M6: seed sub-15-at-anchor persons at certified marital entry (implements ratified 3g)

[MaxGhenis]

Summary

Implements the ratified amendment 3g (§2.8.2g in docs/design/m6_projection_engine.md, merged 92ad162, #209) — the marital projection domain law for sub-START_AGE-at-anchor persons. This is a zero-discovery transcription of a fully pinned design: the clamp, the tests, and the guard are all specified in §2.8.2g's Pins and Implementing patch text.

The closed-panel anchor universe (build_anchor_frame) admits minors with no age filter. marital_panel_builder overrode start_exposure_year := anchor_wave and then demanded the certified person_years entry row at that wave, but the certified marital person_years begin at birth_year + START_AGE (START_AGE = 15). Any person with anchor_wave < birth_year + START_AGE had no certified row at the anchor and the builder raised — the fifth-registration execution failure (ValueError: certified marital panel has no entry row at anchor; graded #42 comment 4979269487, forensics round‑2 comment 4979437110).

The patch

One-line clamp in marital_panel_builder (engine/panel_builders.py), mirroring the adjacent censor-clip idiom:

start_exposure_year = max(anchor_wave, birth_year + START_AGE)

• Bulk (anchor_wave ≥ birth_year + START_AGE): equals anchor_wave, byte-unchanged.
• Gap class (anchor_wave < birth_year + START_AGE): equals birth_year + START_AGE, the certified risk-set entry, which the subsequent entry-row read then finds by construction. The read still reads the certified person_years row (never an assumed constant) — the load-bearing N3 point.

START_AGE from populace_dynamics.data.transitions; birth_year already on attrs. The clamp lives only in the projected-side builder; the truth side (build_marital_panel) is untouched, so the frozen v3 floor and every gated denominator stay byte-identical. The certified entry-row raise stays (its cause is removed, not the invariant). No gates.yaml cell, no runs/ artifact, no floor, no schema-audit contract changes.

Adopted option B (seed-at-marital-entry) over A (exclude-and-mark): A's symmetric exclusion would move the frozen first_marriage.18-29|female tolerance 0.356 → 0.355, breaking byte-identity, which the ratified lock forbids.

Discrimination evidence

Three tests in tests/test_m6_panel_builders.py cover the crash class the born-1980–1982 fixtures lack (a born-2001 never_married seed, a born-2008 censor-drop, and a certified-married-entry-row N3 case). With the pre-3g override temporarily restored in the working tree, all three fail with the exact reg-5 signature:

ValueError: certified marital panel has no entry row at anchor for person_ids [20]

Restoring the clamp makes all three pass. The married-entry-row test is the N3 discriminator: an assumed-never_married seed would read the wrong state and fail.

Real-frame proof (read-only; no scoring, no artifacts)

Patched builder run over the realized anchor (seed-0 crash context) via the production loaders, compared in-memory against the unclamped origin/master builder:

check	result	ratified
no raise	23,062 seeded (20,424 bulk + 2,638 class)	—
sub-START_AGE class	2,850 — waves {2015: 2568, 2017: 246, 2019: 36}; ages 7–14, mean 10.80; born 2001–2008	2,850 / same split
net seeded	2,638	2,638
censor-dropped	212, all born 2008 (birth+15 = 2023 > 2022)	212
seeded entry states	2,638 never_married, 0 certified-row exceptions, entry rows exactly at birth+START_AGE, 0 duplicates	0 exceptions
bulk byte-identity	20,424 attrs + 20,424 person_years rows identical to the unclamped non-class run; survivor-id sets equal	byte-identical
reg-5 crash ids (4979437110)	9/10 seeded with certified entry rows (never_married); 10187 (born 2008) censor-dropped by the 212-rule	resolved

Every number matches the ratified amendment. reg-5 id 10187 is the one born-2008 member among the reported ten and is correctly censor-dropped, consistent with the 212-drop rule — not a divergence.

Guard and mechanics

• Registers reg-5 4976428384 (graded Candidate 2 design: latent-permanent conditioned chained QRF (research memo) #42 comment 4979269487) in _KNOWN_STALE_REGISTRATIONS and the freshness-guard parametrize.
• Tier recount: unit 434 → 437 (the three builder tests), artifact 1013 → 1014 (the parametrize case); tier_counts.json updated, test_tier_policy green on full collection (2,932 items).
• black -l 79 clean; three small commits.

