.0→1.5	caught	FAILS family-B recompute
M9 VINTAGE_WINDOW_YEARS 10→8	caught	FAILS family-B recompute
M10 builder C2 required_representative_order swapped	caught?	invisible everywhere (finding 8a; artifact untouched, binding covers 2 of 4 order fields)
M11 module EARN_BANDS (55,61)→(55,62)	caught	FAILS knob pin
M12 module MARITAL_MAP code 3→separated	?	invisible in CI; certified repro FAILS (1.0s)
M13 SPOUSE_PRESENT_CODES (1,2)→(1,2,3)	caught	FAILS knob pin
M14 REQUIRED_SOURCE_COLUMNS employment floor 0.30→0.01	?	invisible everywhere (guard strength unpinned; fires only against a future zeroed frame — finding 4)
A1 artifact: one gated tolerance +0.001	caught	FAILS 4 tests
A2 artifact: delete one gated cell from draft_thresholds	caught	FAILS 3 tests
A3 artifact: consistent M↔F swap earnings_participation.35-44 (all sites)	caught	FAILS gender-gap invariant
A4 artifact: consistent M↔F swap earnings_p90p50.35-44 (all sites)	?	passes all 57 (m/f upper dispersion differs by only 6.5% — no invariant exists); certified repro FAILS
A5 artifact: claim_age.age62|male anchor_pp 23.8→24.8	caught	FAILS staged-file recompute
A6 artifact: holdout sha256 corrupted (1 hex char)	caught?	invisible everywhere incl. certified repro (finding 10ii)
A7 artifact: c1 psid order swapped	caught	FAILS 3 tests
A8 artifact: OC p_seed 0.922→0.93	caught	FAILS 2 tests
training-copy identity	disclosed	confirmed: 5/5 at 0.8089× (marital_share.married.35-44|female, seed 2); guard-off variant passes 4/5 (seed 0 fails earnings_p90p50.25-34|male at 1.25×)

All scratch mutations were reverted (worktree clean; committed artifact byte-restored, sha 92e97ef9…3078 = HEAD). Everything above is executable with the committed pipeline: the full rebuild is ~7s, the independent 100-seed floor ~3 min, the family-B recompute ~1s. Nothing here touches locked gate-1/2a/2b/2c content. The floor machinery, the household-disjoint split (honest for every family — spousal earnings correlation rides inside the cluster), the byte-exact anchor staging, the verified fingerprint commitments, and the K=20 inheritance are ready for a lock after A–H; what may not lock as-committed is an external-validity family whose gated cells the committed candidate samples from its own anchor or fails by being faithful to an unpinned year, and an internal-consistency family whose entire content waits on a candidate convention the protocol does not yet state.

[MaxGhenis]

W1 gate fixes round — referee findings 1–10 (comment 4950451145) addressed. (fixes commit f85408e; branch tip 088caca merges origin/master through gate-2c #155/#156/#157.)

Rebuilt from the regenerator (scripts/build_gate_w1_floors.py, ~7 s in the pe.py .venv); the artifact reproduces bit-identically mod elapsed_seconds. Family A is untouched by every fix (the self-employment column already existed on the frame, so the earnings concept is unchanged): 53 gated / 52 report-only, OC p_seed 0.922 / p_gate 0.9481, training-copy 0.8089× all hold. Every moving number is in family B, family C's bindings, and the records.

Per-fix status

A (findings 1–2) — family B de-circularized + full candidate protocol + reference-period rule. claim_age_anchor now marks the 14 non-conversion claim-age cells report-only (report_reason=circular_under_v1_claiming_candidate): claiming.draw_claim_ages samples them from 6.B5.1 and the nearest-year rule snaps 2024→2022, so they are scored against their own source. The 2 disability_conversion cells stay gated — the M4-simulated margin. _vintage_tolerance(years, values, delta_years) now prices the drift: round(2·resid_sd + |trend|·Δ + 0.05, 2), Δ pinned from ANCHOR_FRAME_YEAR=2024 − vintage (claim/conversion Δ=2, DI Δ=1). New family_b_candidate_protocol() states the simulated object (2022 award flow for conversion; December-2023 disabled-worker stock for T19), full-frame population, K=20 estimator on stream base 9200, the no-frame-DI-column rule (derive DI from M4 dynamics, never read social_security_disability), and the conjunction pass rule. Wart family_b_claim_age_circularity names the lineage per anchor. Cross-posted to #151 (the pricing is design-level).

