[MaxGhenis]

Tier-slot head: 88b5df28 merges master d8302233 and recounts the tiers. Reviews r2 to r10 approved. r2 to r9's minor findings are fixed. r10's one minor finding and four nits are all in the report, about its wording and its Hypothesis-dependent counts. A docs-only follow-up PR fixes them after this merges. This PR builds milestone OP1 of the open-population design (docs/design/open_population.md on master, now at revision 14). Max approved the design in ruling d1925 at revision 11. Revision 12 adds the death-alignment boundary under ruling d1922. Revisions 12 to 14 change no passage OP1 builds. A Subfleet lane (GPT-6.1 Sol) built it, and later its fixes, in a standalone clone, on invented data only. The lane's sandbox can't write .git, so the main session reviewed and committed its tree. The report, with every code fact it relies on (file and line), is docs/design/open_population_evidence/op1_report.md.

What it adds

src/populace_dynamics/open_population/:

• exits.py: a harness-only exit adapter for the mortality slot (_ExitAdapter).
  • It calls the slot's mortality adapter unchanged, so its death draws are the wrapped adapter's.
  • It then draws emigration among survivors only, from a tagged child stream of the mortality module (off by default).
  • A non-null emigration hazard is refused unless the marital adapter is the explicit no_marital_transitions. The repository's marital adapter widows anyone whose spouse leaves the roster, whatever the exit (cola_track_a/adapters.py:104–117), so OP4 must supply exit-aware widowhood first.
• streams.py: DirectRNGStreams, which builds the registry's spawn keys directly, at O(1) cost per draw. Emigration uses it. The sealed loop's own draws stay on ProjectionRNGRegistry, and engine/rng.py is unchanged.
• births.py: a birth-entry adapter for the fertility slot. It leaves fertility draws unchanged and declares each newborn as a maternal_birth addition, with IDs from the projection's allocator.
• schedule.py: the scheduled-entry seam. It builds m6_scheduled_entries_by_year and the projection's SyntheticPersonIdAllocator together, validates them with validate_projection_allocator on the exact metadata, and declares immigrant_cohort additions with their entry year.
• harness.py:
  • Production horizon. A production run names a registered scenario (REGISTERED_PRODUCTION_HORIZONS, tr2026_intermediate → 2100, design §2.9) and cannot choose its end year. An unknown scenario raises ID_OR_STREAM_COLLISION, and shorter horizons are prefixes of the completed run.
  • Roster order. The initialized roster is put in canonical person_id order.
  • Accounting. Per-year and run-level checks run on engine/accounting.py and engine/accounting_history.py (ACCOUNTING_IDENTITY_FAIL on failure), using three-column snapshots and a ledger indexed by year.
  • Result labels. Results record whether they came from a production or a gate run.
• gates.py: an unaligned-only gate run.
  • Its request has no target field, and its keywords are explicit.
  • Metadata is limited to an allow-list (nawi_by_year, wage_base_by_year, which advance_age reads). Any other key raises GateTargetRefused before an adapter runs.
  • No module whose name contains align loads, whether on import or at run time.
• errors.py, events.py: named refusals and event declarations.

The new modules join POST_REVIEW_SOURCE_EXCLUSIONS and its pin. docs/design/open_population_evidence/op1_run_size.py measures invented runs to 2100, at 25, 100 and 400 starting people with emigration on.

Invariants and their tests

Hypothesis property tests and example tests in tests/open_population/ (231, all unit), all on invented rosters:

• Stock-flow, every year: end = start − deaths − emigrants + births + scheduled entrants, exactly in counts and within the reported residual in weights.

  • Every addition has a known entry_kind, and every exit has exactly one kind.
  • No one exits twice, and no ID is reused.
  • Offsetting weight swaps are refused in all six fixed slots.

• Emigration coupling:

  • With emigration off, the surviving roster equals the closed run's slice by slice, with and without scheduled entrants.
  • No one dies and emigrates in one year.
  • For one year's fixed risk set and coupled draws, raising emigration probabilities never removes an exit selected at the lower probabilities.

• Emigration stream: the emigrant set equals the one recomputed from the registry's tagged children. The marginal matches p, and the draws are independent of the mortality person stream and the fertility stream.

• Stream identity: at every valid address, DirectRNGStreams equals ProjectionRNGRegistry. The check is exhaustive on a grid (draws 0–2; n_periods 0, 1, 7, 75, 86; every module and method, including the period-0 tagged cases), plus Hypothesis over draw, period, module, ordinal, child and tag. A Hypothesis walk of an exact int draw changed in place (fresh values, one-bit flips and steps, negations) gets the registry's streams at every step.

