[MaxGhenis]

This PR completes the conformance review of Track B G (the gross-benefit layer, #492), closes #495 and computes five configurations G used to refuse. It also puts G, R2 (#528) and R3 (#529) under one shared contract for inputs, results and refusal denominators. It is statutory conformance only, on invented families and SSA's published worked examples, and makes no population claim. Version track-b-g-v2.

What changes in G

• Track B G follow-ups: input-validation ordering, 402(q) cohort bound, 403(a)(5) scope for I #495.
  • Record refusals are deferred until the family's inputs are checked, in both entry styles.
  • 402(q) reduction months are bounded by cohort (FRA − 744).
  • Widow(er) reduction periods are fixed by cohort year, under SSA's January 2 to January 1 convention (RS 00615.301B.2).
  • Births 1914–1916 are bounded by the RS 00615.692E chart.
  • Cross-field checks are added.
  • A household helper evaluates one month against per-record 403(a)(5) guards.
• Newly computed:
  • dual entitlement with an age-reduced own RIB, by GN 02603.050C's PTAP formula (GN 02603.060 A.5, A.8, A.9 and B.2 reproduced);
  • disabled widow(er)s at 50–59 from January 1984: 28.5 percent, with the reduction rounded up to a dime (RS 00615.310);
  • the government pension offset ignored from January 2024 (Social Security Fairness Act; GN 02608.100);
  • independently entitled divorced spouses (402(b)(4)(A); RS 00202.005, .100);
  • one or two parents (402(h); RS 00209.001, .015).
• Newly refused, by name:
  • families protected by the widow(er) DRC saving clause (RS 00615.712);
  • a RIB-LIM that actually limits a dually entitled widow(er)'s rate.
• Registry and denominators.
  • 29 statutory worked examples in one registry, with 216 figures checked verbatim against their captures.
  • A coverage test that fails when a supported configuration class has neither an example nor a stated reason.
  • A committed invented-configuration lattice: 356,400 configurations, of which 8,831 are supported, 60,775 refused by reason and 286,794 invalid. A test regenerates it byte for byte. These are invented-configuration denominators and say nothing about populations.
  • 58 pinned source captures.
• The depletion-cut artifact (PolicyEngine-US bridge: depletion-cut offsets for illustrative households #506). A unit-tier test rebuilds the committed couple's G inputs. Its gate runs that proof and then excludes gross_benefits.py from its source pin. The artifact itself is unchanged.

One contract across G, R2 and R3

Merging master showed that R2 and R3, merged meanwhile, build on G's types. G, R2, R3 and the package-private track_b/_provenance.py now follow one contract. Each part is stated in the three design notes, with the tests that execute it:

• One schema boundary, checked once per public call.
  • Built-in scalars are matched by exact type(), and enum members by identity.
  • Declarations are rebuilt field by field. Raw container contents are checked before anything is built or hashed.
  • Collections are declared either ordered or membership. Ordered collections (COLA events, monthly arrays, histories) keep every element in order; membership collections (months, flags) collapse by value.
  • Receivers and arguments are checked before any attribute read or hook.
  • Anything else is an input error, which never becomes a refusal or a denominator row.
• Sealed values.
  • Results, refusals, outcomes and denominators can be built only by their layer's computation.
  • Copying, replacing and pickling are refused. Work that must persist stores declared inputs and recomputes.
  • Each refusal class is bound to exactly one reason enum: G, RET, ARF or recomputation.
• One denominator.
  • count_family_outcomes counts sealed outcomes from every layer, and the layer counters agree with it.
  • Evaluators check provenance (computed by their own layer and unaltered), not freshness or attribution.
• Threat model. Nothing is claimed against code that reaches private names, monkeypatches modules or mutates inputs from another thread during a call.
• Narrowings, both documented:
  • iterators are input errors (R3 used to accept them);
  • sets are input errors for ordered fields.
• No amount changes in R2 or R3. Lane cross-head differentials against master matched on every case (4,428 at the final round).

Invariants

Each invariant is a Hypothesis property; the full mapping is in docs/design/track_b_g_gross_benefits.md.

• Family totals and shares:
  • The family total stays within the maximum.
  • Proportional shares are within a dime.
  • The maximum is monotone in PIA and AIME.
  • Adding a non-dually-entitled auxiliary never raises another's benefit.
  • Dual entitlement never pays below the own benefit.
  • Households of unrelated records equal their records.
• Refusals and inputs:
  • Refusals always raise and stay in denominators.
  • Input errors never count.
• Rounding and arithmetic:
  • Amounts are dime multiples, with whole-dollar floors.
  • Ordered COLAs equal their element-by-element dime fold.
  • The PTAP formula matches an independent reference.
• The 403(a)(5) guard contract: after a qualifying PIA increase, a lower total is refused and its row is kept. A COLA alone can lower the dime-rounded total.
• Contract properties:
  • Seal integrity, receiver-first checks and layer-counter agreement hold.
  • Results are deterministic and order independent.
• Differentials:
  • ss/benefits.py within documented tolerances.
  • ss/statutory_delayed_credit.py over the whole FRA-to-70 window (ss.benefits.delayed_credit caps credits at 48 months, short for births 1917-1942 #494).

