Implemented vs Registered

Recommendation:

The engine banklib.L3.nii_irrbb is BUILT, tested (10/10), and honest — but the insightalm registry entry M-423 is still status: planned with empty component lists (engines/assumptions/contracts = []) and the model card is still the "PLANNED, NOT BUILT" stub. A built, ratified model whose own registry denies it has an engine is an internal inconsistency 2L cannot leave standing; the engine is also invisible to check_registry_integrity (only InsModel binding manifests are scanned, not bankview).

Recommendation: Reconcile the registry (flip status; register the engine id + DS/A bindings or flag them scaffold the way M-431 provenance does) and author the real 13-section M-423 card; set lifecycle.ratification_ref: RAT-423-v1.0.0. (Condition C-423-01.)

The engine energylib.L3.cost_of_service is BUILT, tested (10/10, incl. 6 live- store API tests), and honest — but the registry entry M-431 is still status: planned with empty bindings and the card is still the "PLANNED, NOT BUILT" stub. Same internal inconsistency as M-423. The Tier-3 bar is card + intent; the intent half is honest, the card half is unbuilt.

Recommendation: Reconcile the registry + author the real M-431 card (Tier-3 standard: methodology, sourced-vs-recovered-vs-scaffold provenance, the 6/8 reconciliation, the XEL/NEE misses); set lifecycle.ratification_ref: RAT-431-v1.0.0. (C-431-01.)

VM-21 has no VM-21 reserve engine (registry Q-02)

M-002 registers insmodel.L4.reserve_engine_stat as its reserve engine, but that class (STATReserveEngine) computes NAIC CRVM/NLP *life* reserves — it has no VA / CTE logic. The actual VM-21 CTE70 + Standard-Scenario math lives in C3Phase2Engine, a *capital* engine bound under M-050/C3 Phase II, not a reserve engine. So M-002 as registered has no engine that computes its stated methodology.

Recommendation: Either (a) build a dedicated vm21_engine (parallels vm20_engine) that owns the held VM-21 reserve = max(CTE70, Standard Scenario), delegating the stochastic leg to the C3Phase2 machinery; or (b) re-register M-002 to explicitly compose C3Phase2Engine as its reserve source and rename reserve_engine_stat's binding. Resolve registry Q-02 either way. Update the model card + add a frozen VM-21 gold case for the held reserve.

VM-22 has no VM-22 engine (CRVM life stand-in)

M-003 (Non-Variable Annuity statutory) is status under_development and binds reserve_engine_stat (STATReserveEngine), a CRVM *life* death-benefit reserve calculator. It values a mortality leg that runs off to zero at end of premium-paying period, not an annuity accumulation/payout liability. There is no CARVM or VM-22 PBR engine.

Recommendation: Build a CARVM engine for fixed/payout annuities (greatest-present-value of guaranteed benefit streams) as the near-term statutory basis, with a VM-22 PBR path as the roadmap target. Until then keep status under_development and label the card a CRVM stand-in (done). Add the engine to engine_registry as E-NNN.

Full stochastic reserves are gated on GOES (M-120) — today they run on the deterministic floor

VM-20 (M-001), VM-21 (M-002), and C-3 (M-050) all require the full prescribed ESG scenario set for their held *stochastic* reserve. Because GOES (M-120) is under_development, these engines compute the SET/SSA *exclusion diagnostics* but hold max(deterministic, NPR) — the stochastic CTE shown is a diagnostic, not the held amount. The platform's "stochastic" reserves are effectively deterministic today.

Recommendation: Sequence M-120 calibration (INV-009) as the unlock for the Tier-1 stochastic chain, then enable the full-scenario path in VM20ReserveEngine / C3Phase2Engine and re-validate the held reserves. Until then, state plainly (done in cards) that the held reserve is the deterministic floor.

Validation evidence + change logs missing across most of the inventory

Only M-001/M-020/M-050 carried full documentation packs before this pass. Most models record validation_evidence: missing and change_log: missing with peer_review: pending. Gold tests freeze behaviour but many assert only structural invariants (e.g. reserve>0), not correctness against external truth. The flagship T0-vs-10-K match is circular (BV-032).