• Refusal identity: for arguments of built-in and NumPy types, wherever the registry returns or raises, the direct class does the same, with the same stream or the same exception type and message. The one exception is a spawn count the registry cannot complete. User-defined argument types are outside the claim, and the report names the cases where they can differ; the engine passes none of them. The direct class repeats the registry's steps in order:

  • the module, then the period interval;
  • the root seed, recomputed on every call (only an exact int seed's root is kept, and it is rebuilt when the seed changes; any other seed's root is built on every call);
  • spawn's negative-count and ssize_t checks;
  • the list lookup, with its negative wrap.

  Each returned sequence gets its own copy of the root's entropy. Every comparison checks the element types of the entropy and the spawn key as well as their values. A grid tries every combination of 18 malformed periods (including NumPy floats and bools, Decimals and arrays), three modules (one unknown) and nine tails (including NumPy integers that wrap), for all six methods at ten horizons (including counts past ssize_t and wrapping ones). Malformed draws and 80 Hypothesis examples extend it.

• Horizon: a registered scenario's request always ends at its registered horizon, and two production runs of one scenario to different end years cannot be constructed. A production run to 2100 runs in the suite. The year-t slice is identical across prefix reads.

• Determinism and order: the same inputs and seeds give identical output, including with a mortality adapter that does not sort. The sealed fertility materializer still links children to mothers in row order (baselines/fertility.py:114–128, engine/steps.py:473–497). Its minimized two-mother counterexample stays a strict xfail, and sealed code is unchanged.

Run size and RNG cost

On this host, at 25, 100 and 400 invented people over 75 years:

• Every run reconciles all 75 periods.
• Direct and registry emigration give identical projection hashes.
• Per draw, the registry costs 49 µs at 7 periods and 201 µs at 75. The direct path costs about 6 µs at either horizon, 6.6 µs with the exact refusal checks.
• With direct emigration, building the registry's sequences for the sealed loop's own draws takes 45%, 64% and 80% of profiled runtime as the roster grows. A follow-up PR, after this one merges, will serve those draws from the direct class through the harness wrapper, with no sealed change, and test that the projection is identical either way.
• The full-size measurement remains open before OP10a.

Checks

At 88b5df28, merged with master d8302233:

• pytest tests/open_population tests/estimates/test_birth_evidence_artifact.py tests/test_entrant_schedule.py tests/test_entrant_domains.py tests/test_entrant_id_allocation.py tests/test_track_b_holdout_registry.py tests/test_track_b_holdout_registry_committed.py: 556 passed, 2 skipped, 1 strict xfail. The OP1 command alone (the first five paths) gives 341 passed and 1 strict xfail in 8 to 20 s, depending on host load. That is OP1's 334 plus the 7 OP0.1 record tests master keeps in tests/open_population/. CI runs the rest of the suite.
• Tier recount: OP1 adds 231 unit tests and nothing in any other tier. tests/tier_counts.json and tests/README-tiers.md move unit from 18,549 to 18,780 and the total from 25,119 to 25,350. The recount collected only the test files that differ from master, not the whole repository; CI's tier-policy test checks the totals.
• black -l 79 and ruff clean on every changed file; git diff --check clean.
• CI: run 40229625962 on 88b5df28 passed every job, the tier check included (finished 21:16Z). Runs 40194301088 on 78c6c2d1, 40188392641 on 5f276453, 40184373475 on 42be3231 and 40180013772 on 3cd74630 passed every shard except the tier check, which waited for this recount.
• No edits to engine/ (including engine/rng.py), gates.yaml, committed runs or src/populace_dynamics/track_b/; git diff --quiet d8302233 over the sealed paths exits 0. The only shared-file change is the tier recount.

Reviews

• r1 (Opus 5.5, at bba5b812): REVISE. It found three major issues: a self-certified production horizon, untested emigration stream identity, and an open gate metadata channel. It also found seven minor ones. All are fixed in a8c627a8, with the RNG fast path in 7d321aef, a production test at 2100 in 0d0c073c, and the report and measurement in 3d69b1fc. The report's §4 maps each finding to its fix, its test and its mutation re-check.

