Amendment 17 to the covered-earnings correction design (test-pin activation cure + executed-transition rule)

[MaxGhenis]

Summary

Amendment 17 cures the §30.4.1-pinned test that still hardcoded the {13, 14} closure set for every revision ≥ 16 — the exact block that stopped the revision-18 repin (sol-ce-rev18-repin.out) — and enacts the standing executed-transition ratification obligation (§31.3) plus the Amendment-17 revision-18 executed transition (§31.4). Ratified through the full adversarial convention: three rounds, two fix cycles, closing on a round-3 dual RATIFY (A13/A14 took the same shape).

Attested candidate identity (both referees, byte-exact): design 3,934,849 B, SHA-256 29055c5606a54587107498e8adcdbc8546f93caceabe89238975288db72e7fe1, git blob 84b31290ecd2d1001b6ea802b9a97a86260cdfda, HEAD 81e379f; the 3,915,641-byte A16 prefix byte-identical; §§27.3–27.6 and the canonical fixture untouched; publisher byte-identical.

Ceremony record

• Round 1 (dual REWRITE, 4 findings): A17 normative law absent from the semantic projection (forgeries accepted); public oracle never executed implementation-pin verification (§31.3.2); receipt schema said "at least" vs exact keysets; False == 0 authenticated forged receipts.
• Fix-1 (21a88c2..4de9944): structured A17 projection (document + terminal-A17 + inherited-successor routing), exact closed keysets at every level, JSON-integer strictness.
• Round 2 (dual REWRITE, convergent): §31.3.2 still uncured — both referees' raiser probes answered with zero verifier calls; plus the executed-transition receipt went stale when fix-1 moved the test identity.
• Fix-2 (4de9944..81e379f, one commit, +86/−15): validate_ratification_operativity() now takes one registry snapshot, parses the active pin table, executes _verify_implementation_pins, and only then validates closures; a bound reachability regression (outside the mutation census) fails if the verifier call is removed; the §31.3 same-state demonstration re-executed strictly last — fresh receipt (3,456 B, SHA 636eb300…, state SHA 2e4d429e…, oracle exactly (13,14,15,16), same-state battery 76/76), kept untracked per §31.3.3's outside-candidate-bytes rule with zero receipt-derived identities in the design suffix.
• Round 3 (dual RATIFY): both referees independently reproduced the raiser + counting probes on both registry contexts, proved the regression detects non-reachability (pre-fix entrypoint body → both collected tests fail), validated receipt v2 through the enacted verifier with canonical-manifest recomputation, re-attacked the round-1 cures over the updated suffix (18/18 forgeries rejected each), reconstructed all four enacted closure identities, and confirmed census integrity (inherited 100 fe2efd7b…, A16 7 1e00099f…, A17 exactly three names b19ebcbf…, no inflation). Verdicts: r3 6,669 B SHA-256 8a21ee6bf3c1541525c0d6e98496e7395a01f2631c7177505427281e0516bdc8; r3b 7,758 B SHA-256 bd143b6e4d9ef52d8bcf0bd546f398890421a3f81456eef7178c0e99e9a95a37 (committed with the future revision-19 repin per convention).

What this merge enables (per the enacted §31 sequencing)

1. The revision-18 repin (A15+A16 activation, four ordered closures with §31.4-pinned identities) becomes satisfiable — the cured test expects rev 18 → (13,14,15,16) and rev 19 → (13,14,15,16,17).
2. Amendment 17 itself joins neither revision 18 nor a deemed revision-19: it takes its ordinary revision-19 closure and registry repin under §§30.2.1–30.2.4 afterward.

Merge mode

Classified under §29.3.1: every direct and transitive consumer is blob/tree-bound (path_mode_blob_byte_hash implementation pins; document_only_postmerge_closure for the future rev-19 closure binding the single-parent integration commit). No topology-bound requirement; no first-add paths in the diff. Squash is lawful (A15 #384 / A16 #385 precedent).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
social-security-model	Ready	Preview	Aug 11, 2026 9:03pm