Amendment merge 92ad162 (#209) · forensics #42 comment 4979437110 · grading #42 comment 4979269487.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
social-security-model	Ready	Preview, Comment	Jul 15, 2026 12:31pm

[MaxGhenis]

Adversarial referee — PR #210 (amendment 3g implementing patch)

Independent re-verification against the ratified §2.8.2g pins (master 92ad162), the reg-5 grading (4979269487), and forensics round 2 (4979437110). Fresh worktree at head 853134b, own venv (py3.14, two-stack: policyengine-us 1.752.2 + populace-fit/populace-frame + scikit-learn 1.8.0), real-frame work read-only through the harness loaders exactly as forensics — no scoring, no runs/ artifact, no gates.yaml read or write.

1. Ratified-pin fidelity — exact transcription, verified

• The clamp sits at the pinned site (master panel_builders.py:187, the unconditional start_exposure_year := anchor_wave override — confirmed against the master blob), computes max(anchor_wave, birth_year + START_AGE) in the certified dtype via the same to_numpy(float64) → astype(source dtype) idiom as the adjacent censor clip. START_AGE from data.transitions; birth_year read from attrs (guaranteed non-null by _valid_persons). No NaN path, no tie-case drift (anchor == birth+15 stays bulk).
• The downstream entry-row read is unchanged (now :211-216): the seeded state still comes from the certified person_years row selected at the (clamped) seed wave — never a constant. The N3 load-bearing property holds in code and is now test-enforced (§3).
• The certified raise is retained (:220-225, byte-unchanged) — cause removed, invariant kept, exactly as pinned.
• Nothing else moves: no other builder, no certified-core file, no gates.yaml, no runs/, no floor, no schema/manifest file. Truth side has no import chain into the builder (build_m6_holdout_floors.py and m6_cells.py never touch panel_builders; _truth_cells consumes prebuilt truth frames; the builder feeds only _project_side). Frozen v1/v2/v3 floor files untouched.
• Test pins: the born-2001/anchored-2015 fixture and the born-2008 censor-drop case land exactly as §2.8.2g specifies, in the existing _marital_source idiom (extended, not rewritten). Pin assertion (a) — "under the pre-patch override the builder raises" — is not durably encodable post-merge; it was carried as working-tree discrimination evidence, which I reproduced independently (§3). The third test (certified-married-entry read) goes one step beyond the two pinned cases but enforces the §2.8.2g adjudication's stated load-bearing property ("that B reads the certified row, not an assumed state, is load-bearing") — within "extended, not rewritten", and it is the only class-level discriminator of that property (§3).
• The stale-guard commit (853134b) is outside §2.8.2g's enumerated patch but implements the standing registration-freshness contract with exact precedent (M6 harness: source person sex canonically in build_realized_population (reg-3 crash-2 fix + schema audit) #203 added reg-3, M6 pre-flight 1: wire the §2.8.2-pinned fertility into the injected arm (reg-4 abort fix) #207 added reg-4 in their fix PRs) and is required before the SIXTH registration the ratified lineage names. Adjudicated in-scope, not a transcription deviation. Runner comment wording matches the grading verbatim ("seed-1 scoring projection", both pre-flights passed).

2. Real-frame proof — reproduced independently, every number matches

Read-only, harness loaders exactly as forensics (panels.demographic_panel → build_anchor_frame, deaths.read_death_records, marriage.marriage_history → build_marital_panel with the anchor-weight series):

check	my independent run	PR / ratified
class (anchor < birth+START_AGE)	2,850 — {2015: 2,568, 2017: 246, 2019: 36}; ages 7–14, mean 10.80; born 2001–2008	match
patched full-anchor run	no raise; 23,062 = 20,424 bulk + 2,638 class	match
censor-dropped	212, all born 2008	match
seeded class state	2,638 entry rows exactly at birth+START_AGE, all never_married, 0 duplicates, 0 certified-row exceptions	match
bulk byte-identity	patched-on-bulk-anchor vs unclamped-master-on-bulk-anchor: attrs.equals and person_years.equals True; full-run bulk subset vs master: True/True; 20,424 + 20,424 rows; survivor-id sets equal	match
reg-5 ids	9/10 seeded never_married at their birth+15; 10187 (born 2008) censor-dropped	match

Bonus confirmation: the unclamped master builder on the full anchor still raises the reg-5 signature, and its missing[:10] reports different ids (6035, 6038, 7050, …) than the crash's ten — independently confirming §2.8.2g's claim that reg-5's ids were the household-split side's lowest, not the class's.

