[MaxGhenis]

This PR covers Max's d1802 for the rules lane: G part 2 and R2 part (b). It applies Act 203(a)(4)'s deductions before the family-maximum reduction, which removes R2's deduction_before_reduction_part_b refusal. It also adopts SSA's operational reading of the 1972 saving clause, per Max's d1338, with the literal reading behind a switch. It also fixes #530's round-14 low finding. The work is statutory conformance on invented cases and SSA's published examples only, with no population claim.

Status: draft. Round 10 sits at 434a39c6, and 03530e8b merges master 89d064b (SSI0, #573), which touches no Track B file. An independent cloud review (Opus 5.5) approved 03530e8b with nothing of medium or higher severity (verdict). f5a18c84 records round 10's cloud mutation run (docs only), and dbdceac5 merges master dd9c7be (#596, one B0.2 test file). Sol's tenth review waits for a lane and audits the PR later. GPT-6 Astra reviewed the first round, and GPT-6.1 Sol reviewed rounds 2 and 3. Each round below lists what that review found. #562 (insured status) and this PR touch _provenance.py, the shared schema and audit fixtures, and the tier files. Whichever merges second will merge master and recount. The coordinator's slot order after #574 is #562, #563, #565.

What changes

Deductions before reduction (G)

Act 203(a)(4); GN 02603.020, .040, .050, .090.

• The entry point. family_benefits_after_deductions, and its household form, take declared monthly deductions and apply the reduction for the maximum after them.
• Permanent deductions. Non-deductees share PTAP / (TOTOB − deductees' OBs), capped at OB and dime-floored, with deductees' payables and age reductions reserved (GN 02603.050C).
• Temporary deductions. They leave separate-household beneficiaries unchanged until the deduction is permanent (GN 02603.050D).
• Supported deductions. An auxiliary's or survivor's own earnings-test deduction (full or partial, permanent or estimated), no child in care, and Parisi. Parisi results through the new path are identical to before.
• Refused by name: workers' compensation, prisoner and drug-addiction suspensions, foreign work, penalty, maritime and election-certificate events, and the unsettled interaction of number-holder reservations with age reductions.
• Empty deductions change nothing. With no deductions, results equal ordinary G exactly, for families and households, and a differential property tests it.

403(a)(5): the saving clause (G)

• The switch. SavingsClauseReading on SavingsClauseGuard: SSA_OPERATIONAL is the default (RS 00630.400, RS 00615.801B.2), and LITERAL_REFUSAL keeps the earlier behaviour. Existing tests that pin the literal guard select it explicitly.
• What starts a protection. A protection starts only when a PIA increase lowers the total, the month is reduced for the maximum, and a beneficiary is age-reduced. A departure, or any other fall without a PIA increase, starts none. A COLA alone starts one only with an age-reduced beneficiary, which addresses the dime-rounding case from Track B G v2: close #495, compute five refused configurations, one contract across G, R2 and R3 #530's round 11.
• What a protection does. It protects the payment, not the formula maximum, and carries while the formula maximum stays smaller.
• Refused by name. Membership changes while a protection is active, and concurrent age-factor or maximum changes that leave the cause unsettled.

R2 part (b)

• Family context. Monthly RETFamilyMonth context lets an auxiliary's own deduction release maximum room to the others through the new G entry point (RS 02501.155–.160).
• Downstream effects. Final deductions flow to R3, and a delayed household increase creates no own-work credit.
• New refusal. Missing family facts refuse as deduction_readjustment_requires_family_context.

Fixes from #530's review

• Deleting a refusal's exception notes works again in all four layers; that was Track B G v2: close #495, compute five refused configurations, one contract across G, R2 and R3 #530's round-14 low finding.
• Stateful guard constructors register their declared enums before the first call.

Invariants

Each is a Hypothesis property:

• Exactness. Empty deductions give exactly ordinary G, and permanent rates follow the GN 02603.050C formula.
• Bounds. No rate exceeds its OB, and the counted total stays within the maximum.
• Temporary deductions. These leave a separate-household beneficiary at its ordinary rate.
• Reserved slack. Number-holder reservations never release existing maximum slack.
• Order and determinism. Results are deterministic and independent of beneficiary order.
• Input errors. Invalid inputs fail before any refusal, and every named refusal stays in the denominator.
• Saving-clause readings. Each reading starts exactly on its stated conditions, and a protection never inflates from deduction history.
• R2 accounting. Gross equals net plus deduction, both provisionally and finally. Unused G context leaves R2's earlier outputs unchanged.
• Refusal notes. Deleting a refusal's notes preserves provenance and the denominator.

One invariant is qualified, not absolute. Adding a deduction does not always keep the others' rates from falling: GN 02603.050A.1 disregards age reduction for a single full permanent deduction only when "no other deduction is involved", and GN 02603.050C reserves the age reduction otherwise. A minimized case is pinned (PIA $48, maximum $78): the children's rates fall from $10 to $9.90 when a second, $0.10, deduction appears. The property therefore covers adding the first deduction.

Examples and differentials

• Reproduced exactly:

  • GN 02603.060 A.1, A.2, B.1, C.1 and C.2, plus A.5, A.8, A.9 and B.2 through the new path;
  • RS 02501.130B (the children's $83.50);
  • RS 02501.160 examples 1 and 2 (the separate-household timing);
  • RS 02501.155A.3–4.

  These are eight new registry examples. A.6 and A.7 need combined maximums and stay refused, as do the workers' compensation examples.

• Source discrepancies, both sides pinned. GN 02603.060 A.2's narrative omits the OB cap. RS 02501.160 and .130 quote OBs a dime above G's post-1982 floor.

• Cross-head differential (scripts/track_b_r2_cross_head.py). 240 previously supported R2 results, and their 240 downstream R3 results, are byte-identical to master. The six invented rows R2 used to refuse as deduction_before_reduction_part_b now compute, with no other refusal in their place.

• Conformance report. The 356,400-row G lattice is unchanged. A separate 16-row deduction denominator is added, and every one of G's 37 refusal reasons has an executed witness.

• Mutation checks. Thirteen one-line mutations were caught and reverted (docs/design/track_b_g2_r2b_mutations.json).

Source readings taken (session, under Max's 2026-10-20 delegation)

Both are logged in ~/reviews/us-hub/source-conflicts/RULINGS.md and marked at their decision lines:

• us:oasdi-ret-temporary-partial-deduction. GN 02603.050D.2 says temporary deductions are never partial, while RS 02501.160's worked example pays a partial one. G follows the example (specific over general). R2 keeps its full-month provisional suspension and refuses a provisional partial path by name.
• us:oasdi-saving-clause-operational-rate-rounding. RS 00630.400 says "rounded" without a direction, and Act 203(a)(5) requires the smallest amount that keeps the total from falling. So protected equal rates round up to the least sufficient dime (P1). LITERAL_REFUSAL remains the alternative.

The rest of the build report's judgment items are refusals by name, not readings, so none needs Max.

Round 10 (after the ninth review)

Sol's review of bc460e32 found one medium and one low, and both reproduced.

• Another caregiver keeps its care facts. 402(q)(5)(D) compares a widow(er)'s benefit with what the person would have had "had he or she been entitled for such month to mother's or father's insurance benefits", which replaces one entitlement. Round 9's comparison also cleared every other widow(er)'s care flag. When that other caregiver took a deduction, G counted its whole age reduction against the maximum, and the first caregiver's comparison came out low. A surviving divorced spouse beside a deducted widow, both 1966 cohort and 84 of 84 months, one child:

  PIA	Maximum	Rate at bc460e32	Rate now
  $2.70	$4.20 (1960, 80 of 80)	$1.90	$2.00
  $1,000	$1,600	$715	$746.60
  $1,688	$2,586.90 (the 2026 formula maximum)	$1,206.90	$1,207.20
  $1,800	$2,891.50	$1,287	$1,349.30

  _mother_father_comparison now changes only the caregiver it compares, and each nesting converts one more caregiver, so the recursion ends. The fix reaches the household entry, a disabled widow(er) deductee, a dual deductee on a temporary or permanent event, and RET's provisional ledger, where Sol's case now pays $746.60 instead of $715 and the final $750 stays.

• One call computes each comparison family once. A family depends only on which caregivers it has converted, so _care_scope opens one cache per call and a call with k caregivers runs at most 2^k families. Six caregivers ran 1,957 family computations without the cache and 64 with it. G sets no bound on how many caregivers a family holds.

• RET asks for family facts only where a minimum can reach the rate. A survivor child's OB and a mother's are both 3/4 of the PIA, a readjusted rate stops at its OB, and the new property finds no comparison above a mother's OB. So without a context RET now asks only below the lower of the widow(er)'s original rate and an entitled child's. Sol's widow at $905 of $1,000 beside a working child at $750 now computes and pays what G pays with the facts.

