the lexical protected-authority theorem is the incentive half of corrigibility, with the segment gate, amendment-not-approval, and the item 98 rewrite

Maintainer decision, landed by the legitimacy-internal-external round. (1) wiki/Corrigibility.md §4 is replaced by the protected-authority-theorem round's statement: corrigibility is faithfulness to an allocation of authority, the transform 𝔱 extends 𝔠, her committed evaluation is lexical in the declared violations, and §1's response-authority framing sits under the allocation. The protected-authority round's nondelegation result stays as the non-lexical special case. (2) The gate on future evaluations is segment-level: an evaluation counts iff the segment from the decision through it is legitimate (internal ∧ external), whatever caused a failure; a tainted segment scores a fixed value in (D − ϖ, 0], default 0, with a tie-breaking value just below 0 an allowed variant (both recorded, the choice open); the fallback settles void responses inside legitimate segments and never restores a tainted segment's score. The per-response gate of the theorem round as first stated admitted a routing exploit (Legitimacy.Witness.routing), closed by the segment gate; Result 4 holds for the segment gate (gate_capture_window, handled_gt_bypass). (3) Amendment is not approval: an approved uncorrectable successor through the ordinary gate is a reallocation unless the install is a declared amendment; the corrigibility page's earlier reading of it as authorized is kept in the response-authority sense and qualified. (4) Item 89: the ex-ante typing is the typing of the authority comparison in the signed identity; the lexical theorem does not depend on it. (5) Item 98 is rewritten: the response-channel contract dissolves into transparency with the consultation protocol in scope, authentication under Integrity, the pre-emption and foreclosure violations, the void-response rule and constitutional design; ξ_d measures uncaused divergence. (6) The salami obstruction is per-step only: a cumulative threshold bounds unreported erosion by the threshold (Legitimacy.unreported_lt); the erosion result is updated. (7) The two queued entries of the protected-authority rounds are closed by this decision. Rejected alternatives: keeping T2–T3′ as §4 with the lexical theorem as a note; gating per response; treating the response channel as a fourth contract; exact reporting as the only closure of erosion.