The 7 cells the referee showed exceed the detrended tolerance are all resolved: the 5 claim-age ones (age62|f 1.76×, age70plus|f 1.86×, age62|m 1.46×, age70plus|m 1.68×, age67_69|f 1.18×) are now report-only-by-circularity; the 2 DI ones (60-fra 1.90×, 45-49 1.13×) are now priced — di_prevalence.60-fra tolerance 0.74→2.14 (trend_component_pp 1.405 over Δ=1), gate-eligible and passable by a faithful 2024-simulating candidate.

B (finding 3) — family-A regenerated surface pinned + identity candidate caught. protocol.fresh_run_artifact_schema.regenerated_surface states, per cell family, which column the candidate must RE-GENERATE per deployment draw; copying a scored column is non-conformant. varies_per_seed drops the gate-2 "fit complement" language (nothing refits per W1 seed — the generators are frozen). New top-level degenerate_candidates block adds the identity_candidate (copies scored columns → score 0, across-draw sd 0, NON-CONFORMANT), caught by the regenerated-surface rule + the max_per_draw_abs_ln_per_cell==0 disclosure.

C (findings 4–5) — zeroed-column guard covers the earnings concept it certifies. self_employment_income_before_lsr added to REQUIRED_SOURCE_COLUMNS (floor 0.03; verified 6.3% non-zero, $419.6B); the silent .get(...) zero-default in load_certified_persons removed (missing column now raises); its fraction flows into populated_source_fractions; the guard's column set + floors are pinned in knobs.required_source_columns. The candidate protocol requires the eventual registration to enumerate its conditioning columns under the same populated-support check.

D (finding 6) — coverage statement + report-only A′ family. family_a.calibration_coverage states which family-A families ride on populace's calibrated totals vs uncertified (the marital/household/dispersion joints are CPS-ASEC joints reweighted by the L0 refit, Kish n_eff ≈14.3k, not in the calibration loss). New report-only family_a_prime compares the frame's own values to committed CPS/ACS published values — person-level household size (HH-4, sha256-pinned) and living_with_spouse 25-34 (AD-3) — with the concept/vintage/band caveats disclosed.

E (findings 8b–9) — dispersion max restored + C procedure pinned. per_draw_dispersion_disclosure.fields = [per_cell_across_draw_sd, max_per_draw_abs_ln_per_cell] (the v1 build dropped the max). family_c.candidate_procedure pins the per-fingerprint statistic (F4 outlay ordering / F2 exhaustion-delay ordering), the committed #115/#117 encodings, the engine pins, and the binary pass rule.

F (finding 8a) — family-C orders derived from committed anchors + bound. family_c_block() now DERIVES all four order fields: before-orders from m2_pseudo_projection_v1.json F4/F2 result_order; required after-orders by ranking the committed Mermin payroll-pct (replication_cost_ordering_v1.json) and Smith solvency deltas (m2 forecasts_detail.F2.smith_year_deltas) descending. There is no hand-written required order left to swap (closes M10). test_family_c_block_recomputes_all_four_order_fields + ..._required_orders_derive_from_committed_anchors + a perturbation test bind it.

G (finding 7) — heavy-tail boundary disclosed. New heavy_tail_boundary_bootstrap (B=5000, default_rng(91000)) re-derives, from the committed 100 floor values, the demote re-entry probabilities — coresident_spouse.25-34|male 0.761, marital_share.married.55-64|female 0.718, earnings_p90p50.55-61|female 0.552, earnings_p90p50.25-34|female 0.461, earnings_p90p50.25-34|male 0.396 (matching the referee's 0.77/0.71/0.53/0.47/0.39) — plus the gated flip-out probabilities and the seed-count-dependence note.