• Round 9's tests. test_each_caregiver_compares_alone cleared the other caregiver's care. It now keeps it, as test_each_caregiver_compares_with_only_its_entitlement_replaced, with the same amounts. Two RET records gave a child a $500 OB beside a widow's $1,000; they now carry the $750 a survivor child gets on that PIA.

Money moves this round, for a child-in-care widow(er) beside another caregiver who takes a deduction, and only there. A seeded sweep of 4,000 invented two-caregiver families moved 11, all on a month with a deduction; the 2,016 without one kept every outcome, refusals and input errors included.

Sol's needs_max items need no new call. Sol read 402(q)(5)(D) as replacing only the one entitlement, and no source clears another caregiver's care.

New invariants:

• Each caregiver's own comparison. Each caregiver gets the better of its reduced rate and what it would receive as a mother or father in the family where only its entitlement changes, under the month's events and households. The family and household entries agree.
• Bound. No comparison passes a mother's OB.
• Cost. One call computes each comparison family once, at most 2^k for k caregivers. The cache ends with its call and keeps records, households and events apart.
• RET. Without a context, RET asks for family facts only below the lower of the widow(er)'s original rate and an entitled child's. A month RET settles without the facts pays what G pays with them, by Hypothesis differential.

Local checks at 434a39c6: the 25 care-related G and RET modules pass (2,720 tests), rounds 9 and 10 pass (99 tests), and Black and ruff pass. Fleet ops holds heavy local runs, so CI runs the whole Track B suite and regenerates the conformance report byte for byte. 25 of the new module's 37 tests fail against bc460e32, and round 9's 62 all pass there. A cloud session ran the 22 listed mutations at 03530e8b (results). 19 failed a named test. Three change no result and stay out of the count as equivalent: dropping the month or the parameters from the comparison cache key, since every key in one cache carries the opening call's month and parameters, and giving the events key the ordinary tag, since the two keys differ in length. f5a18c84 records them in docs/design/track_b_g2_r2b_mutations.json.

Round 9 (after the eighth review)

Sol's review of aa86a4da found two mediums, and both reproduced. The first underpaid a supported widow(er) through G and RET. The second kept a counted row for a RIB no filling can make lawful, and round 8's own exception caused it.

• The minimum reads the month. 402(q)(5)(D) sets the minimum by what a mother or father would get "for such month". G took the comparison from the family before the month's deductions, so a child's full deduction raised a mother's rate and left the widow(er)'s. On PIA $1,000 and maximum $1,500 a widow(er) got $612.80 where the rule pays $750. The comparison now takes the month's events and households. Each caregiver compares alone (round 10 corrects this: another caregiver keeps its care facts), and a deductee keeps the ordinary minimum (GN 02603.050B.3).
• RET reads the minimum on an unbound month. A surviving divorced spouse sits outside the actual maximum, and the mother or father the spouse compares with sits inside, so the comparison can bind where the actual maximum doesn't. RET skipped G there. It now reaches G wherever a minimum can move, and FAMILY_CONTEXT_REQUIRED names the missing facts where it has none.
• A partial deduction refuses where it can move the rate. No capture carries a partial amount to a comparison rate. The ordinary comparison and an all-full comparison bound every reading, so a rate at or above the higher bound computes, and any other rate refuses with the new care_minimum_partial_deduction, keeping its row and weight.
• A month before 1983 keeps the PIA cap. RS 00615.101 rounds up to the next dime before 6/82, and that can't pass a PIA G holds to dimes. So $0.20 on PIA $0.10 in 1981 or 1982 now raises and leaves no row. Finality and positive delayed credits keep their rows, and the exact rate stays refused.

Money moves this round, for child-in-care widow(er)s on a month with another person's deduction, and only theirs. A dual comparison keeps its fixed rate, like the actual family's. R3's mother_father_rate_months stays a caller's declaration.

Sol's needs_max items each keep a standing ruling or resolve inside these fixes, so none reaches Max. Sol read the minimum as settled by the sources, and a named refusal for the partial case adopts no reading.

New invariants:

• Minimum. It equals the better of the reduced rate and what a mother or father receives this month under this month's events and households.
• Scope. It moves only the caregiver's own money, and only a current, entitled, undeducted widow(er) reaches a comparison.
• Partial deductions. They compute only where every amount between the two bounds agrees.
• RET trigger. RET asks for family facts wherever a minimum can move (round 10 narrows the request without a context, and it still asks on some months where G leaves the rate alone). With no caregiver, an unbound month equals G's answer, by differential.
• PIA cap. With no delayed credits, no RIB exceeds its PIA in any month.

Local checks at the tree that became bc460e32: all 14,261 Track B tests pass and 7 skip in a session process. Black and ruff pass. The conformance report regenerates with one new named witness and no lattice row moved. The cross-head comparison keeps the same stable hash as round 8, and that comparison holds no child-in-care case, so it can't see this round's money. 34 fresh mutations each failed a named test, and 34 of the new module's 62 tests fail against aa86a4da. Ten of a first pass's eleven survivors showed test gaps that new tests closed, and the eleventh stays out of the ledger as equivalent, held by a differential.

Round 8 (after the seventh review)

Sol's review of fbe491d4 found three mediums and a nit, and all three mediums reproduced. Each kept a counted row for a declaration no filling can make lawful. Round 7 caused the first and third by reading too far past an exact comparison.

• History leaves a RIB at or below its PIA. RS 00615.005C.2 says "The new money amount of reduction is subtracted from the new PIA", so with no delayed credits a rate above the PIA has no lawful filling. Round 7 dropped that cap with the exact rate. $333.40 on PIA $333.30 at cohort 1915 now raises and leaves no row, and so does $0.20 on PIA $0.10. The canonical refusal hid the same rate for a known cohort before 1916 with no declaration, and the check reaches that record too. Finality, positive delayed credits and months before 1983 keep their rows, and a rate at or below the PIA keeps its row under a history hold.
• A zero threshold fails every RIB. Act 202(g)(1)(C) needs a mother's own RIB below three-quarters of the PIA, so at PIA $0 no nonnegative RIB qualifies. A known cohort before 1916 still kept a row. F6 now settles at a zero tested PIA, and the preflight tests a RIB it can't compute at zero, the lowest RIB there is. A positive threshold passes at zero and keeps its row, and a deemed widow(er) PIA counts as the tested PIA. The same line reaches early delayed credits with no reduction.
• A reduced DIB needs a month before it. RS 00615.010 counts "months of WIB entitlement before the first MOET to DIB", and RS 00615.005 dates each route: a RIB from 11/56 at 62, a WIB from 9/65 at 60, a disabled WIB from 2/68 at 50, and the reduced DIB itself from 9/65. So $404.90 on PIA $405 for cohort 1974 in January 2024 raises and February keeps its row. $99.90 on PIA $100 in February 1958, 1966 and 1968 for cohorts 1908, 1916 and 1918 raises too, and March 1968 keeps its row.

The session renamed round 6's test_only_finality_lifts_an_nh_rate_cap_outside_money_history_scope, which was Sol's nit.

The floor reads the payment month, because first_dib_entitlement holds the first-ever DIB month and RS 00615.010 counts from the most recent period. Two limits stay on purpose. Every hold shares the earliest route, because the schema doesn't say which route a hold took. A modern cohort keeps the WIB route, because the schema omits the onset that ends it. Each one leaves a named refusal, and no money moves either way.

Sol's needs_max items each keep a standing ruling or resolve inside these fixes, so none reaches Max.

New invariants:

• PIA cap. With no delayed credits, no history admits a RIB above its PIA, declared or implied by a known cohort. Finality, positive credits and months before 1983 stay open.
• Zero threshold. A zero tested PIA fails every RIB on every filling, and only a zero tested PIA does.
• Route floor. A route opens the month after its own first month, on its own age and date, and no route opens before September 1965. Month counts written out in the test check this against G across every cohort from 1880.
• One DIB rate. Before a route opens, a DIB rate equals its PIA or raises and leaves no row. Unknown facts stay open, and no route limits a hold that needs no predecessor.

Local checks at the tree that became aa86a4da: all 14,193 Track B tests pass and 7 skip in a session process. Black and ruff pass, the conformance report regenerates byte-identically, and the cross-head comparison matches master with the same stable hash as round 7. 39 fresh mutations each failed a named test, and 96 of the new module's 148 tests fail against fbe491d4. A first mutation pass killed 38 of 39, and the survivor gained a test.

Round 7 (after the sixth review)

Sol's review of 3212f823 found three mediums, and all three reproduced. The session read each one against its capture before changing the rule. Two lost a lawful row by comparing a rate with an amount the declaration had already put in doubt. One kept a row no filling can make lawful.

