[MaxGhenis]

Counts released (2026-10-29). Approved at 7d1e2898 (Sol rounds 10 and 11). Waiting on CI and a tier slot: the dynamics coordinator has been idle since 10/22, so the slot question is with Max (d2173). #592 goes first. B0.2 per d1802 (Max 2026-10-21) and design revision 3 §3.1, §5.2 and §5.3.

This supersedes #554. It is #554's tree at 9a0ef5f4 as one commit on master fe5ab5ab. #554's branch history carries an early draft of the held-out registry file, which the registry's history check rejects. This branch's final tree touches no registry file.

What this will deliver

• One frozen record per gate (the ten §5.2 elements plus a named power procedure): B3, B3L, B4, I's observational timing gate, B5-empirical RET, B6a, B6b and J.
• J's joint estimands and numerical limits, for blinded ratification before B3 registers, with a J holdout independent of B2's evaluation data and B2's result recorded as exposed.
• A blinded review of prospective feasibility and power for the §5.3 limits.
• Pricing of the design's still-unpriced items (§3.3, Q13): the timing gate's data and loaders, HRS, linked withholding data, entrant initialization, B6b access, and the 2032/2050 extensions.
• B2's medians recorded as an open item (d1606).

This PR lands the plan, the landscape synthesis, the frozen protocol, the count script, its one run and the released counts, as the coordinator ruled (after the run: recount, commit the counts, take a tier slot). The power procedure, the per-gate records, pricing and the reviews follow in the next B0.2 PR.

Plan

docs/design/track_b_b0_2_plan.md:

1. Landscape lanes, with no counts.
2. A structural-audit protocol, reviewed by Sol, then frozen and hash-pinned before any count.
3. One-shot counts and power.
4. Per-gate records and questions for Max.
5. Reviews: Sol, the blinded feasibility review, and J's ratification.

This work is kept separate from the B2 successor design (d1659): neither lane reads the other's evidence (plan §2).

Status

• Plan
• Landscape lanes: the synthesis is docs/design/track_b_b0_2_landscape.md.
  • BEPUF 2020 is fully synthetic, so it cannot serve as an observed holdout.
  • The restricted linked-data decision is queued for Max as d1903.
• Protocol frozen

  • The protocol is docs/design/track_b_b0_2_protocol.md, FROZEN at e8a9fac0 (item 10 below). Its block is pinned at SHA-256 6840f5fa… (b1ac4bc0… at 6cca06af, 66cadfa4… at 1e3ff4d8, 31af2b85… at 60d77cff, a92539b2… at c6aec979, 71e350ef… at 9b9d53f5).

  • Sol review rounds 1 to 3 asked for changes, and each was answered in the block before any freeze. Round 3 found that B0.1's exact public counts were not modeled, and that disclosures could empty the witness pool. B0.1's sets now enter the audit as exact counts, and an emptied pool reseeds or withholds.

  • The coordinator ruled that B0.1's sets may constrain the audit on conditions, which the block now states and the script meets:

    • a rerun gate before the audit;
    • a write boundary over every output path, failures included;
    • a defined decision record: each of this release's targets with its kind, unit type, sets, true size and final classification, and the class sizes. Nothing about the rounds is written;
    • a stated limit;
    • an invariant test on invented panels;
    • no precedent.

  • Since this PR opened: each program's limit is 300 seconds, up from 60, because round 3's 800-household rerun withheld on a loaded host when seed programs timed out (3fe9541d); warnings print nothing, since whether one fires and where can depend on the data; and an interruption, or a library's own exit, is reported like any failure, with no chained error (f9d6dc4c). Following the coordinator's rulings (74ed29be): the rounds are dropped from every output, and the committed provenance holds only the requested shape, fixed before any count, and hashes of inputs and code.

  • The coordinator then ruled that a stop counts as a decision, a withhold of the version (7f657916).

    • The next attempt is a new version, ruled on before it runs, that treats the stop as public.
    • A failure while reading the inputs or writing the files names its type and the script's line. One in the release prints only "B0.2 stopped in the release". The script's own raises keep their fixed messages.
    • Inside each phase, file descriptors 1 and 2 point at the null device, and every stream, the C library's included, is flushed before they are restored.
    • The stated limit names the run's total time, which no output writes or prints. The run is detached, with no wall limit, since the number of programs is bounded.