Recommendation: For each Tier-1 model: produce a validation-evidence pack (back-test vs disclosed results once BV-032 re-calibration lands, sensitivity suite, challenger comparison), a change log, and a 2L ratification. Sequence behind BV-032 (firm-data) for anything needing 10-K reconciliation.

banklib.L3.cecl_allowance not registered in insightalm engine_registry.yaml

Recommendation:

Registry status=planned and card say 'NOT BUILT' — both contradict the real engine

Recommendation:

The linear repricing-gap structure reconciles the calibrated +100bps up-shock exactly but systematically UNDER-predicts the disclosed down-shock earnings-at-risk. Reproduced on JPM FY2025: +100 recon_err 0.0 (the anchor); −100 −12.5% (modelled −2,100 vs disclosed −2,400); −200 −30% (modelled −4,200 vs disclosed −6,000). The disclosed down-shocks are super-linear (deposit-floor convexity: JPM −200 = 2.5× −100; BAC 2.45×) which a linear gap cannot capture.

Recommendation: Keep the convexity limit DISCLOSED in the card + any surface (it is honestly a decision-support limitation, not a hidden defect — the engine reconciles what it calibrates and predicts the rest). Reading the −200bps modelled figure as the bank's true down-rate earnings-at-risk is out of scope (Condition C-423-02). A convexity term / non-linear repricing curve is the documented upgrade path — NOT a precondition for this Tier-2 decision-support ratification.

Reconciliation over the live store (8 utilities): 6/8 within ±10% (DUK −3.7%, CEG −3.6%, D −7.5%, SO −7.8%, AEP −8.0%, ED −9.8%); 2 misses. The intake brief named the misses as NEE/CEG — the LIVE DATA shows the actual pair is XEL (+17.2%) and NEE (−15.6%); CEG reconciles. NEE's modelled requirement falls BELOW disclosed (merchant/IPP earnings above the cost-of-service return — the documented < case); XEL's is ABOVE (regulatory lag / accounting plant > authorized rate base — the documented > case). Both are correct, informative signal.

Recommendation: The card must state the correct pair (XEL/NEE) with the return_test interpretation, and the two misses must stay documented as signal — never tune the tolerance to hide them or drop the non-reconciling peers (Conditions C-431-02/03).

AG-53 has no complex-asset modelling; listed component engines not composed

CFTEngine is a generic 7-scenario flat-rate cash-flow-testing engine over a homogeneous fixed-coupon bond book at book value. AG 53's defining requirements — complex/illiquid asset modelling, projected net investment income with asset-class spreads + default/ downgrade haircuts — are absent. Separately, the M-004 Components list asset/investment/ mortality/lapse/multi_basis engines, but CFTEngine imports NONE of them; it takes a pre-computed liability-CF dict + a bond DataFrame directly (card-vs-code divergence).

Recommendation: (1) Add an asset taxonomy + spread/default/downgrade haircut model and projected-NII for complex assets to meet AG-53; (2) either wire the listed component engines into an AAT orchestrator that feeds CFTEngine, or correct the M-004 Components to reflect that CFT consumes pre-computed inputs. Replace flat scenarios with the prescribed Model-822 paths.

AG-55 AAT-CFT composition unwired (under_development)

The reinsurance engine runs and is well-tested, but the defining AG-55 exercise — net-of- reinsurance cash flows run through the CFT core (M-004) with supporting-asset look-through for asset-intensive/offshore-affiliated reinsurance — is not wired. No orchestrator composes CFT + reinsurance + asset; no AG-55 output contract. AAT reports first due Apr 2026.

Recommendation: Build the AG-55 orchestrator: net the reinsurance leg, run the retained + recoverable cash flows through CFTEngine with the supporting-asset portfolio, and emit an AG-55 adequacy contract. Keep under_development until composed. (See also INV-024, the capital_relief bug, which sits in the same engine.)