H (findings 5/10) — records. build_commit_note documents the base_sha=parent-of-child convention; estimand.age_top_code=85 + note; wart 1's column list now includes self-employment; the certified repro test recomputes the holdout sha256s and binds the universe to the frame; a new always-runnable test reconstructs every holdout sha256 from the committed household_id_universe_csv (closes A6 at the always-runnable tier); certified_repro_env_note records the .venv-gate skip; the underived 6.0% uprating knob is stripped; the thin-coverage facts are computed (marital 13/50, lower-tail dispersion 1/8) and named here and in the PR text.

New family-B partition / OC

	v1	fixes round
family-B gated	24	10 (2 disability_conversion + 8 DI bands)
family-B report-only	1	15 (14 circular claim-age + 1 benefit level)
family-A	53 / 52	53 / 52 (unchanged) · OC 0.922 / 0.9481

Updated degenerate table

candidate	outcome
train-copy	passes 4/5 at 0.8089× (procedural defense; unchanged)
identity map (new)	score 0, across-draw sd 0 → NON-CONFORMANT; caught by regenerated_surface + max_per_draw_abs_ln_per_cell==0

Mutation table — CI-invisible rows closed

row	was	now
M10 builder C2 required order swapped	invisible everywhere	required orders DERIVED from committed anchors + bound (fix F)
M14 REQUIRED_SOURCE_COLUMNS floor weakened	invisible everywhere	knobs.required_source_columns pinned (fix C)
A6 holdout sha256 corrupted	invisible incl. certified repro	always-runnable recompute from committed universe + data-bound universe binding (fix H)
M7 SPLIT_FRACTION 0.5→0.55	invisible in CI	builder.SPLIT_FRACTION constant pin (bonus)

Suite

Always-runnable tiers green in CI (pytest 3.11 + 3.13, build, lint all pass at 088caca) and locally (866 passed, 45 skipped, 0 failed across unit + artifact in the gate .venv-gate; W1 files 78 passed / 2 skipped); the certified-frame repro + the data-bound universe/holdout-sha bindings pass in the pe.py .venv. black + ruff clean. The fixes add +1 unit / +21 artifact; the tier manifest is refreshed over the merged tree to unit 199 / artifact 712 / total 2,367 (absorbing gate-2c #155/#156/#157). gh pr checks exit 0; mergeable: CLEAN/MERGEABLE. Stays a DRAFT — the ratifying flip, not the author, controls the lock.

[MaxGhenis]

Verdict: AMEND BEFORE LOCK — one text-only amendment (the PR description), everything else verified lock-ready.

Round-2 verification of the fixes round (comment 4950611796; design cross-post 4950611844 on #151; fixes commit f85408e, tip 088caca) against round-1 findings 1–10 (comment 4950451145), under the 2b/2c/M4 verification standard: everything recomputed, everything mutated. The evidence base itself — artifact, builder, module, tests — verifies clean on every fix, A through H, with no defect found. The single incompleteness is fix H's last sub-item: the coverage sentence is NOT in the PR text, and the PR description still carries the v1 family-B surface the fixes round retired — 24 / 1 gated/report-only, the detrended-only tolerance rule, and wart 4's "the tolerance prices the year-to-year noise, not the trend", the exact sentence finding 2 falsified. The description of record now contradicts the committed scored surface (10/15, reference-period-priced), which is the description_claims_exactly_the_scored_surface class that round 1's blocker 1 invoked. The amendment is an edit to the PR body only; no artifact, code, or test change is needed, so re-verification after it is a description-delta check.