  • In place of a wall limit, the coordinator set three conditions on the run (60d77cff), since each program's limit is wall-clock time and any stop spends the version:

    • the script holds off sleep on its own process;
    • it starts only at nice 0, with the five-minute load below the CPU count;
    • an expected run time, extrapolated from the calibrations, goes to the coordinator before the freeze.

    Round 4's S2 replaced the first two with six run conditions checked before every program (below). The run prints nothing until it ends.

    • Three tests that had not yet run failed on their first run and were fixed in the tests (the block's preamble names them). The relabeling tests now include panels that release.

  • The count script scripts/track_b_b0_2_counts.py was built on invented frames. No count has run.

  • Evidence on invented tables is in docs/design/track_b_b0_2_evidence/: an enumeration oracle written apart from the integer programs, three searches over it, a calibration on invented panels, and the mutation runner, now with 127 specs. The build report is docs/design/track_b_b0_2_counts_report.txt.

  • Review round 4, at 60d77cff, approved the block and the script as they stand. It ran on an Opus 5.5 lane, since the Codex lanes were closed. Nothing is blocking. It asked for four test changes before the freeze, none of which changes the pin or the script. They are done in 80c5ab72 and 3747d0ee, and the count, review-root and exclusion test modules pass (322 tests):

    • main() runs under an audit hook in the relabeling tests, which refuses any write besides the run's outputs and any new process. The static check knows NumPy's, pandas', pickle's and shutil's writers.
    • A property test checks that the local copy is the same whatever rounds settled the targets.
    • Round 4's table, on which B0.1's exact household count withholds a small band's households, is now a test.
    • The Hypothesis relabeling swap is drawn between heads of different ages, and a draw that leaves the atoms unchanged is counted apart. In the first run, 14 of 16 draws changed the atoms and kept the decisions. Before, round 4 counted 41 of 60 draws swapping heads of one age, which leaves the atoms unchanged.

  • The coordinator ruled that round 4's other seven items also go in before the freeze, in one head with a fresh master merge. They are in 1f3b529c, on the master merge a3b62363, whose second parent 9967dfd6 is still master's head. (That merge's message names 51323bed in error.)

    • S1, the decision record: a target the round that ended the audit did not reach is unreached, whichever round that was, so the record no longer shows the round. Each class names the paths of this release's sets that hold it, in the release's order, and never B0.1's, even where a B0.1 set is the same set.
    • S2, the run's conditions: caffeinate is gone. Through ctypes, the script holds two IOKit sleep assertions in its own process, and reads the providing power source, the Darwin background priority and the main thread's QoS class.
      • Six named conditions (ac_power, sleep_assertions, nice, background, qos, load) must hold before the attempt record, or it refuses to start.
      • They are rechecked before every program, never during one. While one fails, it rechecks every 60 s and takes a lapsed assertion again. After 1,440 failed rechecks (24 h), it stops with the condition's name.
      • The QoS condition goes beyond round 4: on this host a CPU loop ran about a twelfth as fast under taskpolicy -c background, with niceness and the Darwin priority both 0.
      • As the coordinator then required (0f942549), qos holds only when the class is unspecified or the default or above, by two named constants, so an unknown class below the default fails. The block names the wait's constants (RECHECK_SECONDS, RECHECKS), the stop message is built from them, and a test runs the wait with a shortened bound and real sleeps.
    • S3: the exclusion test also builds a root with decoys that share basenames with B0.2's files, and requires each to be kept.
    • S4: a present row without its person or interview number, or a present person without a design stratum and cluster, stops the run while reading.
    • B1–B3: the committed status of a withheld release is among the audit's limits; the stop channel names the script's own checks; and running without a wall limit is stated to rest on the calibrations' timings, not on the program bound.

  • The mutation specs drop the five that targeted removed code, and add 20 for the new code plus round 4's four mutants, for 112. Round 4's four mutants are killed at 3747d0ee.

  • The count, review-root and exclusion modules pass at 1f3b529c: 359 tests. In the relabeling property, 14 of 16 draws changed the atoms and kept the decisions. At 0f942549, the 37 tests its change touches pass (run conditions, QoS, both bounded-wait tests, the static message check, the pin and the real-host reads); the full modules rerun with the evidence.