• A declared history reaches past an omitted cohort. An omitted cohort keeps today's formula, but a declared OWN_RIB_HISTORY_BEFORE_1978 or REDUCED_BENEFIT_HISTORY_BEFORE_1978 says RS 00615.005C.2's money reduction set the amount, and that reduction can exceed today's fraction. PIA $123.40 at RF 8 in December 1977, every captured COLA through 1999 and an upward recomputation to PIA $333.30 give $318.50 on all sixteen rounding paths, against $318.40 today. That declaration raised and lost its row. It now keeps its reason and weight 7, in both directions, for an old-age benefit with a positive PIA and a remaining reduction, in a cohort before 1916 or none. Cohort 1916 keeps the cap, and a DIB keeps its PIA as its cap. Round 6's claim that only finality lifts a cap was wrong, and the note says so.
• Every test of an actual own RIB shares the carryover. Act 202(g)(1)(C) compares a mother's or father's actual own RIB, and RS 00209.001 a parent's. Round 6 opened the carryover for widow(er)s alone. A mother with own PIA $400 and a prior WIB on PIA $300 carries $359.10 against an ordinary $373.30, and the threshold of $360 sits between them. That declaration raised and lost its row. It now keeps dual_entitlement_sequence, in a pre-FRA year too. A spouse's raw own-PIA test and a child's lack of one stay settled.
• Age rules out a prior reduced benefit. RS 00615.010 says "DIB is not reduced unless there was prior entitlement to reduced RIB (or WIB prior to 1/90)", and RS 00615.005 starts those benefits no earlier than age 50. A DIB of $404.90 on PIA $405 for cohort 1975 in 2024 counted as a refusal. It now raises before evaluate_ret and leaves no row. A rate at the PIA keeps its named refusal. Workers' compensation and finality need no prior benefit, so each keeps a young row, even beside a dual declaration.

The session extended the same classes past the findings. F6 reads the same own RIB as F3, so a declared history now opens it too. REDUCED_BENEFIT_HISTORY_BEFORE_1978 opens F6 in the carryover scope, because it carries through the rule that already opened F3. The age floor covers all five holds that work through a prior reduced benefit.

One choice for the reviewer to check: the floor takes the earliest age on any route, 50, even for DIB_AFTER_REDUCED_RIB, which names a RIB that starts at 62. The schema has no separate declaration for a DIB after a reduced WIB under 404.411(b)(2), so that row stays a named refusal from 50 through 61. The direction rule decides this, and no money moves either way.

What stayed:

• An undated input with no history hold keeps today's formula. 404.411(c)(2) reduces an own RIB "by the larger of the following", so the carryover only lowers it.
• G still takes entitlement as declared, so an RIB below age 62 computes with no hold, as it did before this round, and keeps a named refusal under a carryover hold. An entitlement-age check would reach every record, so it sits outside this fix.

Sol's needs_max items each keep a standing ruling or resolve inside these fixes, so none reaches Max.

New invariants:

• History scope. Under a declared pre-1978 history, every rate on an old-age benefit with a positive PIA and a remaining reduction, in a cohort before 1916 or none, keeps its row. Past that scope, a reduction-only hold keeps the cap.
• Own-RIB tests. F6 opens under a carryover hold for exactly the roles whose test reads an actual own RIB, for cohorts before 1928 or none, and stays settled at a zero PIA. A table written out in the test checks this against G.
• Age floor. For cohort Y, F2 stays settled below the PIA in every month before January of year Y + 50, under every prior-reduced-benefit hold, and no age limits a hold that needs no such benefit. A table written out in the test checks this too.
• Young DIB. Before that floor, a DIB rate equals its PIA or raises, and it leaves no row.

Local checks at the tree that became fbe491d4: all 14,032 Track B tests pass and 7 skip in a session process. Black and ruff pass, the conformance report regenerates byte-identically, the cross-head comparison matches master, and 42 fresh mutations each failed a named test. Against 3212f823, 44 of the new module's 158 tests fail. A first mutation pass killed 39 of 43: one survivor showed a redundant month comparison, so the rule now compares years, and three exposed test gaps that each gained a test.

Round 6 (after the fifth review)

Sol's review of a135519f found three mediums, and all three reproduced. Each came from a fact table that treated a fact as wholly open or wholly settled, where the sources settle one direction of it.

• A widow's DRC clause doesn't reach a child's original rate. RS 00615.712 says "The child's original rate is $300" on a PIA that stays $400, and the clause protects the adjusted cash. A $300.10 original against OB $300 counted as a refusal. It now raises under a declared clause and under unknown history, as it does with no clause. A widow(er)'s own OB stays open, because the same page gives her $400 and, with DRCs, $410.
• A prior reduced WIB can lower an NH's own RIB. 20 CFR 404.411(c)(2) keeps the carryover before cohort 1928 and reaches someone with no current WIB. Round 5 opened this for another person's own RIB and missed the NH's. PIA $400, deceased PIA $300, WIB at 60 and RIB at 64 gives $359.10 against an ordinary $373.30. That declaration raised and lost its row. It now keeps dual_entitlement_sequence, weight kept. Cohort 1928 stays settled: "There is no further reduction."
• A reducing hold keeps its cap. A prior reduced RIB or workers' compensation can lower a DIB and can't raise it, yet a DIB of $4.10 on PIA $4 counted as a refusal. It now raises. Every reduction-only hold leaves equality open below the rate and keeps the rate as a cap. Only administrative finality lifts a cap.

The session extended the same class past the findings. Sol's exploratory probe of a DIB after a reduced WIB didn't enter its verdict, but it reproduces: $398.10 on PIA $400 raised under dual_entitlement_sequence. 404.411(b) reduces that DIB, and the schema omits the onset that scopes it, so the row now stays in every cohort. The two pre-1978 history reasons open the same comparison before cohort 1928 only, because a later cohort reached age 50 after 1977.

Protected cash stays a refusal. A child paid $300.10 on OB $300, and a deduction above that OB, keep the named refusal, because the capture states no cap on protected cash. A stricter proof could drop those rows, and no amount moves either way.

Sol's three new needs_max items are these fixes, and Sol called each source-settled, so none reaches Max.

New invariants:

• Direction. Under a reduction-only hold, an NH rate above its ordinary rate raises, and a rate at or below it keeps its row and refusal. Only finality lifts the cap.
• Carryover reach. Every rate 404.411(c)(2)(ii) can reach stays a counted refusal, with the preflight removed or not.
• Original rates. A nonwidow's OB stays settled under widow DRC protection or unknown history.
• Every reason. Each UnsupportedReason classifies a lower DIB, a lower RIB and a rate above the cap against an expectation written out in the test, not read from G's table.

Two existing assertions moved, and each now states both sides. test_protected_widow_cannot_be_excluded_from_unknown_drc_history asserts the input error and the finality refusal on the matching child. The round 4 property keeps an input error for a DIB above the PIA under workers' compensation.

Local checks at the tree that became 3212f823: all 13,874 Track B tests pass and 7 skip in a session process. Black and ruff pass, the conformance report regenerates byte-identically, the cross-head comparison matches master, and 38 fresh mutations each failed a named test. Against a135519f, 50 of the new module's 224 tests fail.

Round 5 (after the fourth review)

Sol's review of e3315baf confirmed round 3's three counterexamples, the $175 and $192.10 corrections and the composition refusal. It found one medium: a held refusal still masked contradictions in RIB gross, auxiliary original rates and widow eligibility. Reproducing that showed round 4 had already gone too far the other way, so the fix reverses part of the finding.

• The problem. RS 00615.754A.3's first example under administrative finality (PIA $750, MAX $1,312.50, NH rate $1,000, child $375.50) raised InvalidFamilyInput at e3315baf, and at 1ce508e5 it refused by name. The capture says "the rate to the NH is protected by administrative finality and cannot be changed", so a protected rate rests on a PIA other than the declared one.
• The rule. A preflight compares a fact before a held refusal only when nothing declared on the record or that beneficiary can lawfully change it. A wrong input error drops a lawful row, and a wrong refusal counts a row that shouldn't exist.
• The table. _PREFLIGHT_FACT_UNSETTLERS classifies every RecordCondition, BeneficiaryCondition and UnsupportedReason against six facts: NH original, DIB gross, RIB gross, auxiliary original, spouse raw own-PIA eligibility and other own-benefit entitlement. A new enum member fails a test until someone classifies it. Each deferred reason applies only within its own person, role, record kind and payment period.
• The check. _check_settled_family_facts compares settled facts through G's validated helpers and catches only FamilyConfigurationUnsupported. The path with the preflight removed gives the same valid outcomes and refusals.
• The deduction bound. The ordinary OB bound follows the same table, because a protected rate isn't bounded by correct-PIA OB. Strict withholding of actual gross still runs after G.