'Lattice/prepay' structured pricer has no lattice, no PSA; 'OAS' is a Z-spread

Despite the "prepay / lattice" family name, there is no binomial/trinomial tree or backward-induction; embedded optionality enters only through a deterministic flat CPR and a parallel spread. The "OAS" is a parallel spread-to-zero-curve (a Z-spread), not a Monte-Carlo/lattice option-adjusted spread. No PSA ramp; prepay does not respond to the rate path, so negative convexity is understated. Single flat pool — no tranching.

Recommendation: Add (1) a PSA/refi-incentive prepay function so CPR responds to rates, (2) a Monte-Carlo or lattice OAS engine for true option-adjusted spread, (3) tranche/waterfall support for structured deals. Relabel the current "OAS" as Z-spread until MC-OAS exists.

VM-21 SVJ/jump assumptions (A-061/062/063) bound but not consumed

The registry binds stochastic-vol vol-of-vol, jump intensity, and jump size to M-002, but C3Phase2Engine._generate_equity_scenarios is plain constant-volatility GBM — it consumes none of them. Tail CTE is understated vs a jump-diffusion / the NAIC ESG.

Recommendation: Replace the GBM generator with the GOES SVJ scenario set (ties to INV-009/010) so the bound A-061/062/063 actually drive the tail, or unbind them and document GBM as the basis.

ORSA stressed RBC: single-period only; no multi-year capital roll-forward

Re-scoped 2026-06-06 to the multi-period leg (the frozen-denominator leg is fixed, see progress). Each shock is still applied once to the current balance sheet — no multi-year capital roll-forward (that lives in a separate ProjectionOrchestrator the engine doesn't call), and there is no frozen gold pinning the counterintuitive rate-up path (positive P&L yet most capital-destructive). Output-changing → gated on ratification + gold.

Recommendation: Re-derive required RBC under each scenario (run CapitalEngine on the stressed balance sheet) so the ratio reflects both numerator and denominator; integrate the ProjectionOrchestrator for multi-year ORSA solvency projection; add a frozen gold case for the negative-surplus path.

Hedge projection and hedge-effectiveness engines are not integrated

DerivativeProjectionEngine (projection) does not produce the delta-hedge / delta-hedged-item series that HedgeEffectivenessCalculator consumes; the offset series used for the ASC-815 effectiveness tests is a deterministic illustration. derivative_pnl is a simplified identity (net_hedge_position - hedge_cost), not a true period-over-period change with greek attribution. No dedicated test module for the effectiveness calculator.

Recommendation: Feed the projection engine's hedge + hedged-item MV series into the effectiveness calculator so dollar-offset/regression/variability run on real projected data; wire the greek-attribution P&L from HedgingEngine; add an effectiveness test module.

Liquidity stress is horizon-dilated -> implausible coverage; stylized, not firm-calibrated

Outflow rates are annual percentages scaled linearly by 30/365, so even 'severely_adverse' (3x surrenders) yields LCR ~119x and a ~5,647-day survival horizon. Tier weights/haircuts are hardcoded identically for every firm; inflows/outflows are total-assets/notional proxies, not modeled liability cash flows; no dynamic-lapse surrender model; no multi-period ladder despite the liquidity_projection_v1 contract name. Owner is tbd (Q-09).

Recommendation: Model a real 30-day stressed liability cash-flow ladder (dynamic surrender), asset-level liquidity scoring + haircuts, and a multi-period projection. Assign an owner (resolve Q-09) so the model gets a validation cadence.

Counterparty contagion is single-hop and near-inert; 'Other Reinsurers' plug dominates concentration

The cascade fires only when a firm impaired by the direct event is itself a named reinsurer; external nodes like 'Athene (APO)' don't map to firm node 'APO', so contagion rarely propagates (canonical Fortitude stress -> zero cascade). Haircuts are a deterministic LGD proxy (no PD, no transition matrix, no correlated downgrades, no time dimension); collateral credit is a flat 50% via substring match. The 'Other Reinsurers' residual plug is the largest single edge AND largest aggregate counterparty (~38% of system), so HHI/concentration are driven by an artefact, not a real name.