  • Round 5's first attempt, a Sol delta review at c6aec979, stopped before its report: the provider's content filter refused it after 1 h 38 min. Its draft found two gaps in round 4's items and two wording errors in the block, all fixed in 9322a0b6 (pin 71e350ef…):

    • S2's sleep assertions: the check counted an assertion that still existed as held, though its owner can set it to the off level, where it no longer prevents sleep. held() now requires the AssertLevel property to read 255, and an assertion that fails is given back before it is taken again. A macOS test sets a real assertion off.
    • T1's test confinement: it let a write into an existing __pycache__ folder pass, and did not see a database, the system log, a file's removal or metadata, a rename's source, or a socket before it connected. It now refuses each, with bytecode writing off while it holds, and the static check refuses the modules that could write past an audit hook (socket, sqlite3, syslog, mmap and others).
    • The block: the identifier check can fire on the real files, since the person-wave reader passes each wave's interview number through as read (the block said it never fires); and round 4's two 97-head status tables are described separately.
    • Two mutation specs cover the assertion fix, for 114. Master 7e050df5 is merged at c8d6dbb3; it changes no B0.2 file, nothing B0.2 imports, and not the tier file.

  • Round 5's second attempt (Sol, at 9b9d53f5) found all eleven items and those four fixes resolved, apart from one sentence: the block credited the reader's fixed-atom rerun's result (withheld at 0 to 2 heads) to the natural tables, which round 5 found withheld at 1, 2 and 7. Fixed in 3e169c74 (pin 66cadfa4…), with its three nonblocking suggestions:

    • a CoreFoundation ownership test for the host calls, which catches a properties dictionary left unreleased;
    • a design-stratum identifier case, which catches a stratum left out of the check;
    • name lookups refused by the test confinement.

    Two mutation specs cover them, for 116. Master 1ec57a5d (PSID income and wealth readers and field registry (D1a) #575, D1a) is merged at 226d844d. It adds two data modules and changes a birth-evidence script, tests and the tier files; nothing B0.2 imports.

  • Calibrations at 60d77cff on invented panels, with B0.1's sets registered:

    • 9,000 households release: 3,838 targets in 2,146 s of audit.
    • 800 and 3,000 households withhold, each on one narrow one-person class. B0.1's exact cuts leave such a class at 0 to 3, so the real run may withhold too.
    • The expected run time went to the coordinator.

  • Whether a class that B0.1's published counts already fix should still withhold this release was a methodology call for Max. He ruled on 2026-10-26: exempt a class only when B0.2's rows narrow it no further than B0.1's published rows already do, as tested in the frozen protocol. This is implemented in 6cca06af (pin b1ac4bc0…):

    • The block gains an "Exempt targets" section. For a narrow target with proven optima, two more programs find its least and greatest size under B0.1's exact counts alone. Like every program, they are set from the publications: no relations and no disclosures go in, and a target holding an atom no B0.1 set counts is refused. If the two sizes equal the round's range, the target is exempt. It neither withholds the release nor is disclosed, and every later round tests it again, so a disclosure that narrows it further ends its exemption. Anything unproven fails closed. The release guarantee, the limits, the decision record (exempt), the Tests list and the program bound (9(T + 2) + 7T(T + 1)/2) change with it, and the preamble records the ruling.
    • The script: earlier_counts_system builds B0.1's rows at their exact counts over the same atoms, and fixes at 0, and flags, every atom none of them holds; exempt() applies the test; audit_counts applies the outcome.
    • The tests:
      • the exhaustive reader's oracle also enumerates B0.1's counts alone, and the script's exemptions must match it, with three new examples: an exempt class; an exempt target of true size 10, which is not disclosed; and a disclosure that ends an exemption;
      • the exemption programs are the same for every table with the same publications;
      • each fail-closed case has its own test;
      • through main(), a panel whose small classes B0.1 already fixes releases, and withholds with the exemption off.
    • Changed expectations, each checked against the rule:
      • The relabeling test's withholding panel now releases, because its three small person classes are exempt: B0.1's counts alone leave them 0 to 2, 1 to 3 and exactly 3, as the audit does. It is now a third, releasing case, and a six-head panel this release narrows takes the withholding slot.
      • The small-B0.1-cell test still withholds, now at the 1–24 band's clusters (left 2 to 5, and B0.1 counts no clusters), while the band's person classes are exempt. The test now names that target.
    • Mutation specs: 11 new specs cover the exemption, for 127. The tier count is +6.