Readings this round:

• us:oasdi-finality-protected-rates-before-coverage: under finality, a rate that differs from the declared PIA stays administrative_finality, one row, weight kept. This is the session's single reading under Max's 10/20 delegation, logged in RULINGS.md.
• RS 00615.010's sole-survivor alternative can exceed ordinary OB, so a declared legacy widow's $4.10 against OB $4 keeps its historical refusal. A child's cap stays exact.
• An unresolved parent count keeps the one-parent 82.5% upper bound, because 75% and 82.5% are the only ordinary shares.

Invented examples:

• PIA $1,000, gross $800, DIB_AFTER_REDUCED_RIB: dib_after_reduced_rib, one row, weight kept. The same gross under a maximum-only hold: InvalidFamilyInput, no row.
• PIA $4, widow original and gross $3.30: eligibility_before_1983 in January 1972, because RS 00615.005A.2 set 82 1/2%. InvalidFamilyInput in January 1973, because A.5 set 100%.

Nine tests under round 4's reading split into a protected case with its exact refusal, row and weight, and a settled case that keeps the input error. No money moves: the cross-head comparison keeps all 240 R2 and 240 R3 rows, and G's conformance artifact stays byte-identical.

New invariants:

• Preflight neutrality. Removing the preflight changes no valid outcome and no refusal.
• Table completeness. Every condition and held reason has an explicit classification.
• Scope. A protection reaches only its beneficiary, month and declared conditions.

Local checks at a135519f: all 13,650 Track B tests pass and 7 skip in a session process. Black and ruff pass, the cross-head comparison matches master, and the lane's 30 mutations each failed a named test.

Round 4 (after the third review)

Sol's review of 1ce508e5 confirmed all three round-3 fixes and found three new mediums, plus a question on how two POMS exceptions compose. e3315baf fixes all four.

• Outside deductions. A divorced spouse sits outside the family maximum, but that spouse's deduction still counted as an "other deduction" under GN 02603.050A.1, so a governed child got $175 rather than $200. Act 203(a)(3)(C) and GN 02603.020B keep outside people out of the governed decision, so every decision now reads subject events only. Outside events still apply to their own cash.
• NH reservations. The same audit found an outside event was what activated a subject's NH reservation. A reservation now reduces cash with or without an event, and it still refuses with a subject's age reduction.
• Entitlement before held refusals. apply_ret_year compares declared NH entitlement with RET before it computes any G money, in both directions, so a held refusal can no longer mask a contradiction. One helper now serves G and RET. The lane's audit of the whole loop added the same preflight for spouse eligibility under the raw own-PIA test, NH original rates and DIB gross rates. The checks that need G's money stay after it.
• One cohort per person. RecordYear now rejects two known cohorts for one person, across months and across record and own-benefit fields. A missing cohort adds no constraint.
• A new refusal. GN 02603.050A.1 and A.2 don't settle how a sole full permanent deduction composes with a zero-rate dual row. sole_full_deduction_zero_dual_composition refuses only where the two readings pay differently, and the rule computes where they agree. RULINGS logs this as us:oasdi-sole-full-deduction-zero-dual-composition.

Invented examples:

• PIA $400, MAX $600, spouse RF36, child, outside divorced spouse RF60, full deductions on both: the child gets $200, and the record pays $600.
• Survivor PIA $400, MAX $600, widow, three children, outside surviving divorced spouse: each child gets $200, not $192.10.
• PIA $400, MAX $600, spouse RF36, child and zero-dual child: A.1 pays $175 and A.2-first pays $200, so the rule refuses by name, one row, weight kept.

New invariants:

• Outside independence. Outside events leave every governed payment unchanged, in any order, for all three record kinds.
• NH-only cash. It equals ordinary cash less the reservation, and outside facts can't activate a deduction.
• Composition. The refusal fires exactly when the two exact payments differ.
• Preflight. No held condition masks an NH, spouse or direct-rate contradiction, and every monthly declaration validates before the first G computation.
• Cohort. One identity has one known cohort across all month and field pairs.

Local checks at e3315baf: all 13,341 tests across the 104 Track B modules pass (7 skip), and black and ruff pass on the round's Python files. The lane's 11 new mutations were all caught. The conformance report changes only for the new reason, and 240 R2 and 240 R3 cross-head results stay unchanged. One existing test moved its reason count from 37 to 38. The tier files add this round's 637 unit tests; the coordinator's slot recount replaces them.

Round 3 (after the second review)

Sol's review of bbcdf7f4 kept every round-1 fix and reading, and found four mediums. 7fa124e3 and 872cebc7 had already fixed the stale conformance hash. 1ce508e5 fixes the other three.

• FRA against G facts. R2 accepted an FRA declaration that the family's G birth cohort contradicted, which let an own-earnings deduction run after FRA. RecordYear now checks the NH and every auxiliary against the twelve months each cohort allows, and an input error comes before any coverage refusal. Applied own delayed credits prove FRA by the snapshot month. A deceased worker's credits and old age reductions prove nothing about a survivor's age. Act 203(f)(9) and RS 02501.021B.3 apply the old-age FRA to every role, so this needed no ruling.
• Own-work event at the OB bound. A payable plus NH reservation equal to the original benefit means nothing was withheld, so that's now an input error, even on a held record.
• Divorced spouse outside the maximum. An age-reduced divorced spouse could start operational protection for people whose benefits Act 203(a)(3)(C) determines as if that spouse were absent. Operational membership, the age basis, the age trigger and the person count now skip anyone outside the maximum. That person's own rate stays ordinary, and the literal reading doesn't move.

New invariants:

• FRA classification. A declaration passes exactly when some possible birthday satisfies it, checked against an independent birthday enumeration.
• As-if-absent. Adding or removing an outside beneficiary changes no other row, protected total, refusal or guard history, in either order.

Local checks at 1ce508e5: all 12,704 tests across the 102 Track B modules pass (7 skip), and black and ruff pass on the round's Python files. The lane's 11 new mutations were all caught. All 480 literal rows and 240 R2 and 240 R3 cross-head results stay unchanged, and the conformance report regenerates byte for byte. The tier files add this round's 176 unit tests; the coordinator's slot recount replaces them.

Round 2 (after the first review)

• Two-record entitlement. With RETFamilyMonth context, R2 derives it from G's admitted own-benefit facts, for actual and estimated excess. two_record_entitlement is now optional: a value that contradicts G's facts is InvalidFamilyInput, and a consistent one refuses by name.
• No child in care. Act 203(c)(2) and 20 CFR 404.421(a) rule out a deduction from an age-reduced benefit, so NO_CHILD_IN_CARE on such a spouse is InvalidFamilyInput. The rule derives age status from supplied birth facts and delayed credits. BenefitDeduction.under_full_retirement_age is required only when those leave age unknown.
• Saving clause. A qualifying fall with a membership change at the first trigger refuses by name and keeps its denominator row. The rule checks own benefits in both the prior and the current month before it sets or extends a protection. Membership-only declines without a PIA increase stay admitted.
• R1 year. The rule looks up the R1 parameter year before it releases any held G refusal, so an unsupported year stays an input error with no denominator row.
• Zero-amount events. R2 emits only positive events, so every layer rejects a zero-amount own-work event as an input error.
• Notes. The R2 note's step 5 now describes the conditional readjustment through RETFamilyMonth. The G note, the docstring and the refusal notes now call the reservation case deferred coverage.
• Unchanged results, from the lane's ledger docs/design/track_b_g2_r2b_verification.json. All 356,400 G conformance rows are byte-identical, and the cross-head harness shows 240 R2 and 240 R3 results unchanged with the six former refusals computed. Both ran against master 1ec57a5d; the round-2 review reruns them at this head.
• Recovery note. The fix lane finished on 10-25 and left its work uncommitted, and the orchestrator recovered it from Subfleet's salvage ref on 10-31. The lane's full report no longer exists. The committed ledger and docs/design/track_b_g2_r2b_mutations.json keep its results and its 15 new mutations.
• Tiers. The counts at this head come from a three-way sum of the branch's delta and master, not a recount. The coordinator's slot recounts them.
• Local checks at bbcdf7f4. 87 tests pass across the four round-2 modules, and black and ruff pass on the 42 changed Python files. A one-off audit hook over a sample of those modules counted no opens of the barred names. CI and the round-2 review cover the rest.
• Conformance refresh at 872cebc7. CI failed at bbcdf7f4 on the byte test for docs/design/track_b_g_conformance_report.json: round 2 edited the registry YAML after the lane's last conformance run, so the report kept an old registry hash. 7fa124e3 regenerates the report. One line differs and all 356,400 rows match. 872cebc7 records the new hashes in docs/design/track_b_g2_r2b_verification.json. Neither commit changes Python.