Recommendation: Unify external-counterparty identity with firm nodes so cessions to a modeled firm degrade that firm; add a correlated default model (PD + transition matrix + correlation); replace the residual plug with named exposures where disclosed, or exclude it from concentration metrics.

Adopt the M-NNN(model)/E-NNN(engine) identification standard (see naming_standard above)

Standard RATIFIED (Decision 046) + enforced by check_registry_integrity.py. Precise scope: only 4 TRUE collisions remain — the tier-0 decrement engines carry a governance model_id that EQUALS a registered model id (mortality_engine=M-001 vs VM-20, lapse=M-002 vs VM-21, premium=M-003 vs VM-22, benefit=M-004 vs AAT). The higher engine ids (M-101+) are the engine namespace and don't collide. The 4 ids are COUPLED across legacy_metadata + engine_registry + data_source_registry.consuming_models + ~10 governance test assertions, so retiring them is a deliberate Phase-2 migration, not a rename.

Recommendation: Phase-2 migration: re-id the 4 colliding engines to their engine_id across legacy_metadata, engine_registry, and data_source_registry.consuming_models; update the ~10 coupled test assertions (test_vm20_governance, test_legacy_metadata_loader, ...); run the full InsModel suite green; then flip check_registry_integrity's collision check from warn to hard-fail so no engine id can ever equal a model id again. DONE so far: Decision 046, the guard (now precisely flags the 4).

M-003 card body + registry description are STALE (still describe the CRVM stand-in)

Recommendation:

_annuitization_value is effectively a lump-sum max(AV, GBB) stub — the 'life-contingent greater-of' is not actually computed

Recommendation:

No firm 10-K back-test — the honesty anchor is the synthetic frozen gold (BV-032)

Recommendation:

The M-005 card Validation Packet was not updated for COND-001(c): no row surfaces sensitivity_and_cross_check.md, the three sensitivity tables, or the composition-cross-check tolerance; the external worked-example deferral is not stated as an explicit carve-out.

Recommendation: Add a Validation Packet row pointing at the COND-001(c) evidence and state the external-worked-example deferral as a data-gated carve-out.

The M-005 snapshot (scripts/model_snapshots.py M-005) CRASHES (IndexError) — its driver uses the stale singular treaty/gross_liability engine-context schema, while the wired engine reads treaties (list) + gross_book, returning an empty frame so out.iloc[0] fails. The card's snapshot-reproduces claim is unverifiable.

Recommendation: Update the snapshot driver to the wired treaties/gross_book schema so the card snapshot is reproducible.

Segment PD/LGD/EAD decomposition is an unvalidated modelled prior; reconciliation is by construction

Recommendation:

M-133.md Limitation 7 + the "Tracked for ratification" note still describe INV-032 (the packaged finlib interface + sibling-aware drift gate) as NOT yet built. Both now exist and are merged (FinView #111 / InsModel #90); this re-review clears COND-002 and approves the model.

Recommendation: Update the card to mark INV-032 closed (packaged finlib.__version__ 1.0.0 + the check_finlib_drift.py gate now exist); bump registry lifecycle.ratification_ref to RAT-133-v1.0.3 and set peer_review.status: signed. Doc/metadata only. (FIND-133-01.)

Doc-currency / drift coverage gap (banking analogue of INV-032 / LG-420-03): model_doc_currency.py cannot watermark M-423 — the engine is bankview-resident with no insightalm @engine binding.

Recommendation: Apply the sibling-aware drift-gate pattern the M-133 finlib gate now demonstrates when bankview engines are consumed cross-repo.

Scaffold/recovered substitutions present (all already flagged in engine provenance, verified live): allowed_roe RECOVERED at the ~9.7% sector prior (the M-432 gap, allowed_roe_sourced False across the peer set); equity_ratio / cost_of_debt scaffold; CWIP default 0; Dominion (D) rate base = invested-capital proxy (rate_base_sourced False).