3. Discrimination — proven both directions

• Clamp reverted (pre-3g override restored in a scratch worktree): exactly the three new tests fail, each with the exact reg-5 signature ValueError: certified marital panel has no entry row at anchor for person_ids [20]; all 7 pre-existing builder tests still pass — confirming the doc's claim that the born-1980–1982 fixtures never exercised the crash class. Restored → 10/10 pass.
• Constant-seed mutation (entry state overwritten with assumed never_married after the row read): test_marital_builder_reads_certified_married_entry_row_for_minor fails while the other two new tests pass — it is the sole class-level discriminator of the read-the-certified-row property (three pre-existing bulk tests also catch the mutation, but only for bulk seeds). Restored → all pass.

4. Mechanics

• Stale guard: bare 4976428384 and the full issue-42 URL form both rejected (rsplit("-", 1) extraction verified empirically); fresh ids in both forms accepted. Parametrize follows the pre-existing bare-form shape.
• Tier recount: collection = 2,932; manifest sum 437+1,014+802+520+159 = 2,932; +3 unit (builder tests, module classifies unit — no PSID/oracle indicator strings) and +1 artifact (runner parametrize case) mechanically consistent; test_tier_policy green against the full pre-deselection collection, locally and in CI at head.
• black -l 79 and ruff check (repo config) clean on all four changed files. Three commits, each scoped to one pin component. CI fresh and green at head 853134b (pytest 3.11 + 3.13, lint, build); mergeable: MERGEABLE.
• Beyond CI: the full m6 module family (22 files, 143 tests) passes at head against live PSID, including test_m6_truth_identity (floor-script vs harness reducer byte identity — the frozen-floor live guard) and test_m6_schema_audit_psid. This set is closed over the diff: the only test modules importing the changed production modules (directly: test_m6_inputs, test_m6_panel_builders, test_m6_population, test_m6_runner, test_m6_runner_cli; indirectly via the m6 harness) all sit inside it, and the only production importers are the m6 harness modules plus the registered-run script — no legacy gate-1/2/2b, w-series, or oracle test executes a changed line. In the live legacy tiers (which CI skips), a handful of committed-artifact reproductions (test_real_family_*_floor_reproduces_committed_run, gate-1 QRF test_seed0_reproduces_committed_artifact in candidate5a/5a2, test_downstream_relevance) fail on my unpinned py3.14 + scikit-learn 1.8 stack — identically at head and at origin/master in the same venv (controlled A/B: same failure set both sides), i.e. pre-existing environment sensitivity, not this PR.

Findings

BLOCKING — none.

SHOULD-FIX — none.

NOTE-1 (routes to the design lane, not this PR): §2.8.3f manifest now understates the builder's reads. The clamp reads birth_year from marital.attrs, but PHASE_FRAME_COLUMN_READS["marital_panel_builder"]["marital.attrs"] still lists {person_id, censor_year, start_exposure_year, weight} — and the manifest's own contract says each entry is "the set the function requires to EXIST on the frame". Dormant today (the audit checks manifest ⊆ schema, and birth_year is on the certified 9-column schema, so nothing fires), but the §2.8.3f guard would not catch a future schema change dropping birth_year ahead of this builder — the exact run-2 defect class it exists to catch. The patch is faithful here: §2.8.2g pins "Schema-audit / manifest deltas: none", so adding birth_year in this PR would itself deviate. The pin's rationale ("needs no new contract row") conflates no-new-row with no-delta-to-the-existing-row's read-set. Recommend a one-line erratum rider in the next docs amendment authorizing birth_year into the existing manifest row, then the one-token code follow-up.

NOTE-2 (comment currency; may ride this PR or the next): (a) the new clamp comment says "the read below (:200-205)" — the insertion itself shifted the read to :211-216, so the pointer is stale on arrival (the §2.8.2g master-coordinate habit carried into a post-patch file); (b) the builder docstring's universe sentence ("their anchor interview is within their realized report/death censor") is post-3g inaccurate for the class — the binding keep-test is now the clamped seed wave ≤ clipped censor, and the 212 born-2008 have their anchor interview within censor yet drop; (c) the new test comment's "All five graded pre-scoring terminations" is loose for reg-5, which crashed inside the seed-1 scoring projection (the grading stresses that reaching score_m6_seed was a first) — the same comment's next clause already states it precisely. All comment-only; none touches a pinned surface.

Verdict

VERIFIED — ready to merge. Exact transcription of the ratified §2.8.2g pins; the real-frame proof reproduces to the digit including bulk byte-identity; the tests discriminate in both directions; the guard, tiers, format, CI, and mergeability all check. The two notes are non-blocking (one is design-lane routing by construction, one is comment text).

Referee protocol: read-only real-frame verification through the harness loaders in a disposable worktree; no gates.yaml, runs/, or held-worktree contact; scratch worktrees and venvs removed after filing.