Checks (local, at f3b9a719)

Suite	Result
G files, the four-layer notes test and the shared schema file	8,672 passed after correcting the schema file's guard-reader inventory for the new reading property
R2, R3 and birth-evidence	2,403 passed
Tier policy	passed

• Black and ruff are clean, and the conformance report regenerates byte for byte.

• Cost, measured back to back by the lane under load. G regeneration: 152 → 173 CPU seconds. R2 tests: 87 → 114 CPU seconds, for 786 → 818 tests.

• Tiers:

  Tier	Tests
  unit	18,629
  artifact	4,253
  integration_psid	1,450
  reproduction_legacy	520
  oracle_policyengine	308
  Total	25,160

• Protected files are untouched.

axiom: n/a: not a country-model change. G and R2 are Python statutory references per d515, and rulespec-us has no 42 U.S.C. 403 encoding.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Nov 2, 2026 6:18pm UTC

[MaxGhenis]

Ready for hub review
Independent cloud review (Opus 5.5) of 03530e8: APPROVE

Sol's round-9 findings

Severity	Location	Issue	Resolved
medium	src/populace_dynamics/track_b/gross_benefits.py:3923 (_mother_father_comparison)	The comparison cleared other caregivers' child_in_care, which overstated a deducted caregiver's age reserve and underpaid the focal caregiver.	yes
low	src/populace_dynamics/track_b/ret_ledger.py:1148 (_care_minimum_can_move)	Without context, RET requested family facts for any reduced widow rate, even above the highest possible mother/father amount.	yes

My findings (none of medium or higher severity)

• low docs/design/track_b_r2_ret_ledger.md:2761: The nested composition is not called out as a composition choice. When one caregiver's 402(q)(5)(D) hypothetical holds a second caregiver, that second caregiver's minimum is recomputed with the first already converted to a mother or father. The note describes this mechanism, but it doesn't say that carrying the second caregiver's actual-world minimum would pay differently. No source discusses two caregivers. I read the nested form as the literal counterfactual, so I'm not raising it as an unsettled case.
• nit docs/design/track_b_r2_ret_ledger.md:2821: The round-10 note cites scratch/review/round10_mutate.py, which is gitignored and not in the repository. Round 10's mutation results are not yet in docs/design/track_b_g2_r2b_mutations.json, though the PR says a later commit will add them.

Gates

• Tests: 82 named modules, 12,918 passed and 8 skipped. Every skip is the policyengine-us oracle.
• Conformance: regenerated byte-identical (b5dfc011…).
• Cross-head: against origin/master dd9c7be, 240 R2 and 240 R3 rows stable, and the 6 former refusals now compute.
• Black and ruff: clean on 53 files.
• Captures: 148 of 148 match the manifest.
• Mutations: 7 of mine, all killed.
• Tracked tree: clean.