Recommendation: Keep every caveat disclosed in the card / registry description / provenance; M-432 (allowed-ROE / rate-case) remains the precondition for booked use + tier promotion (Condition C-431-02).

Lapse/mortality curves bound but not consumed by the engine

M-003 binds lapse curves (A-010/A-011) that STATReserveEngine never reads; M-004 lists mortality/lapse among components but CFTEngine takes a pre-computed liability-CF dict, so they enter (if at all) upstream, not inside the engine.

Recommendation: Thread the bound decrement curves into the engines (M-003 once a CARVM/VM-22 engine exists, INV-002), or move the bindings to the upstream liability-projection step that actually consumes them.

P&L attribution: assumption-change line is a flat-rate NPV proxy; lapse variance is a count proxy

The assumption-change impact is a single-cohort flat-rate NPV using net-income-per-policy as a reserve proxy (no re-projection); lapse variance is an in-force-count proxy; new-business is premium x flat 5% margin; hedge_pnl is pass-through; other_items is hard zero. The period-1 residual (0.70) is the gap between the proxy and realized income.

Recommendation: Replace the assumption-change proxy with an actual before/after reserve re-projection; derive lapse variance from modeled releases; wire real hedge P&L. Tighten the residual to ~0.

Futures convexity is a single-sigma closed form; sibling pricers have crude greeks

The convexity adjustment is a single-sigma Ho-Lee/Hull-White closed form — accurate front- month, under-built for deferred strips (no vol surface). Equity-future DV01 is a crude S*T*1bp approximation; Treasury CTD is static (no delivery-option/switch modelling).

Recommendation: Calibrate convexity to a short-rate vol surface for deferred contracts; model the CTD delivery option and a proper equity-future sensitivity.

Vol surface: no butterfly arb-check; SABR beta fixed; nearest-cell interpolation

No per-slice Durrleman butterfly no-arbitrage check (only bounds + a left-wing floor); SABR beta is fixed (A-281), never calibrated; the SABR surface is nearest-cell lookup with no smooth interpolation; calibration failures only warn, never raise; single fixed optimizer start. The DS-057/058 market-smile fetchers are not landed, so the surface has never been validated against a curated historical smile set.

Recommendation: Add a butterfly/calendar arb-free check, smooth SABR-surface interpolation, multi-start calibration, and validate against the DS-057/058 historical smiles once landed.

PRT default params underfund the benefit stream; no premium-solve

Shipped initial_reserve ($300M) is far too small for the shipped benefit stream (10,000 x $2,500/mo = $25M/mo), so the canonical projection exhausts the reserve at month 13 and returns degenerate profitability (PVFP ~ -premium, no breakeven). The engine has no premium-solve: it scores adequacy of a *supplied* premium rather than computing the actuarially fair buyout price.

Recommendation: Ship internally-consistent defaults (reserve = PV of the benefit stream) AND add a premium-solve (PV(benefits)+loading -> price). Add a calibrated-block frozen case.

Prism rating model under_development; D044 cross-check not implemented

RatingModel is functional (fundamentals -> implied score, no agency-rating input, so the D044 'recover-don't-ingest' stance is structurally enforced) but status under_development with no governance ratification and only a unit-test suite. The D044 next step — cross- checking implied vs disclosed agency ratings as validation targets — is not built.

Recommendation: Implement the implied-vs-disclosed cross-check (the disagreement is the signal, per D044), add validation evidence, and ratify before promoting out of under_development.

FinView-resident pricing/CECL engines reached cross-repo with no drift gate

M-040 (CECL) and M-130-137 (asset pricing) are FinView-resident, consumed by InsModel only via sys.path insertion. No packaged interface or drift gate — a finlib signature change silently breaks the InsModel snapshot harness / consumers.

Recommendation: Define a packaged interface (or a versioned contract) for the FinView pricing library and a CI drift gate, so cross-repo consumers fail loudly on signature change. Tie to D041 ownership.