Reproduction anchor. (i) A full rerun of scripts/build_gate_w1_floors.py in the recorded env (policyengine.py .venv: pandas 2.3.2 / pytables 3.11.1 / hf 0.34.4; certified pin resolved by revision + sha256, h5 recomputes to c2065b64…39c5) reproduces the committed runs/gate_w1_floors_v1.json field-for-field bit-identically except elapsed_seconds and the two git sha pins; the committed base_sha = d34be1b = the parent of f85408e, exactly the convention build_commit_note now documents. (ii) gates.yaml is sha256-identical to origin/master (3990e15a…147e); no gate_w1 anywhere. (iii) f85408e touches exactly the 8 claimed files; the branch-vs-master diff is the same 8 W1 files and nothing else. (iv) Suites: always-runnable unit+artifact in the repo's .venv-gate: 866 passed / 45 skipped / 0 failed (W1 files 78 passed / 2 skipped); the two data-bound tests (certified-frame seed-0 repro + the new universe/holdout-sha binding) pass in the pe.py .venv; live tier collection = unit 199 / artifact 712 / total 2,367, equal to tier_counts.json; test delta vs v1 = +14 floors + 7 derivations (+21 artifact) + 1 unit, as claimed; ruff + black clean; gh pr checks exit 0 at 088caca (pytest 3.11/3.13, build, lint), mergeable: MERGEABLE, still a DRAFT. (v) Family A is verified untouched: noise_floor_seeds_0_99, gate_partition, and training_copy_check are byte-identical between 8e1512c and 088caca; every v1 fixed block (regenerated surface, degenerate table, A′, bootstrap, knob pins, universe CSV) is genuinely net-new, and the v1 uprating knob is genuinely gone.

Per-fix verification (all recomputed independently — my own parsers and rule implementations, not the builder's)