• r2 (GPT-6.1 Sol delta review, at 3d69b1fc): APPROVE, with three minor findings: an incorrect load range in the report, no test of refusal precedence (mutant N10 survived), and a non-integer horizon the registry refuses but the direct class accepted. 1647a4ba fixes all three: streams.py mirrors the registry's integer refusals in its order, the refusal grid catches N10 and five other refusal mutants, and the report gives the JSON's load ranges and labels every timing outside the JSON.

• daa1f58d merges master 4e20c6e4 (Track B: held-out data registry for every Track B and open-population gate #560 and Registry: compare a pull request's own commits from its fork point #582) without conflicts.

• r3 (Opus 5.5 delta check of 1647a4ba and the merge, at daa1f58d): APPROVE, with one minor finding. The report stated the refusal invariant more broadly than the code delivered: 288 of 2,352 exotic-type addresses still differed, though none can arise from the engine. dee1e1b7 closes it. The direct class now mirrors the registry exactly, the probe's 2,352 addresses agree, 4,556 period-zero identities hold, and twelve mutants of the fix are killed. The report states the invariant to its true scope.

• r4 (Opus 5.5 delta check of dee1e1b7): APPROVE, with three minor findings and a nit:

  • the invariant still failed for user-defined types, and the cached root missed a draw mutated in place and a later np.errstate(over="raise");
  • every returned sequence shared the cached root's entropy list;
  • no test pinned spawn-key element types.

  6361b4c0 fixes all three. Negative positions wrap as the list lookup does. The draw seed is recomputed per call, and the root is rebuilt when it changes. Each sequence gets a fresh entropy list. Both identity helpers compare element types, and three new tests pin the root's state. The report scopes the invariant to built-in and NumPy types and names the user-defined cases left. Rerun on the fix, r3's and r4's probes give no difference for built-in, NumPy or pandas types, and 13 mutants of the fix are killed.

• r5 (Opus 5.5 delta check of 6361b4c0): APPROVE, with three minor findings and a nit, none reachable from the engine. It confirmed the coordinator's four checks.

  • The cache compared seeds by value, so a draw changed in place to an equal value of another type (3.0, Decimal(3), np.int64(3)) was served from the cached int root, where the registry refuses it or types its entropy differently.
  • The entropy-copy test covered seed_sequence only.
  • "A refused seed is never kept" and wraps below -length were unpinned.

  3fda5862 fixes all three. Only an exact int seed's root is kept. Both identity helpers compare entropy element types. Twenty new test cases pin an equal seed of another type, entropy isolation in every method (period-zero tagged calls included), refused seeds on repeat calls and wraps inside and below the range. Rerun on the fix, r3's, r4's and r5's probes give no difference for built-in, NumPy or pandas types. Every mutant r5 found non-equivalent is killed.

• r6 (Opus 5.5 delta check of 3fda5862): APPROVE. It found the code correct, with no difference in 472,392 type-sweep comparisons, and confirmed the coordinator's four checks. It had two minor findings and a nit, all in the tests and the report:

  • The report wrongly called mutant C2, a refused seed kept in the cache, equivalent. A negative int seed, from a draw changed after construction, is refused and does reach the cache.
  • The equal-seed fix was not pinned for a field replaced through object.__setattr__.

  3cd74630 changes only the tests and the report; streams.py is unchanged. Ten new cases pin refused negative int seeds and frozen-field changes, and the seed-follow test now catches a hash-keyed cache. That kills all four of r6's non-equivalent survivors (C2, M9, M13, M16). The report corrects the C2 claim in place and adds a review r6 section.

• r7 (Opus 5.5 delta check of 3cd74630): APPROVE. It found the code correct and confirmed the coordinator's four checks. It had one minor finding and two nits, all in the tests and the report:

  • No test sent an exact-int draw past int64, or two seeds equal as floats, down the cached path, so four contrived mutants survived (S8, R4, R2, R5).
  • Two Hypothesis-dependent kill counts were given as single numbers, and one count of re-wrapped lines was off by one.

  42be3231 changes only the tests and the report; streams.py is unchanged. r7's verified test, test_cached_root_follows_exact_int_seeds_compared_exactly, kills S8, R4 and R2. R5 differs only past CPython's 4,300-digit int-to-string limit, a process-wide setting, and stays unpinned. The report fixes both nits and adds a review r7 section.

• r8 (Opus 5.5 delta check of 42be3231): APPROVE. It found the code correct, confirmed the coordinator's four checks, closed r7's finding and nits, and reproduced every count. Its one minor finding was again in the test: the seeds never aliased modulo 2^64 and never passed 2^64 + 5201, so five contrived cache-key mutants survived (K6, K1, S9, S14, S13).