Hardcoded prescribed-ERP (+3%) and linear surrender-charge contradict the engine's 'no hardcoded calibrations' docstring

Recommendation:

Three sensitivity/mechanic tests are weak/partly tautological; numeric weight rests on the gold tests

Recommendation:

A-002 improvement application is wrapped in try/except ImportError → silent no-improvement

Recommendation:

The cession A-NNN (A-230/A-233/A-234/A-235) are bound at the reinsurance_structure consuming_engines level; model_registry M-005 inputs.assumptions lists only [A-001,A-002,A-090,A-091,A-100]. Minor consistency gap — COND-002 is cleared on the documented leg-(b) policy.

Recommendation: Add the cession A-NNN to the M-005 entry, or note in the card that they are bound at the domain level under the leg-(b) policy.

The README's reproduction command hard-codes a stale checkout path (check_registry_integrity.py [redacted]); the canonical checkout is [redacted]

Recommendation: Correct the path. Non-blocking (the no-arg invocation passes).

Two clerical loose ends: (a) model_doc_currency reports M-054 `unstamped` (id=None/cur=None) — not drifted, but not stamped into the currency ledger; (b) engine_registry insmodel.L4.bscr_engine declares outputs [..., technical_provision_adjustment] while the engine ENGINE_CONTRACT emits `technical_provisions` — name mismatch.

Recommendation: Stamp the M-054 card fingerprint; reconcile the engine_registry output name to the engine contract. Non-gating.

Recommendation:

Recommendation:

Registry documentation_pack.change_log = "missing" for M-420 although the card embeds a Change Log section; lifecycle.ratification_ref = null.

Recommendation: On accepting RAT-420-v1.0.0, flip documentation_pack.change_log to reflect the card's Change Log and set ratification_ref: RAT-420-v1.0.0. Metadata only.

tenk2win packs/banking/pack.py reuses literal id strings "A-401".."A-406" (AssumptionSpec a_ids) and "M-401".."M-405" (OutputSpec model_ids). M-401 and M-403 already exist in insightalm engine_registry.yaml as legacy Scheme-B engine governance ids (INV-031 family). No actual binding collision today (M-420's registry component lists are empty), but a future hard collision if any θ/output is promoted to the insightalm A-NNN / M-NNN registries.

Recommendation: Namespace the pack-internal labels (e.g. BANK-A-NN / BANK-M-NN) before any θ or output is promoted to the insightalm registries. Track under INV-031.

model_doc_currency.py cannot watermark M-420 (reports "unstamped, id=None") because the engine is tenk2win-resident with no insightalm @engine binding — the Decision 049 drift detector is structurally blind to this scaffold. Not a drift breach; correct for a scaffold, but the Tier-3 quarterly monitor sweep cannot lean on the doc-currency signal for M-420.

Recommendation: For the Tier-3 monitor sweep, substitute a manual card-vs-pack read + the seam test until a bound insightalm engine exists. Track as the banking analogue of INV-032 (cross-repo engines with no drift gate).

Doc-currency detector is structurally blind to the bankview-resident engine

Recommendation:

Citi (C) not-consumable is handled honestly; record the gap, don't infer a Citi ACL

Recommendation:

Card-vs-code imprecision. M-430.md (Validation Evidence), the registry description, and the firm-adapter docstring all cite "D/SO have no utility_plant_net series" as the proxy-rate-base example, but the live coverage_report shows SO SOURCES its rate base cleanly (scaffold=[]) while NEE uses the invested-capital proxy. The accurate proxy set is D and NEE.

Recommendation: Correct the example list to D/NEE in the card, the registry description, and the pack/firm-adapter docstring so the documented proxy set matches actual behaviour. Documentation accuracy only — no output impact.

tenk2win packs/energy/pack.py reuses literal id strings "A-601".."A-605" (AssumptionSpec a_ids) and "M-601".."M-605" (OutputSpec model_ids). M-601 already exists in insightalm engine_registry.yaml as insmodel.L4.asset_management (INV-031 family). No actual binding collision today (M-430's registry component lists are empty; the card's ID Collision Note already documents the clean M-430..M-432 block and that M-601 is "not reused" for the insightalm id), but a future hard collision if any θ/output is promoted to the insightalm registries.