{
 "verdict": "APPROVE",
 "head": "03530e8bd99db9608ecfb60ae4f17508fde1b3be",
 "reviewer": "cloud Opus 5.5, independent review",
 "summary": "I reviewed the whole diff against origin/master (63 files) and focused hardest on round 10 (434a39c): the care comparison now keeps other caregivers' care facts, there is a per-call comparison cache, and RET's request bound has moved. Both of Sol's round-9 findings are resolved. I rebuilt every counterexample through the family, household and RET entry points, and each now pays the right amount: 1349.30/1349, 2.00/2, 746.60/746 provisional with 750 final, and 1207.20/1207 on the 2026 formula maximum. Sol's widow at 905 beside a child at 750 now computes, pays 905, and withholds the child's 750. I hand-derived the 1800/2891.50 case and GN 02603.060 C.2 (225.30, 182.80) from the captures. The registry checks each published figure against the cited capture text. My own properties passed: 400 Hypothesis families of 2-3 caregivers and 1-2 children, with mixed full and partial, temporary and permanent events across households. They checked permutation invariance, determinism, each caregiver at or above its public-API comparison, and no comparison above a mother's OB. 360 cases computed and 40 refused by name. A refused RET row stays in the shared denominator. The gates passed: 82 named modules gave 12918 passed and 8 skipped. Every skip is the policyengine-us oracle, which is absent in this VM. The conformance report regenerated byte-identical (sha256 b5dfc011...). Cross-head against origin/master dd9c7be gave 240 R2 and 240 R3 rows stable, and the six former part_b refusals now compute. Black and ruff are clean on 53 files, all 148 captures match their manifests, and no protected path changed. All 7 of my mutations were killed, and the tree was clean after each revert. I found nothing of medium or higher severity. I have one low disclosure point, on how the nested hypothetical composes, and one nit about a design note that cites an untracked scratch file. I used Python 3.14.6 via uv. I opened no barred path and made no population claim.",
 "sol_findings": [
  {
   "severity": "medium",
   "location": "src/populace_dynamics/track_b/gross_benefits.py:3923 (_mother_father_comparison)",
   "issue": "The comparison cleared other caregivers' child_in_care, which overstated a deducted caregiver's age reserve and underpaid the focal caregiver.",
   "resolved": true,
   "evidence": "PYTHONPATH=$PWD/src:$PWD OMP_NUM_THREADS=1 POLARS_MAX_THREADS=1 OMP_WAIT_POLICY=PASSIVE POPULACE_DYNAMICS_EPUF_DIR=/nonexistent/epuf POPULACE_DYNAMICS_PSID_DIR=/nonexistent/psid $PY -m pytest -p no:cacheprovider -p no:xdist -q -s scratch/review/test_review_care.py -> 9 passed: former 1349.30/whole 1349 (PIA 1800, MAX 2891.50, 1966 84/84, temporary spouse event, same household); minimized PIA 2.70/MAX 4.20 gives 2 through family and household entries; PIA 1000/MAX 1600 1960 80/80 gives 746.60; formula MAX 2586.90 on PIA 1688 gives 1207.20; RET provisional_net 746.60, provisional_payment 746, net_due 750; hand derivation reserve 1156.60-963.80=192.80 gives floor_dime(1350*2698.70/2700)=1349.30. The nearby 400-case Hypothesis property over 2-3 caregivers passed. Mutation M1, which restores the clearing, fails 4 tests."
  },
  {
   "severity": "low",
   "location": "src/populace_dynamics/track_b/ret_ledger.py:1148 (_care_minimum_can_move)",
   "issue": "Without context, RET requested family facts for any reduced widow rate, even above the highest possible mother/father amount.",
   "resolved": true,
   "evidence": "scratch test_sol_low_trigger: widow 905/1000 beside child 750/750 with January wages 25980 now gives supported=True. Round-10 tests: 749.90 and 600 still refuse with FAMILY_CONTEXT_REQUIRED, and 750 computes. Bound reasoning: child OB = mother OB = floor_dime(0.75*PIA) (original_benefit, gross_benefits.py:3106), and a readjusted rate is capped at its OB, so gross >= child OB means the minimum cannot bind. Mutations M3 (min child) and M4 (<=) are both killed."
  }
 ],
 "executed": [
  {
   "command": "git rev-parse HEAD",
   "result": "03530e8bd99db9608ecfb60ae4f17508fde1b3be"
  },
  {
   "command": "git diff --name-only origin/master...HEAD | grep -E 'gates.yaml|engine/loop.py|engine/steps.py|^runs/'",
   "result": "no output; protected paths untouched; no scratch, report or bundle files committed"
  },
  {
   "command": "PYTHONPATH=$PWD/src:$PWD OMP_NUM_THREADS=1 POLARS_MAX_THREADS=1 OMP_WAIT_POLICY=PASSIVE POPULACE_DYNAMICS_EPUF_DIR=/nonexistent/epuf POPULACE_DYNAMICS_PSID_DIR=/nonexistent/psid HYPOTHESIS_STORAGE_DIRECTORY=$PWD/scratch/review/hyp $PY -m pytest -p no:cacheprovider -q -n 4 <82 named modules: tests/test_track_b_gross_benefits*.py, test_track_b_refusal_notes.py, test_track_b_input_schema.py, test_track_b_ret_*.py, test_track_b_arf*.py, test_track_b_recompute*.py, test_track_b_r3_*.py>",
   "result": "exit 0: 12918 passed, 8 skipped in 202s; skips are all tests/test_track_b_gross_benefits_oracle.py (no policyengine-us tree)"
  },
  {
   "command": "PYTHONPATH=$PWD/src:$PWD OMP_NUM_THREADS=1 POLARS_MAX_THREADS=1 OMP_WAIT_POLICY=PASSIVE POPULACE_DYNAMICS_EPUF_DIR=/nonexistent/epuf POPULACE_DYNAMICS_PSID_DIR=/nonexistent/psid $PY scripts/track_b_g_conformance_report.py --output scratch/review/conformance.json && cmp scratch/review/conformance.json docs/design/track_b_g_conformance_report.json",
   "result": "exit 0, 356400 configurations, IDENTICAL, sha256 b5dfc011181eb5fdaf795719ae7557dbc23d0a680058f24c6a5aa03ba28f2a70"
  },
  {
   "command": "git worktree add --detach ../master origin/master (dd9c7be); PYTHONPATH=$PWD/src:$PWD OMP_NUM_THREADS=1 POLARS_MAX_THREADS=1 OMP_WAIT_POLICY=PASSIVE POPULACE_DYNAMICS_EPUF_DIR=/nonexistent/epuf POPULACE_DYNAMICS_PSID_DIR=/nonexistent/psid $PY scripts/track_b_r2_cross_head.py --baseline-root ../master --output scratch/review/cross_head.json",
   "result": "exit 0; r2_stable_rows 240, r3_stable_rows 240, identical_declared_output_bytes true, stable_sha256 799fc9e23a902ac1ca0c2563579ceb094d0dbcd631a912305c40062cf21a5f55; 6 transitions part_b -> supported"
  },
  {
   "command": "$PY -m black -l 79 --check <53 changed .py files>; $PY -m ruff check <same>",
   "result": "53 files unchanged; All checks passed"
  },
  {
   "command": "manifest sha256/bytes check over tests/data/track_b/*_sources/manifest.json",
   "result": "148 entries, all match, no unlisted captures"
  },
  {
   "command": "PYTHONPATH=$PWD/src:$PWD OMP_NUM_THREADS=1 POLARS_MAX_THREADS=1 OMP_WAIT_POLICY=PASSIVE POPULACE_DYNAMICS_EPUF_DIR=/nonexistent/epuf POPULACE_DYNAMICS_PSID_DIR=/nonexistent/psid $PY -m pytest -p no:cacheprovider -p no:xdist -q -s scratch/review/test_review_care.py",
   "result": "9 passed; Hypothesis STATS ok=360, refused=40 (care_minimum_partial_deduction)"
  },
  {
   "command": "$PY scratch/review/mutate.py (each mutation applied, rounds 9+10 modules run -x -n 4, then git checkout -- file)",
   "result": "7/7 killed: M1 clear other caregivers' care (4 failed); M2 events cache key drops households (1 failed); M3 RET bound min(children) (1 failed); M4 RET bound <= (3 failed); M5 floor ignores full settlement (4 failed); M6 ordinary cache key drops state (2 failed); M7 other deductee's reserve drops age reduction (4 failed). git status --porcelain empty"
  },
  {
   "command": "alternative-reading probe (family_benefits on actual and former-as-mother families)",
   "result": "spouse payable 1350 in the actual world vs 963.80 in former's hypothetical; carrying the actual-world minimum would pay former 1350 instead of 1349.30"
  },
  {
   "command": "git status --porcelain",
   "result": "empty"
  }
 ],
 "findings": [
  {
   "severity": "low",
   "location": "docs/design/track_b_r2_ret_ledger.md:2761",
   "issue": "The nested composition is not called out as a composition choice. When one caregiver's 402(q)(5)(D) hypothetical holds a second caregiver, that second caregiver's minimum is recomputed with the first already converted to a mother or father. The note describes this mechanism, but it doesn't say that carrying the second caregiver's actual-world minimum would pay differently. No source discusses two caregivers. I read the nested form as the literal counterfactual, so I'm not raising it as an unsettled case.",
   "counterexample": "PIA 1800, MAX 2891.50, 2026-01; former=SURVIVING_DIVORCED_SPOUSE and spouse=WIDOW, both 1966 84/84 with child_in_care='child'; one child; temporary full own-work event on spouse; all in one household. Head (nested) pays former 1349.30, whole dollar 1349. Carrying spouse's actual-world payable of 1350 (reserve 0) would pay 1350, whole dollar 1350. Executed.",
   "fix": "Add one sentence to the round-10 note naming the nested composition, the alternative, and this $0.70 example. No code change."
  },
  {
   "severity": "nit",
   "location": "docs/design/track_b_r2_ret_ledger.md:2821",
   "issue": "The round-10 note cites `scratch/review/round10_mutate.py`, which is gitignored and not in the repository. Round 10's mutation results are not yet in docs/design/track_b_g2_r2b_mutations.json, though the PR says a later commit will add them.",
   "counterexample": "git ls-files scratch prints nothing.",
   "fix": "Record round 10's mutations in the committed mutations ledger and cite that file."
  }
 ],
 "needs_max": [
  {
   "item": "Other caregivers in the hypothetical (round 10, nested composition)",
   "assessment": "keep; add the disclosure in findings[0]",
   "source_text": "402(q)(5)(D): 'below the amount to which he or she would have been entitled had he or she been entitled for such month to mother's or father's insurance benefits'; RS 00615.340 does not address two caregivers.",
   "conclusion": "The hypothetical replaces one entitlement. Applying the same subsection to the other caregiver inside that hypothetical is the literal reading. Carrying an actual-world minimum would mix the actual world with the hypothetical one. Example: 1349.30 nested versus 1350 alternative. No ruling is needed, only a sentence in the note."
  },
  {
   "item": "RET context-request bound",
   "assessment": "resolve",
   "source_text": "402(d)(2) and 402(g)(2) both give 3/4 of the PIA; GN 02603.050 NOTE: 'beneficiaries are still limited to the original benefit amount'.",
   "conclusion": "Settled. A widow at or above a child's OB can't be raised by a mother/father minimum. With 905 against 750, RET computes and agrees with G."
  },
  {
   "item": "us:oasdi-ret-temporary-partial-deduction",
   "assessment": "keep",
   "source_text": "GN 02603.050D.2: 'there are no partial deductions for temporary work deductions'; RS 02501.160 Example 2 pays a partial temporary month.",
   "conclusion": "The tension is genuine. Following the specific worked example is defensible, and R2's provisional full suspension, with a named refusal on the partial path, discloses the choice."
  },
  {
   "item": "us:oasdi-saving-clause-operational-rate-rounding",
   "assessment": "keep",
   "source_text": "RS 00630.400: 'Difference ÷ By the Number of Auxiliaries (rounded)' gives no direction; 203(a)(5) requires the smallest amount that keeps the total from falling.",
   "conclusion": "Rounding up to the least sufficient dime is the only direction that meets 203(a)(5). LITERAL_REFUSAL stays as the alternative under d1338."
  },
  {
   "item": "us:oasdi-finality-protected-rates-before-coverage (Appendix B)",
   "assessment": "keep",
   "source_text": "RS 00615.754A.3: NH keeps $1,000 although 'the correct PIA is really $750.00'; the rate 'is protected by administrative finality and cannot be changed'.",
   "conclusion": "The capture itself shows a lawful rate that differs from the correct PIA. Treating that gap as an input error would drop a lawful row, so the named refusal with its weight is right."
  },
  {
   "item": "us:oasdi-sole-full-deduction-zero-dual-composition (Appendix B)",
   "assessment": "keep",
   "source_text": "GN 02603.050A.1: 'no other deduction is involved for any beneficiary'; A.2: zero dual rate disregarded 'regardless of other deductions'.",
   "conclusion": "Both readings are defensible. I re-derived the PIA 400 / MAX 600 / spouse RF36 example: reserving the age reduction gives the child 175, and applying A.2 first gives 200 (record 575 versus 600). Refusing where the payments differ is the safer default."
  }
 ]
}

---

Generated by Claude Code

[MaxGhenis]

Ready for hub review

Cloud run of the round 10 mutation list and the Track B gate at 03530e8bd99db9608ecfb60ae4f17508fde1b3be. The branch head on GitHub was 03530e8bd99db9608ecfb60ae4f17508fde1b3be when I checked, the same SHA the brief gives, and every run used that SHA (detached worktree).

Environment. nproc 4; Python 3.14.6 (uv venv); pytest 9.1.1, Hypothesis 6.168.3, numpy 2.5.1, pandas 3.0.3, scipy 1.18.0, scikit-learn 1.9.0 (also pytest-xdist 3.8.0, pyyaml 6.0.3, openpyxl 3.1.5).

Hashes. All 4 file hashes in the brief's #563 table matched, and both #563 script hashes matched (run_round10_named.py f640418c…, round10_mutate.py a4286c42…).