fix	claim	verification
A (findings 1–2) — de-circularize + protocol + reference-period pricing	14 claim-age cells report-only by circularity; 2 conversion + 8 DI gated; tolerance prices |trend|·Δ; full candidate protocol	VERIFIED. All 14 non-conversion claim-age cells carry report_reason=circular_under_v1_claiming_candidate (my own partition rule reproduces all 25 family-B reasons cell-by-cell). The circularity trace confirms: claiming.draw_claim_ages → claim_age_pmf → 6.B5.1 shares with the nearest-year rule snapping 2024→2022, and the sampler excludes conversions — so the conversion share is the one claim-age margin the anchor lookup never produces; disability_conversion.py states it is "supplied by the M4 disability hazards" (the choice-claimer/conversion partition). The frame carries no claim-age or conversion column (shortcut inventory below), so the 2 conversion cells + 8 DI bands genuinely require M4-simulated dynamics. All 24 vintage tolerances re-derive exactly under my own OLS detrend + round(2·sd + |trend|·Δ + 0.05, 2) from my own parse of the staged 6.B5.1 JSON and DI T19 TSV: di_prevalence.60-fra 0.74→2.14 (trend 1.405 × Δ=1, now gate-eligible ≤ 3.0), 45-49 0.49 (covers the 0.259 drift that was 1.13× the v1 tolerance), conversion cells 1.91/1.89; the 5 flagged claim-age cells are report-only-by-circularity (e.g. age62|female tolerance would now be 5.8 — the circular reason takes precedence, both disclosed). Δ pinned {claim/conversion 2, DI 1} and bound by test. Protocol block complete: full-frame population, K=20 mean estimator on stream 9200 (distinct from 9100 and the split seeds), per-anchor simulated objects, reference-period rule, no-frame-DI-column rule naming social_security_disability (recomputed on-frame: 4.71% non-zero, $147.1B), conditioning-column enumeration rule, conjunction pass rule.
B (finding 3) — regenerated surface + identity candidate	copying a scored column non-conformant; identity caught by surface rule + max_per_draw_abs_ln_per_cell==0	VERIFIED mechanically on the frame. I constructed the identity candidate (emit the frame's own scored columns on all K=20 draws, gate seed 0): score ≤ 4.4e-16 on all 53 gated cells, max_per_draw_abs_ln_per_cell exactly 0 on every cell → caught by the restored disclosure, and non-conformant under regenerated_surface (per-family re-generation rules present for all three cell families). A legitimate transported mock (re-generates marital status per draw from the train half, streams 9100+k) shows across-draw sd > 0 and max-per-draw > 0 on every cell, passes seed 0 at worst 0.644× tolerance, and is not flagged — the rule separates the two candidates cleanly. varies_per_seed is grounded ("nothing REFITS per W1 seed"; the gate-2 "fit complement" language explicitly does not carry).
C (findings 4–5) — earnings-concept guard	self_employment_income_before_lsr required (floor 0.03); .get removed; set + floors pinned	VERIFIED. Recomputed from the pinned frame: self-employment 6.30% non-zero, $419.6B weighted (employment 47.19%, $9.711T). The loader indexes both columns directly (missing column raises, unit-tested); fraction flows into populated_source_fractions (0.063); knobs.required_source_columns pins set + floors (mutation M14 caught, below).
D (finding 6) — coverage statement + A′	calibration-coverage disclosure; report-only published-value block	VERIFIED. calibration_coverage names covered (earnings/OASI/DI totals) vs uncertified (marital/household/dispersion joints). All 7 A′ rows recompute exactly from the committed census files + the frame's own moments; the HH-4 file's sha256 pins the upstream hh4.xls. Note: A′ covers household size + the one aligned AD-3 spouse-presence band, not a full marital×age×sex table — the round-1 wording made A′ recommended, so this is satisfied; the enrichment stays open (flip note 3).
E (findings 8b–9) — dispersion max + C procedure	both locked gate-2 fields; per-fingerprint statistic/encodings/pins	VERIFIED. fields = [per_cell_across_draw_sd, max_per_draw_abs_ln_per_cell] (v1 had no fields key at all); the max is the identity-candidate exposure. family_c.candidate_procedure pins F4 outlay / F2 exhaustion-delay statistics, the #115/#117 committed encodings, engine pins, and the binary pass rule (single committed adjacent swap, nothing else).
F (finding 8a) — C orders derived + bound	all four order fields derived from committed anchors	VERIFIED. My own reads of replication_cost_ordering_v1.json (Mermin 0.68 / −0.14 / −0.50 / −1.12) and m2_pseudo_projection_v1.json (Smith +21/+18/+5/+1; F4/F2 result_order) reproduce all four fields by rank-descending; both reversals are exactly one adjacent transposition (my own check). No hand-written required order remains; M10 is closed on both sides (builder _rank_desc inverted → 3 tests fail; artifact order swapped → 5 tests fail).
G (finding 7) — boundary bootstrap + seed-count note	B=5000, rng 91000, re-entry + flip-out probabilities	VERIFIED, with one honest note. My own vectorized implementation (not the builder's) reproduces the committed block exactly: re-entry 0.761 / 0.718 / 0.552 / 0.461 / 0.396 over the same 5 heavy-tail demotes, corroborating round 1's informal 0.77 / 0.71 / 0.53 / 0.47 / 0.39; gated flip-out = 7 cells at 0.059–0.198. Round 1's informal flip-out side (six cells 0.12–0.31, worst earnings_profile.18-24|female) does not reproduce against the committed floors under either a fixed-tolerance or recomputed-tolerance reading (that cell's flip probability is ≈0.001); the committed, seed-pinned, test-bound derivation is the one the lock freezes, and it is now doubly verified — fix G's requirement explicitly allowed "or a committed re-derivation", which is what shipped. Seed-count-dependence note present.
H (findings 5/10) — records	parent-sha convention; age top-code; wart 1; holdout shas recompute; env note; knob stripped; coverage facts	VERIFIED except the last sub-item. build_commit_note documents the parent-pin convention and the committed base_sha obeys it (= d34be1b); age_top_code 85 recomputes from the frame (max age 85.0); wart 1 lists both earnings columns; the certified repro test now recomputes all 5 holdout sha256s and binds the universe to the frame (passes, pe.py venv); the new always-runnable test recomputes every holdout sha from the committed universe CSV with no h5 — verified in .venv-gate, which cannot even import huggingface_hub/tables (A6 closed at the always-runnable tier); the universe CSV self-hashes to its committed sha and n=57,240 = the frame's household count; certified_repro_env_note records the skip; uprating_context_tolerance_pct appears nowhere in the artifact (v1 had it); coverage facts recompute (marital 13/50, lower-tail dispersion 1/8 = earnings_p50p10.25-34|female) and are in the fixes comment — but not in the PR text (the amendment below).