  • Scope (1ed6a266, pin 6840f5fa…). The ruling's question names a class. The dynamics coordinator read it as any audited target, each class and each published-set difference, because the test that grants the exemption is the same for both kinds. The block now says so. For the uncounted-atom refusal it also says a difference holds each atom of its superset outside its subset. No script logic changes. New tests, on the main() panel that releases with exempt targets:

    • switching off one exemption alone (classes of true size 1 and 2, a difference of this release's sets of true size 3) withholds on that target in the same round, and every target that audit reaches is decided as in the release;
    • the size-10 difference against a B0.1 set, disclosed instead of exempt, ends the size-1 class's exemption in the next round.
    • The tier count is +4.

  • Next:

    1. A delta review (round 5d) of 3e169c74 and the master merge, at 226d844d. APPROVED (Sol): the requested sentence is right, the only change between the markers, and both pins match; the ownership test catches all five ownership mutations tried; the stratum spec fails exactly the new case; the four lookups are refused; the merge changes nothing B0.2 imports; the tier arithmetic holds. No new findings: the block and script may be frozen as they stand.

    2. Master 444f970d (SM1: differential mortality by lifetime earnings, education and race (normalized within age-sex-year cells) #570 SM1, OP1: open-population harness around the sealed loop #566 OP1) is merged at e79f41b5. It adds the mortality_ses and open_population packages, and changes a birth-evidence script, its test and the tier files: no B0.2 file and nothing B0.2 imports. The B0.2 files and the pin are identical to 226d844d's.

    3. Evidence at e79f41b5, on the serial runner (one job at a time, one core, nice 10), with each program's limit at 300 s:

       • The B0.2 modules: 380 passed.

       • Calibrations on invented panels with B0.1's sets registered, as main() registers them: 800 and 3,000 households withhold, each on one narrow one-person class, as at 60d77cff. 9,000 households release: 3,838 targets (3,820 wide, 18 irrelevant) in 2,245 s of audit. No target took more than 31.5 s over all its programs, and no seed program more than 20.4 s.

       • The same two panels without B0.1's sets release: 800 households, 2,843 targets, all wide, in 276 s; 3,000 households, 3,112 targets, all wide, in 668 s. B0.1's sets are what makes them withhold. A diagnostic of which B0.1 sets pin the one-person class (a Sol review found it sound for this question) runs next on the same runner, for Max's ruling.

       • Mutation record: 113 of 116 specs killed. The three survivors were untested paths, not faults in the script. As the coordinator ruled, they are answered with tests only:

         • spec 37, the audit's use of the relations it registers between unit types: abbbf793 checks that with the relation a household class withholds, and without it releases;
         • spec 53, the B0.1 record check for a set with no published count: an earlier check fired first in every test, so 8a30da57 adds a case that only this check catches;
         • spec 66, the class sizes counting atom classes only: no test table had a difference that was not also an atom class, so 8a30da57 adds nested sets where one is.

         Each new test kills its mutant. The count script is unchanged (SHA-256 7ec6ee28…). The count module: 232 passed.

    4. Master 172f690f is merged at 1e3ff4d8. It adds OP1's report and the held-out registry's module, tests and record: no B0.2 file and nothing B0.2 imports.

    5. The full mutation record reruns at 1e3ff4d8, after the modules, on the same runner. Then one evidence commit: the calibration file, with each run's limit and sets (300 s with B0.1's sets now, 60 s without before); the rerun record; and the report's final-head section. Then a delta review of everything since 226d844d, and out of draft.

    6. Max's ruling. Ruled 2026-10-26; implemented in 6cca06af (above). The record at 1e3ff4d8 was stopped once the block and the script changed (56 checks run, all killed), so it is superseded.