Mutation	Exit	First failing test	Open audit (restricted / Popen / os.system)
bound_any_beneficiary	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_a_rate_past_any_minimum_needs_no_family_facts	0 / 0 / 0
bound_at_equality	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_a_childs_original_rate_bounds_the_request[BenefitType.WIDOW-gross0-True]	0 / 0 / 0
bound_child_only	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_a_widows_own_original_rate_still_bounds_the_request	0 / 0 / 0
bound_lowest_child	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_the_higher_of_two_declared_child_rates_bounds_the_request	0 / 0 / 0
bound_original_only	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_a_rate_past_any_minimum_needs_no_family_facts	0 / 0 / 0
bound_skips_the_child_check	1	tests/test_track_b_ret_ledger_fix_round_9.py::test_no_minimum_can_move_on_these_records[no	0 / 0 / 0
cache_never_stores	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_each_comparison_family_runs_once[events0-2]	0 / 0 / 0
cache_recomputes_each_hit	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_each_comparison_family_runs_once[events0-2]	0 / 0 / 0
comparison_clears_disabled_widow_care	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_a_deducted_disabled_widow_keeps_the_minimum[1800-2891.50-expected0]	0 / 0 / 0
comparison_clears_other_care	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_another_deducted_caregiver_keeps_its_minimum	0 / 0 / 0
comparison_clears_widow_care	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_another_deducted_caregiver_keeps_its_minimum	0 / 0 / 0
deduction_entry_unscoped	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_another_deducted_caregiver_keeps_its_minimum	0 / 0 / 0
event_key_drops_events	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_one_scope_keeps_records_households_and_events_apart	0 / 0 / 0
event_key_drops_households	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_one_scope_keeps_records_households_and_events_apart	0 / 0 / 0
event_key_drops_state	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_one_scope_keeps_records_households_and_events_apart	0 / 0 / 0
event_key_shares_the_ordinary_tag	0	SURVIVED	0 / 0 / 0
family_entry_unscoped	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_another_deducted_caregiver_keeps_its_minimum	0 / 0 / 0
rate_key_drops_month	0	SURVIVED	0 / 0 / 0
rate_key_drops_params	0	SURVIVED	0 / 0 / 0
rate_key_drops_state	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_one_scope_keeps_records_households_and_events_apart	0 / 0 / 0
scope_never_resets	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_each_comparison_family_runs_once[events1-2]	0 / 0 / 0
scope_opens_per_call	1	tests/test_track_b_ret_ledger_fix_round_10.py::test_each_comparison_family_runs_once[events0-2]	0 / 0 / 0

Totals. 19 of 22 exited 1 (a test failed). 3 survived (exit 0): event_key_shares_the_ordinary_tag, rate_key_drops_month, rate_key_drops_params. Other exit codes: none. Every open audit printed 0 / 0 / 0.

Last 20 lines of scratch/review/round10-mutations-shard3/event_key_shares_the_ordinary_tag.log

MUTATED_TREE /home/user/w563/scratch/review/round10-mutations-shard3/event_key_shares_the_ordinary_tag/src
........................................................................ [ 72%]
...........................                                              [100%]
99 passed in 34.29s
OPEN_AUDIT {"os.system": 0, "restricted_opens": 0, "subprocess.Popen": 0}

Last 20 lines of scratch/review/round10-mutations-shard2/rate_key_drops_month.log

MUTATED_TREE /home/user/w563/scratch/review/round10-mutations-shard2/rate_key_drops_month/src
........................................................................ [ 72%]
...........................                                              [100%]
99 passed in 33.80s
OPEN_AUDIT {"os.system": 0, "restricted_opens": 0, "subprocess.Popen": 0}

Last 20 lines of scratch/review/round10-mutations-shard3/rate_key_drops_params.log

MUTATED_TREE /home/user/w563/scratch/review/round10-mutations-shard3/rate_key_drops_params/src
........................................................................ [ 72%]
...........................                                              [100%]
99 passed in 30.78s
OPEN_AUDIT {"os.system": 0, "restricted_opens": 0, "subprocess.Popen": 0}

Gate.

cd ../w563 && env POPULACE_DYNAMICS_PSID_DIR=/nonexistent/trackb-round10 POPULACE_DYNAMICS_EPUF_DIR=/nonexistent/trackb-round10 OMP_NUM_THREADS=1 OMP_WAIT_POLICY=PASSIVE POLARS_MAX_THREADS=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$PWD/src:$PWD HYPOTHESIS_STORAGE_DIRECTORY=scratch/review/hyp-gate $PY -m pytest -n 4 -q -p no:cacheprovider tests/test_track_b_*.py

Exit 1. Last pytest summary line: 1 failed, 14284 passed, 20 skipped in 865.53s (0:14:25)

One failing node, the same one at both heads:

• tests/test_track_b_b0_1_review_root.py::test_every_engine_match_of_a_spelled_denied_name_is_flagged[bun] — AssertionError: ['docs/**/deni{e..e}d{{.m}}d'] (test line 1715)

This container has bun 1.4.4 at /root/.bun/bin/bun, ripgrep 14.1.0 and Node v22.23.4 on PATH, so all three engine parametrizations ran instead of skipping. The [rg] and [node] cases passed. I did not rerun.

Worktrees. git -C ../w562 status --porcelain and git -C ../w563 status --porcelain both printed nothing after the gates.

round10-mutations.json (gzip, base64)

SHA-256 of the uncompressed file: d3ab07eb2e589613e8be609135869076b699ea019f7122f656623daadc817a83