Still refused (named, kept in denominators)

• Dates: pre-1983 eligibility or payment months; pre-July-1980 DIB; Parisi before October 1999; IEDS before 1985 or with WEP before 2024; pre-1917 delayed credits.
• Family structures: combined family maximums and multiple auxiliary records; deemed spouses; more than two parents, or the circular two-parent own-RIB interval.
• Benefit forms and offsets: DIB guarantee PIAs; DIB after a reduced RIB; workers' compensation; GPO before 2024; non-AIME formula PIAs.
• Unsettled interactions: administrative finality; some dual-entitlement sequences; unresolved Parisi interactions.
• 403(a)(5): still the literal refusal here. Max ruled d1338 (adopt SSA's operational reading of RS 00630.400 and keep the literal one behind a switch). That lands in G part 2, which d1802 queues next with R2 part (b).

Readings left open (each refused; both sides pinned)

• Zero only after auxiliary age reduction. A dually entitled spouse whose rate reaches zero only after the auxiliary's age reduction: GN 02603.045A against GN 02603.050A.2/C.1.
• The circular parent interval. The parent entitlement count when one parent's own RIB is between 75 and 82.5 percent of the PIA (RS 00209.001 against .015).
• Pre-1978 historical reductions: RS 00615.301B.1.e against .005C.2, and some dual sequences.

No reading is chosen in this PR.

Review

GPT-6.1 Sol reviewed this PR over 14 rounds; round 14 approved at 4246b578. The earlier rounds found, among other things:

• widow cohort periods, the RS 00615.712 saving clause and the depletion-cut gate (round 1);
• contradictory result fields and role/record compatibility (round 10);
• mutable numerics, unsafe pickle restoration, a false COLA property, input errors counted as refusals, and mutable guard state (round 11);
• forged identities and containers rebuilt before validation (round 12);
• a set of COLAs that lost an event ($1.10 instead of $1.20) and getters reading receivers before checking them (round 13).

Each was fixed as a class across the layers. Round 14 left one low finding: deleting a refusal's exception notes raises IndexError. It changes no amount or denominator, and is fixed in G part 2. The reviews are in the Track B evidence folder (out/review-g-r*.json).

Checks

• At 2907297c, run locally:

  Suite	Result
  G	8,169 passed
  R2/R3	2,352 passed
  Delayed-credit, d1408 and birth-evidence	671 passed
  Bridge, live PolicyEngine-US oracle	615 passed

• After merging master (1e739d32) at 4246b578: tier policy, birth-evidence and B2 (244 passed), and G with R2/R3 (10,521 passed). Black and ruff are clean, and protected files are untouched.

• Tiers:

  Tier	Tests
  unit	18,088
  artifact	4,253
  integration_psid	1,450
  reproduction_legacy	520
  oracle_policyengine	308
  Total	24,619

• Cost: G's conformance regeneration takes about 1.43× the CPU of 5e68159b, measured back to back with identical output.

axiom: n/a: not a country-model change. G, R2 and R3 are Python statutory references per d515; rulespec-us has no 42 U.S.C. 403 encoding.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Oct 21, 2026 2:12pm UTC

[MaxGhenis]

Merge audit: merged as 6967142 at head 4246b578, with a merge commit pinned by --match-head-commit.

• Independent review. GPT-6.1 Sol reviewed 14 rounds. Round 14 approved at 4246b578, the merged head, with no medium or high findings. Its one low finding (deleting a refusal's exception notes raises IndexError) changes no amount or denominator. It is assigned to G part 2, which goes next. Rounds 1–13 requested changes, and each was fixed as a class across G, R2 and R3; the PR body lists them.

• CI. Every check passed on the slot-time rerun (Tests run 39614670109, attempt 2, against master 1e739d32): four pytest shards, graph-integration on 3.13 and 3.14, pytest, build, lint and Vercel. GitHub Pages deploy was skipped. gh pr checks exited 0, and the PR was MERGEABLE, not a draft, with no changes requested.

• Local gates at 2907297c. G 8,169; R2/R3 2,352; delayed-credit, d1408 and birth-evidence 671; live PolicyEngine-US bridge 615 (all passed). After the master merge (4246b578): tier policy, birth-evidence and B2 244, and G with R2/R3 10,521 (all passed).

• Tiers at merge, recounted by collection at the slot:

  Tier	Tests
  unit	18,088
  artifact	4,253
  integration_psid	1,450
  reproduction_legacy	520
  oracle_policyengine	308
  Total	24,619

• Protected files (gates.yaml, engine/loop.py, engine/steps.py, runs/*.json) are untouched.

• Next (Max's d1802): G part 2 with R2 part (b), then insured status.

🤖 Generated with Claude Code