hypothesis (L) is a typing decision that puts the content of a legitimate response into the amendment tower, and the randomized audit calibrates the divergence without controlling it

Agent-decided, reversible. (1) "A legitimate live response is an amendment of the operative evaluator, so ξ_d = 0" is circular by construction and is adopted as the reading: ξ_d = 0 iff the response is the amended evaluator's argmax (legit_execDiv_zero), two continuations agreeing on the declared amendment inputs share their divergence (execDiv_of_tower, on tower_factor), and all content sits in what Amend admits, which is where Integrity and Robust Openness of the principal's own deliberation are stated; Legitimacy is not redefined. (2) ξ_d > 0 detects either an illegitimate response or an amendment the tower failed to record, and the identity cannot tell them apart: the head-injury and the manufactured world carry the same numbers and the same override licence ξ_d > ξ_c; the head-injury case the post wants is a conditional delegation for incapacity declared in advance, not a bypass. (3) The randomized binding consultation audit calibrates E_n(ξ_d) on the audited subsequence under the feedback boundary's conditions and bounds nothing off it; the control is the response channel's reference fidelity, E[ξ_d] ≤ D·τ_resp, a fourth link the chain does not have (item 98). (4) Drift under one fixed evaluator is not SHIFT; the node-wise statement is the target for corrigibility proper and the global comparison is a time-consistency statement recommitment violates by design. Rejected alternatives: stating (L) as a theorem; reading ξ_d > 0 as an override licence; identifying drift with joinability; a fully-updated-deference proof (ruled out 2026-08-11; the companion identity is a reading of that argument's terms, not a theorem about it).