H4sICG+16GoCA3JvdW5kMTAtbXV0YXRpb25zLmpzb24A7Z1rc6JMFsffz6eg8spsxYBRY5Jaq9aJPhtrM9FSZ2dTSaqrgUapcHFoSGI9Nd99Dw0JXkDRgYmX9sWMQnP+TZ/u3+kb5O8vwpFse5aKsDVBMrGIpis6diZHV8LfXwThSBlha0go/HyAn+wYHMWaSxw4duT/Uka6oTrEEurCg3xqO/pQt7CBHOwS+mDaljsSikLpSdBsR5AF3RKI5equQdSnR+voJDAoEzhL4iw+WkL4WWI7SrQgEp3SNTAR3KKL3Ml4NndwSeFrcHIA506vb9q3zRNh5lDz63Fgzs+5n/Ff8M/TCSsn2zSxpfp3QKwXodvpfr9tXLdQ8/6u8a193UfdfruJmu1eXbRsi7zp1IUciq6DlWe56PguKEkxl7W63/9aeVnnWxfdff+GBje9VqPZr5fYkR+N9gB1O7ft6/t6t9Hvt//bAoHbRq+PvjX+N5W4ez+46dw1O3eDH732oPX1ftC67jRbH2e6jcFNXRzZJhE9ShzxtXpeFqkCTlBGokNedPIqhlkpmp6LXd22aJGOsKNKYmztEqmjXM1ZFAa9xvV/vqJe5/tdsyShQa/Vyl5VuLnvdgY3rX67j/qDTq/x75ZfvK1r+H5fT2t+NBkXYyUE0TXHoiu/QCUQZd0SxxN3ZFvCvGHPQqFxZGGTqKfjiVAcC5Z99aaCj8PvClZGZOzYL7pKHKH4UygWXblu6BYRio4mQBtwqej/i1iFQDJyiIug0g+JgzT9LdBAJck3nzb1JSRmzfIIqpuLFFv122WJHdGwDupDxKwokNyFU9XglG6w9gtlLI7tsWdghSB1AnenK1QMFcVI8UNF0x0wNm3ZN7PWvV1dsYSYcQGNsf8d/GLqlm56JrIIUSmybBAxdWMC/ykuDcRNW/WMCG/ryQbwOlqrYD+A4bvdv9F4+rIk9phYCHuq7oY0hkP0lE6AASYckQJ5B4QdXXGJivwLaHSGejJUHoVQetr1T/ln4MQvZpzangMeggp9Vj1n2FLVS1y5OCur5QtcLlVrMpZkWZOqVVK6INqljCuShmsXNUWBM1hRyzW5gtWyIssKrsgq3Jpv+f2GXER+etjQ3XVCif/5Z10AxxWW0P5EMPFb4T1IHB8nhRFmbQNjnOwpIFgWFxydM9UTFLMgenma6JH5Q6R5eXtozholRTNNFzEnUeSOCJj46UHKh+k+2o92s/OjOHRsSqXiwPHI05aBfoqLOw955iBkW8bajJ+FLgf4JwC8JM47MWd+xwtmge/SFL4j64dI79L20PtVV+1XoPerNUdw6uqGEcPx7QL1FNt2ntOG/coqiX9L65N6JX4hAe+MfyrLz8RFR+dM8yTJLHh+NsXzafuc6J9IdJ/UI304ggS2htxXG6lEMbBD3lnJGvPWc32GhTtP9g+SbtQJXzqjzjH+abPlM179Q3PlC5pZz5TPCPCZFT5Pvgm9Z3m38/imz/o4iJVBCIVqrDyvgXEoP8+xBHBiIQnYYRLZto2IyHCF+n4VJ/MacxexDvtD8yaJ2llPocQKHSKxzz6T2JcRsAHJ74xWsIVM+4UAAH0PUb+XrdiOSh8se7tQHc+2HUY2q7MQJF+gCKgLiKXrkxrwOvZcUkicJtE14ZlMoIm4/o4UJnkVbWFhvx8gwZNQn7Y1rfCRhLM97eLfomdzX8qMl8xuLXPR/iEC/HwNgLM1w3AThktz6HYTKDLkN1rs6BTwHfayocAp0FwhD+Asy6VS8Wxr1ixjkPcJAMfqebUi1bBWU84vq1JNuqwSqXxWqShVtXJexuVqVT2T5PNaRS0ThZQ0Sb0o1c6188uLGq7iy1mA+/GSgZMGHhl93ESqzY5rEphDflumVhK9n/sEy1Ll7KZZEmU4+Tn5NyN/HCt3OQBELlAMgh2KoF5jGYokWK2G0RWD9Dqz6CHPTWLKMPSb2sOJdFWoA8DB5FB/WTgX8d7/EIMSoTB7zP+AB8ZBpQ3XWgqB0EmwRx7pFstz/S8MBo4Xr49y5tgGEXQq9OD/02a73/h622oitl1q8TKWneDC2ZNTEsezm+6D1H48i+5TJ3TZOkKGRTef19SZ48Ez1XpsqpaT+4pz6lxktwidSpKvZnxygMXAR9VjgWbOPc+EhLNQ4QzaQ+lCgkB7cVk6rUpF8jYm/mXS9gTeVDFqr4Kw7fqbCvY+9lpCEG6BhbetPg+6POiuGjcuaSn5D1pXiGc4bl2idJCrTqWtCq1W4I2PAPsBiDC2gux7bN3eGDoVYvYqdB7WsJWPVnngTLOVYVk7yX2zxirx7HZrLFM6yK3SZR44sw6c+zHmDHwA7QcByYDKnkUVUE/7MIxKNAGxX+jDEo3dcfcvVlSIWX+0Eq/jHE81OkhyW+6Dn2XC2Q18klQOkd2VC87u32N3IuN2mNtsXRSKfIJUx4ZiD9ZJU1J7eVfe/7je2CAFajtwwwXNM4xTHYqDFo6Pj084pdN2ReOdlHs/O1k2ux52vAZ/DPGT8QztJOhihTQOt0CjkQ3VaGT7Lw2Blhp6C2Ho0m7NQ4gJRNsjRkdOyIfTkX1O6w3W0JPdlfvy/XLp7Nbsk3U4uTm5syL3FOf2iN4U2tMmawn+5zGwRh+PThYn6aOppZNVs+wrbbFMrtTgASHVTERsDch9hiVRNbvplVgJHgF4BMgqAgSs3Av4+82GBPvkwBu65S9duni4cSB4N8LwvSbtObjTPea30nu5P8SYKgfZPdO4Um5v4S4lw13KCe6WZxhbx90kTO0wg8NngTZflwwNvHs17bJkzGWcu6lQFOux3FmbqJodX2MlDrLDXOOLkb+H7Hiq7TCm2Ruzoq4/e9fdmr3jwky3OJzEmJ6zEHS1AN+xSdmM9vt1BjZlFV8tIjvGwhhPTD9Ysvz5P5m1pX3w1dmaM5pnLlkIOlk1xti0JKN8TiWuR1+v0kXT9bKSqvQ2yxkP2KnWBOLabu6LHUmi2S1zxCnwEdBejoBio8/+RNMAiJmH0xny8oj6exE1sTB5UD3IUXBsE859FJyomt0oOFaCx9VDiKthHNqfwLrJav4cfD8pbO1xcP1DcYxH2B3fVx3XlnPfVZ0kmt2e6jgFviuD78rIKIbv/KaMwA3BO1chb8Rdd2Cs+X8gwZhczWJ6jOnSx9vjr0LXjV4LXQMUG712v3PXP2VZKrj2c/B3GznLU83XLTo19wnIeMnsph8X7fM/EbAb7xktbdF7RmNot/PsZllBY/bCGcNYk966JrC3osyBOHzxs+ZZ7BnPwj+wM6RL/9giGFqk9xDYfey/T8V/9/QdsDStDOd8qg5uXAXIvc+eJJpdnz1Ogb9Vmr9VejPaz/FxR3n/5df/Abu0TlE9iQAA

Judgment calls.

• I posted this comment with the GitHub MCP add_issue_comment tool (a REST issue comment), not gh api: this cloud session's tooling restricts gh to search. The body is the same Markdown the brief describes.
• I ran the two gates one after another, after all mutation shards had finished, so they would not compete with the shards for the 4 cores.
• python3.14 was not on PATH, so I used uv venv -p 3.14, which provided 3.14.6 as the brief allows.
• The base64 block is the output of gzip -9 -c <file> | base64 -w 0 exactly; I checked that it decompresses to the file before posting.
• The table shows each first failing node as the script recorded it. For bound_skips_the_child_check the script's ^FAILED (\S+) regex stops at a space, so it recorded ...test_no_minimum_can_move_on_these_records[no; the log's full line is FAILED tests/test_track_b_ret_ledger_fix_round_9.py::test_no_minimum_can_move_on_these_records[no child]. The results file keeps the truncated value.

---

Generated by Claude Code

[MaxGhenis]

Merge request for the coordinator's slot (Track B payment session)

The "Microcosm dynamics" coordinator can merge #563 at dbdceac55e5a0f9326cc55798af0f940057e4b32. The five items:

1. Reviewed head 03530e8bd99db9608ecfb60ae4f17508fde1b3be. Two commits follow it: f5a18c84 (docs only: round 10's cloud mutation ledger in docs/design/track_b_g2_r2b_*.json and docs/design/track_b_r2_ret_ledger.md) and dbdceac5, a merge of master dd9c7be2.
2. Verdict: Track B G part 2 and R2 part (b): deductions before reduction; SSA's operational saving clause #563 (comment). An independent cloud Opus 5.5 review of 03530e8b approves it with no finding of medium or higher.
3. Brief: ~/reviews/fleet-ops/cloud/started/181-trackb-payment-independent-review-563.md.
4. gh pr checks 563 exits 0 on dbdceac5. GitHub reports MERGEABLE and CLEAN, with no reviews and no CHANGES_REQUESTED.
5. Tiers: dbdceac5 merges current master dd9c7be2, and CI's full-collection tier check passes there.

One call for the coordinator under condition 1: the master merge brings #596, which adds 11 lines to tests/test_track_b_b0_2_counts.py (B0.2; it touches no payment file). If the coordinator counts that as Track B, I'll rerun the review at dbdceac5.

Money impact: none. The PR changes statutory conformance on invented cases only; the axiom line sits in the PR body.

Sol audits the merged commit later, when the Codex lanes place (condition 4). A medium finding from that audit becomes a follow-up PR.

[MaxGhenis]

The Microcosm Dynamics coordinator merged this PR at dbdceac55e5a0f9326cc55798af0f940057e4b32 with --merge --match-head-commit, as edba88f74c328c1f7f4272c22a33849d2593e2b5 (21:36Z, 2026-11-02).

• Review. A cloud session running Claude Opus 5.5 reviewed 03530e8b independently and approved it, with no finding of medium or higher severity (verdict). It rebuilt the counterexamples behind both of GPT-6.1 Sol's round-9 findings and confirmed both fixes.
• After the review. Track B added two commits, and neither changes a file under src/. In f5a18c84, Track B recorded round 10's mutation run: a cloud session ran 22 mutations at 03530e8b, and 19 failed a named test. For each of the other 3, Track B explains in the design note, docs/design/track_b_r2_ret_ledger.md, why the change alters no result. In dbdceac5, Track B merged master dd9c7be2, and the merge's one change, Flush the real streams before each B0.2 test captures output #596's stream flush in tests/test_track_b_b0_2_counts.py, leaves that file identical to master's.
• CI. gh pr checks 563 exited 0 at the head, with 11 checks passing and deploy skipped (Tests run 41499146341). GitHub reported the PR mergeable.
• Follow-ups. The reviewer's one low finding asks the design note to say that carrying the second caregiver's actual-world minimum into the nested hypothetical would pay differently. Track B will add that sentence in a follow-up PR. Once a Codex lane opens, Track B will also run Sol's round-10 review as an audit and fix any medium finding in a PR of its own.
• The slot. Track B G part 2 and R2 part (b): deductions before reduction; SSA's operational saving clause #563 landed ahead of Aggregate-table captures and readers, part 1 (D4) #574. Before Aggregate-table captures and readers, part 1 (D4) #574 lands, its owner merges master edba88f7, or later, into it and recounts the test tiers.