    7. Evidence at 6cca06af:

       • The five B0.2 modules pass (411: 238 + 173), and all 11 new mutants are killed by the full module.
       • Calibrations on invented panels:
         • 800 households release, with 5 exempt targets (audit 474 s);
         • 3,000 households release, with 4 (1,596 s);
         • 9,000 households: the first run withheld on one stratum atom whose programs reached no proof within the 300 s limit (357.6 s). The host had gone to sleep under it. The power log shows the lid closed at 23:49:16Z and opened at 00:06:22Z, and the run ended at 00:06:24Z. The calibration script holds no sleep assertions. The run's script holds two and checks AC power, and the block has the operator keep the lid open, which the script does not check.
       • Reruns of the 9,000 panel on an awake host release at both heads, with the same decisions (3,820 wide, 18 irrelevant):
         • at 6cca06af: 2,562 s of audit, slowest target 44.7 s, median five-minute load 105;
         • at e79f41b5: 2,276 s, slowest target 34.0 s, median load 52.
       • At 1ed6a266, in a clean clone on the same runner: the four B0.2 modules pass (393), the B0.1 count module passes (22), black and ruff are clean on the 13 changed Python files, and the full mutation record kills all 127 specs (6 h 13 min), each check restoring the script's SHA-256 647b52fd….

    8. Round 6, a Sol delta review of 226d844d..1ed6a266. APPROVED (Sol), no findings. The exemption implements the ruling under the coordinator's reading:

       • classes and differences get the same test, and no exemption function branches on kind;
       • the uncounted-atom refusal covers every atom of a difference;
       • an exemption adds no constraint, pool point or ordering change for any other target.

       All 11 new mutants and the three former survivors fail tests; the pin and the tier arithmetic hold. One editorial note outside the block, on the evidence files' "none has changed since" (to read "as of the evidence commit"), goes in the evidence commit.

    9. The evidence commit 18fa204f is evidence only: the block, its pin, the script and the tests are unchanged.

       • It replaces the mutation record with the 127-spec run at 1ed6a266.
       • It adds the report's final-head section.
       • It appends the 6cca06af calibrations to calibration.txt.
       • It rewords the two headers round 6 noted.

       Round 7, a short Sol delta review of 1ed6a266..18fa204f. APPROVED (Sol). All 127 records match their specs, code, pins and restoration hashes; its replays of specs 127 and 37 reproduced every recorded failure, and its calibrate.py 800 1 rerun reproduced the recorded decision. It had three nonblocking wording notes, which 2d8d982c addresses, again in two evidence files only:

       • the report's 71.3 s is the slowest classification of one target, since calibrate.py does not time the exemption's programs;
       • the 13 to 81 starting-load range is the post-exemption calibration jobs';
       • that the host's sleep caused the first 9,000-household run's timeout is stated as an inference, and the run's end time is cited to the job runner's log.

       Round 8, a Sol delta review of 18fa204f..2d8d982c. REQUEST CHANGES, one medium finding. The new text said the first 9,000-household run ended "3,277 s after it began", but the job runner's log timestamps span 3,965 s; 3,277 s is the runner's elapsed field. ff5bce43 (calibration.txt only) fixes this:

       • it gives both figures and names each one's clock: the log's times are UTC from the system clock, and the elapsed field, like every time calibrate.py prints, comes from time.monotonic();
       • it states that this clock advanced about 688 s less than the system clock during that run, without asserting a cause;
       • the header no longer says "wall clock";
       • it records, as the author's account, a rerun launch stopped before any output (round 8's low note).

       Round 9, a Sol delta review of the whole range 18fa204f..ff5bce43. APPROVED (Sol), no findings: the clock statements match the runner's and calibrate.py's code, no cause is asserted, the stopped launch is attributed to the author, and every other file is byte-identical to 18fa204f.

    10. FROZEN at e8a9fac09b600ddfdaa586f962a49a351d9386b7. That commit changes only the protocol's Status line, which is outside the pinned block:

        docs/design/track_b_b0_2_protocol.md | 2 +-
        1 file changed, 1 insertion(+), 1 deletion(-)
        

        -**Status: version 1, DRAFT, 2026-10-24. Not yet frozen. No count has run.**
        +**Status: version 1, FROZEN, 2026-10-27. Block SHA-256 `6840f5fa41c897407c5896d4c3729ca5a5c0f1d166faa294e65e42309908ad23`. No count has run.**

        The block still hashes to 6840f5fa41c897407c5896d4c3729ca5a5c0f1d166faa294e65e42309908ad23 and the count script is still 647b52fd…. The script's own protocol check passes on the frozen file, as do the pin, frozen-protocol, provenance and exclusion tests (12). Every commit since round 6's approval has an approving Sol review (rounds 7 and 9). Master has not been merged since. The run uses a clean clone checked out at this commit. A dry run of the read-only preflight there passes every check except the window and the load.