Recommendation: Namespace the pack-internal labels (e.g. ENRG-A-NN / ENRG-M-NN) before any θ or output is promoted to the insightalm registries. Track under INV-031 (same family as the banking LG-420-02 A-401/M-401 collision).

model_doc_currency.py cannot watermark M-430/M-431/M-432 (reports "unstamped, id=None") because the engine is tenk2win-resident with no insightalm @engine binding — the Decision 049 drift detector is structurally blind to this scaffold. Not a drift breach; correct for a scaffold, but the Tier-3 quarterly monitor sweep cannot lean on the doc-currency signal for M-430.

Recommendation: For the Tier-3 monitor sweep, substitute the real-θ recovery (coverage_report) + a manual card-vs-pack read until a bound insightalm engine exists. Track as the energy analogue of INV-032 / LG-420-03 (cross-repo engines with no drift gate).

FALSE EVIDENCE in the M-005 v1.0.0 pack (a Tier-1 no-fabrication / adequacy failure): README §2/§3 claim "13 passed (9 acceptance + 4 sensitivity/ cross-check regressions)" but tests/test_ag55_engine.py has EXACTLY 9 test functions and pytest returns 9 passed — the 4 regression tests do not exist (the count was bumped in prose only; the InsModel test file was untouched by #3438). The referenced generator Models/scripts/validate_ag55_sensitivity.py (the sensitivity tables' claimed provenance) does NOT exist on disk. The analytical substance (sensitivity + composition cross-check) is real and was independently reproduced; the artifact CLAIMS around it are false.

Recommendation: Correct the README count to 9 (or actually add the 4 sensitivity/cross-check regression tests and re-run — preferred), and commit validate_ag55_sensitivity.py (or drop the "Generated by" provenance). Blocks COND-001(c) clearance.

STALE / OVER-CLAIMING validation README. validation_evidence/M-041/v1.0.0/ README.md (2026-06-08) asserts assumptions A-286..A-289 are bound (A-288 consumed) and a contract funds_withheld_embedded_derivative_v1 is bound — NEITHER exists on disk (highest registered assumption is A-285; no such contract in contract_registry.yaml), and the reconciled card itself now correctly disclaims both (by-design `[]`). The README contradicts the reconciled reality.

Recommendation: Correct the README to match the reconciled card (no bound A-NNN, no registered contract; document the by-design `[]` postures). Blocks COND-004 adequacy.

Tier-1 validation-evidence ADEQUACY gap. The pack now has a conceptual-soundness review + a reproducible deterministic gold snapshot + an honest disclosed-BMA cross-check (Athene Bermuda 2024 FCR: AARe ECR $11,889M; computed $12,832M = 1.08x — same order of magnitude, with the public-structure-vs-binding-tables caveat disclosed). But there is NO sensitivity analysis on the top parameters and NO stated numeric tolerance on the cross-check — both explicit COND-054-01 requirements (grep sensitiv|perturb|stress|tolerance -> 0 hits).

Recommendation: Add a sensitivity table on the dominant per-module factors (reserve, fixed-income, interest-rate/liquidity), the operational factor, and the cost-of-capital/risk-margin rate (response of bscr/ecr/technical_provisions/ ecr_coverage_ratio, explained); and restate the disclosed-BMA cross-check with an explicit tolerance band. (Condition COND-054-01.)

bma_bscr is NOW in the §8.3 enum (line 611) and is a Tier-1 trigger (line 407), but M-054 is still tagged [solvency_ii, internal] and the recorded materiality.tier: 2 is inconsistent with the bma_bscr Tier-1 trigger (the engine_registry already carries tier: tier-1).

Recommendation: Re-tag M-054.regulatory_frameworks to add bma_bscr (demote the solvency_ii interim proxy), and re-derive the materiality tier to Tier-1 under §6.3, reconciling the card header, model_registry, and engine_registry. (COND-054-03.)