OC + partitions (independent). From the committed floor values alone — my own tolerances round(mean+4·sd,3), my own rms sigmas, my own normal CDF — p_seed 0.922, p_gate 0.9481, matching the artifact to the rounded digit. Family-A partition reproduces 53 / 52 cell-by-cell under my own implementation of the four rules, with every machine reason matching (report-only: 44 tolerance_above_t_max, 5 floor_max_exceeds_tolerance — the same 5 demotes as round 1 — 2 below_20_events, 1 undefined_on_some_seed). Family B reproduces 10 / 15 (2 conversion + 8 DI gated; 14 circular claim-age + 1 benefit level report-only). Family C 2 / 0. Training copy recomputes: 5/5 seeds, max 0.8089× at (marital_share.married.35-44|female, seed 2).

Mutation close-out (always-runnable W1 files, .venv-gate; baseline 78 passed / 2 skipped; every mutation reverted, artifact sha byte-restored to 45f3c6f9…946f after each)

mutation	round-1 status	now
M7 builder SPLIT_FRACTION 0.5→0.55	invisible in CI	CAUGHT — 1 failed (test_builder_constants_are_pinned)
M10a builder _rank_desc ranks ascending	invisible everywhere	CAUGHT — 3 failed (family-C recompute + derivation + perturbation)
M10b artifact c2 required order swapped	invisible everywhere	CAUGHT — 5 failed (recompute, anchor derivation, direction, orderings, single-swap)
M14 module employment floor 0.30→0.01	invisible everywhere	CAUGHT — 1 failed (test_required_source_columns_and_floors_are_pinned)
A6 holdout seed-0 sha256 1 hex char	invisible everywhere incl. certified repro	CAUGHT always-runnable, no h5 — 1 failed (universe recompute)
V1 (new) artifact di_prevalence.60-fra tolerance 2.14→2.24	—	CAUGHT — 3 failed (staged-file recompute + trend-pricing + rule recompute)
V2 (new) builder ANCHOR_FRAME_YEAR 2024→2025	—	CAUGHT — 3 failed (constant pin + both anchor recomputes)
V3 (new) artifact A′ published_share +0.01	—	CAUGHT — 1 failed (census-source match)
V4 (new) artifact no-DI-column rule stripped of social_security_disability	—	CAUGHT — 1 failed (protocol-specified test)
V5 (new) artifact promotes a circular claim-age cell to gated	—	CAUGHT — 3 failed (circularity + rule recompute + staged-file)
V6 (new) artifact dispersion fields drop the max	—	CAUGHT — 1 failed
V7 (new) artifact bootstrap re-entry 0.761→0.9	—	CAUGHT — 1 failed (bootstrap recompute)
V8 (new) builder FAMILY_B_DRAW_STREAM_BASE 9200→9300	—	CAUGHT — 1 failed (constant pin)
V9 (probe) artifact A′ file_sha256 1 hex char	—	passes all 78 — the sha's value binds at rebuild only (bit-compare, which I performed); the load-bearing content (the published values themselves) is bound always-runnable via V3. Same class as prose fields; note, not a defect.

Hygiene + the env-split adjudication. Tier manifest verified by live collection (199/712/2,367, absorbing gate-2c #155/#156/#157 through the merge); only the claimed files change; CI green and MERGEABLE at 088caca; draft preserved. The env split the lane flagged — always-runnable tiers in .venv-gate (which lacks tables/huggingface_hub by design), the data-bound pins in the pe.py .venv — is adjudicated acceptable as documented: certified_repro_env_note now records exactly this split, it matches the split this verification itself used, and the A6 closure means the previously-invisible commitment class no longer depends on the data-bound tier at all. Shortcut inventory on the frame (for the record): social_security_disability (4.71%), plus adjacent proxies SS_VAL (15.3%), SS_YN (77.6%), social_security_retirement (15.4%), social_security_dependents, social_security_survivors — no claim-age or conversion column exists.