        The script runs once, in Fleet ops' reservation (Thu 10/29 08:00–11:00Z).

        • It starts only if the five-minute load is below 18, with the host on AC power and its lid open for the whole run.
        • Expected audit time at the calibrations' sizes: 474 s, 1,596 s and 2,562 s at 800, 3,000 and 9,000 households.
        • After the run: merge master and recount, then commit the public counts file, which the exclusion record already names. The PR then leaves draft and takes a tier slot.

    11. The run, 2026-10-29: released. Version 1 ran once from a clean clone detached at e8a9fac0, inside Fleet ops' reservation.

        • The read-only preflight passed before each launch.
        • The first launch (09:36:00Z) refused to start. The zsh launcher ran it as a background job, which zsh starts at nice 5 unless BG_NICE is off. The script's nice check failed before the attempt record and before any read, so it spent no version. Its whole log is the one line B0.2 refuses to start: run condition nice fails. The launcher now turns BG_NICE off.
        • The second launch (09:38:32Z) started at nice 0, wrote the attempt record and ran to the end. Its one line of output was the published file's path. By the main session's account, the host stayed on AC power with its lid open, and the power log shows no sleep or wake while it ran. As the protocol's stated limit says, the run's total time can depend on the data, so no end time or duration is published here or in the repository.
        • The main session read only the run log's last line and the published file. It did not open the local copy or the attempt record.

        e72aec18 is the one commit since the freeze. Master 172f690f is already an ancestor, so there is nothing to merge.

        • docs/design/track_b_b0_2_counts.json: the run's published file, byte for byte (SHA-256 c8415139…). Every count is 0, "<10" or a multiple of 10; the disclosure block holds the base, the two rules and the status alone.
        • Four new tests (six since 7d1e2898) hold the committed file to the frozen run: provenance (freeze head, script and B0.1 hashes, geometry, opened-file hashes), the disclosure block and forbidden keys, coarsening's image for every count, and every leaf path against the counts the script builds from an invented panel. Sixteen edited versions of the file each fail at least one.
        • The exclusion test now requires the counts file to be tracked; only the exposure inventory is still to come.
        • The protocol's status line records the run. The block (6840f5fa…) and the script (647b52fd…) are unchanged, and the script's protocol check passes.
        • docs/design/track_b_b0_2_counts_report.txt has the run and the committed release.
        • Tests: both B0.2 modules, 250 passed (serial). Black and ruff clean.
        • Round 10, a Sol delta review of e8a9fac0..e72aec18. APPROVED (Sol). It found every claim and check confirmed, and three low, nonblocking gaps in the four tests: the allowlist's content went unchecked, the shape test ignored empty objects, and another admissible value in place of a count passed.
        • 7d1e2898 (tests, report and tiers only) closes all three. A new test pins the published file's SHA-256 and requires the script's own serialization. Another checks the allowlist against the script's constants and B0.1's committed variables, and requires every other leaf to be a PSID variable and its label. The shape test now records containers. Ten edited versions of the file, round 10's three escapes among them, each fail at least one of the six tests. Both modules: 252 passed.
        • Round 11, a Sol delta review of e72aec18..7d1e2898. APPROVED (Sol), no blocking findings. It confirmed the pin, the allowlist checks and the container paths against the script, and found that 26 edited versions of the file each fail at least one of the six tests. Two informational notes (the shape test does not encode node types; a made-up label outside B0.1's waves passes the allowlist test alone) need no change, since the file pin rejects both.
        • Slot: requested. Master 172f690f is already an ancestor. If master moves before the slot, I merge it, recount and get the new head reviewed.
• Exclusion inventory before any count reaches master
  • docs/design/track_b_b0_2_exclusions.json lists every B0.2 file, including the future counts and exposure inventory. Since round 4 it also lists the 12 files in docs/design/track_b_b0_2_evidence/, which round 4 found were left in blinded review roots.
  • It is a standing record in scripts/track_b_b0_1_review_root.py.
  • tests/test_track_b_b0_2_exclusions.py checks the record's exact list and requires every tracked B0.2 file to be on it. Since 3747d0ee, its name rule also catches any file in a folder named as B0.2's. Before, it checked basenames only, which is how the evidence folder was missed. Since 1f3b529c, a built root with decoys that share basenames with B0.2's files must keep every decoy.
• Counts (one run): released, committed in e72aec18 (item 11 below)
• Power (the power procedure waits on Max): next B0.2 PR
• Records and pricing
• Reviews and ratification