  5f276453 adds r8's verified draw of 2^1100 to that test, and changes nothing else in it; streams.py is unchanged. That kills all five, with no kill lost across 100 mutants. The report adds a review r8 section.

• r9 (Opus 5.5 delta check of 5f276453): APPROVE. It found the code correct, confirmed the coordinator's four checks and reproduced every author mutant output. Its one minor finding was again in the test: six contrived lossy cache keys still passed, among them the cached seed compared modulo 3, by its low 64 bits past 2^64, by bit length, or without a large seed's sign. It also had four nits in the report.

  78c6c2d1 takes both of r9's verified options; streams.py is unchanged. The draws 2^64 and 2^64 + 1 swap places in the exact-int test, and a new Hypothesis property test checks the invariant itself: any walk of an exact int draw gets the registry's streams. Together they kill five of the six, with no kill lost across 114 mutants. The sixth, a key compared modulo 2^89 − 1, is ruled out only by the exact comparison the code makes. The report fixes the nits, corrects its scope commands to diff against master 4e20c6e4, and adds a review r9 section.

• fa862935 merges master d8302233 for the tier slot, without conflicts; its tree equals git merge-tree --write-tree 78c6c2d1 d8302233. 88b5df28 recounts the tiers and updates the report.

• r10 (Opus 5.5 delta check of 78c6c2d1 and the slot head 88b5df28): APPROVE at 88b5df28. The merge is clean: its tree equals git merge-tree --write-tree 78c6c2d1 d8302233. OP1's diff against master is its 20 new files, the two exclusion pins and the recount, and every count reproduces. r9's finding is closed as r9 asked:

  • K9 and K11 fall to both new tests;
  • K12, K13 and G1 fall to the property test in 40 of 40 seeded runs;
  • K10 is ruled out only by the exact comparison.

  Its one minor finding and four nits are all in the report. The r9 table's r8-harness row gives one run's property-test gains as fixed, though they vary with Hypothesis's draws. Two r5 and r6 table cells need ranges (7 or 8; 54 or 55). Three sentences need clearer wording or a wider timing range: r10's OP1 command took 20.06 s at load 98. A docs-only follow-up PR fixes them. Six new contrived cache-key mutants survive. All fall in r9's known classes (an odd-factor modulus, size, or values the strategy can't reach), and the exact comparison cached[0] != seed rules out every lossy key.

Still to do

• The coordinator lands it at 88b5df28: r10 approved and CI is green.
• A docs-only follow-up PR fixes r10's report findings.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Oct 25, 2026 8:12pm UTC

[MaxGhenis]

Landing audit (Microcosm Dynamics coordinator, 2026-10-26 00:05Z).

Merged at the reviewed head 88b5df28edc327d1656c6a6f32e1dcd879168c43 with --match-head-commit, as merge commit 444f970d. This PR held the tier-count slot under the coordinator's 11:05Z ruling. It was the first slot PR with an approved head that had merged master d8302233, recounted tiers, passed CI and left draft. #573, the other candidate, is out of the slot until its round-8 fixes land.

Gates checked at 00:00Z by the lane and again at 00:02Z by the coordinator:

• gh pr checks 566 exited 0. Tests run 40229625962 succeeded at 88b5df28 in every job (lint, the four pytest shards, build and graph integration); deploy was skipped.
• MERGEABLE, merge state CLEAN, not a draft, no changes-requested review.
• 88b5df28 is the tier recount on fa862935, whose parents are the OP1 branch (78c6c2d1) and master d8302233. d8302233 was still master at merge time.
• Tier counts at the head: unit 18,549 → 18,780, total 25,119 → 25,350. The +231 is OP1's own tests. The other four tiers are unchanged.
• The diff against master is 24 files: OP1's 20, two exclusion pins and the two tier files.

Review:

• An independent Claude Opus 5.5 delta check (r10) approved 88b5df28, covering 5f276453 to 88b5df28. The Codex review lanes were full. It found the merge clean (its tree equals the merge-tree of 78c6c2d1 and d8302233), reproduced every count, and closed r9's finding as r9 asked.
• Its remaining findings are one minor and four nits, all in op1_report.md, none in code or tests. A docs-only follow-up PR will fix them. It does not touch the tier files, so it does not need the slot.

Other open tier-slot PRs must merge master at 444f970d or later and recount before they land.