The amendment (blocking, text-only)

Refresh the PR description to the fixed surface. It currently states: family-B row "24 / 1" with round(2·detrended_residual_sd + 0.05, 2) and "Claim-age (16 cells) and DI prevalence (8 cells) gate"; wart 4 "the tolerance prices the year-to-year noise, not the trend" (finding 2's falsified sentence); tier counts "unit 178→187, artifact 574→623"; and no coverage sentence — the fixes comment's "named here and in the PR text" is false for the description, and round-1 fix H required it there. Update: (i) family-B row to 10 / 15 + the reference-period rule round(2·resid_sd + |trend|·Δ + 0.05, 2), Δ pinned {2, 1}; (ii) wart 4's sentence to the priced-trend wording (and add the circularity + age-top-code warts or point at the artifact's 10); (iii) the family-A coverage sentence (marital 13/50, lower-tail dispersion 1/8); (iv) the tier line to 199/712/2,367. No other change of any kind is required.

Flip-time notes (for the ratifying flip, once amended)

1. The gate_w1 stub comes from W1 transport gate: design #151 (proposed block, floor_run: runs/gate_w1_floors_v1.json) — this PR deliberately writes no gates.yaml content (verified byte-identical to master), so the flip is the first and only edit.
2. Anchor bundle conventions to carry into the lock: family-B anchors at their own vintages with Δ pinned {claim/conversion 2, DI 1} against anchor_frame_year 2024; family-C required orders derive from replication_cost_ordering_v1.json + m2_pseudo_projection_v1.json (a revision to either re-derives the orders — treat them as locked inputs); A′ census files sha-pinned; candidate streams 9100 (A) / 9200 (B), distinct from the split seeds; the family-B candidate registration must satisfy the conditioning-column enumeration + populated-support rule, under which any indirect DI inference via the frame's SS proxy columns (SS_VAL, SS_YN, social_security_*) must surface at registration — the no-DI-column rule names the direct shortcut; the enumeration covers the laundered ones.
3. Manifest transition: tier_counts.json (2,367) is enforced at full-suite collection and already absorbs Gate-2c candidate 1: couple formation from certified components (registration 4950250151) #155/W2 interim seam: caregiver-credit full tax-benefit incidence (registration 4950247511) #156/Gate-2c candidate 2: earnings-conditioned first-marriage timing (registration 4950370498) #157; any master movement before the flip forces a fresh merge + manifest refresh, and the flip PR's own additions will move it again — refresh deliberately, per README-tiers. The A′ marital×age×sex published comparison remains a recommended (non-blocking) enrichment before or at the flip.
4. Binding scope, for the record: the protocol/procedure prose (family-B protocol, C candidate procedure) binds artifact-side at the always-runnable tier and builder-side at rebuild only — the lock freezes the artifact, so the artifact-side binding is the operative one; and per V9, provenance sha values inside report-only blocks bind at rebuild.

Everything in this verification is executable from the committed tree: the full rebuild is ~7 s in the recorded env, the mutation harness ~0.5 s per run, the independent family-B re-derivation reads only the staged files. Nothing here touches locked gate-1/2a/2b/2c content. The scratch worktree was discarded after byte-restoration checks; the PR branch was never modified. One text edit stands between this evidence base and a lock-ready state; the artifact itself is already there.

[MaxGhenis]

Verification amendment executed: PR body rewritten from the committed artifact (10/15 family-B surface, reference-period-priced tolerance rule, coverage facts, the falsified wart-4 sentence replaced) — the description now claims exactly the scored surface. Per the verification verdict (comment 4950670492: evidence base clean on every fix; amendment text-only), ratifying by merge under the standing delegation; the flip PR follows from the #151 stub with the enumerated flip-time notes (anchor-bundle Δ pins, SS-proxy conditioning rule, tier transition, binding-scope record).