Invariants (stated in the protocol block, tested on invented tables)

• Size-blindness: before the withhold test, every solver program depends only on the publication and the frame's structure. test_audit_programs_depend_only_on_the_publication compares solver transcripts across tables that share a publication.
• Replay: a reader who knows the rule and reruns it on any vector with the same publication learns exactly the final constraint set, disclosures included. Checked by enumeration in docs/design/track_b_b0_2_evidence/search.py.
• Width: on a release, every sensitive target has two exactly verified feasible sizes at least 4 apart, so no range of fewer than five sizes holds every size it can take. Checked by the tests and by enumeration.
• This release's targets: which targets are this release's own, and their order, are the same whatever earlier sets coincide with them.
• Relabeling: swapping a death and a move-out so that B0.1's counts, this release's class sizes and the audit's decisions are unchanged leaves every byte the run writes or prints unchanged. One example where the atoms change, and a Hypothesis property.
• Write boundary: a stop, an interruption included, prints one line with no chained error. In the release, that line is a fixed text naming the phase. While reading or writing, it is a type and a line. The script's own raise adds its message, which a static test confines to paths and settings. Nothing printed inside a phase is seen, through Python, a file descriptor or the C library's buffers. Warnings print nothing.
• Provenance: the committed record's key set is exact, the geometry is the requested shape, and every hash in either file is of an input or code.
• One attempt: the run's six conditions are checked, and the sleep assertions taken, before the attempt record; they are checked again before every program, and a Hypothesis property checks that waiting out a failed condition changes no decision. The attempt record is written and flushed before the count; each output file is written to a temporary name, fsynced and hard-linked into place, and never replaces an existing file.

Tier counts change: unit 18,789 → 19,041 (+252) against master 172f690f, merged at 1e3ff4d8; total 25,611. The +252 is the earlier +233, the three survivor tests, the six exemption cases, the four both-kinds cases and the six committed-release tests (e72aec18, 7d1e2898). CI's full collection passed the tier policy at 18,666 at 226d844d (+233 against master 1ec57a5d), and at 19,013 at e79f41b5. The README tier table matches. CI checks the counts, and they are recounted at the merge slot. Merging waits for a slot from the dynamics coordinator.

axiom: n/a: Track B design and audit records; no policy encoding.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Oct 29, 2026 11:18am UTC

[MaxGhenis]

Merged by the Microcosm Dynamics coordinator at the reviewed head 7d1e289863b668a8807ee866fd0c81ac90c7b430 with --merge --match-head-commit, as 53c7f2d2988a7a1f8ea8d6f3237aed4c68a3a82c (15:44Z, 2026-10-29).

• Order. The protocol puts B0.2's one run at the frozen head before any merge. The freeze is e8a9fac0, the released run and its published counts are e72aec18, and 7d1e2898 adds round 10's three test gaps. So the PR took the tier slot after the run, as planned.
• Reviews. Independent review/hard (Sol) rounds on Subfleet: r10 approves e72aec18 (16 mutations rejected), and r11 approves the delta e72aec18..7d1e2898 (four files, two added unit tests, 26 mutations rejected, no blocking findings). Neither requests changes.
• CI. gh pr checks 584 exited 0 at the head (run 40864250019: four pytest shards, graph-integration 3.13 and 3.14, lint and build). Deploy was skipped.
• Tier counts. The branch already contains master 172f690f. Unit goes 18,789 → 19,041; the other tiers don't change.
• Next in the slot. Every other tier-slot PR merges master 53c7f2d2 or later and recounts: Serve OP1's adapter draws from DirectRNGStreams by default #591 (OP), Federal SSI interface and source-to-input contract (SSI0) #573 (IR), Held-out registry: deeply nested events raise LookupError; test the 64-digit zero before #592, and the drafts behind them.