legitimacy is one time-indexed property of the history, `L_t(h)`: as of `t`, her judgment is legitimately hers (R2)

Maintainer ruling, landed by the phase-2 round. L_t(h) holds iff every state of the record is open and every step of the formation window [r, t] is licensed and transparent under the criteria fixed at r (Headline.LegitAt); the decided period is compromised iff L fails at some time in it, each over its own step, and a retrospective evaluation counts iff L holds at its time over its formation window. Old-to-new map, proved: the landed gate is legitimacy over the span (Headline.counted_iff_legitSpan); on the consultation model EvalLegitOn2 ↔ L at the evaluation over its window, TrajLegitOn ↔ L at every other time over its own step, LegitOn2 ↔ L over the span, Counted2 ↔ ∃ ev, LegitOn2 (the converse the landed file lacked, from the monotone license), and the split is L at two times (Headline.split_iff_legitAt); every row keeps its verdict (rows_keep_verdicts). The landed TrajLegitOn, EvalLegitOn2 stay as the finite-model forms. Two elements stated with the concept: the void rule — an impaired response is not admitted and the fallback she arranged in advance decides — and the content residual — legitimacy concerns how her judgment was formed, not whether what she was told was true. Legitimacy never attaches to a trajectory as a world. Rejected alternatives: two predicates as the primitive (phase 1); a truth condition inside legitimacy. *Amended by the follow-up (2026-09-27, FOLLOWUP.md Part 2):* two corrections. The wording: L_t(h) is a property of the history up to t, about how her judgment was formed and not about outcomes or the state of the world; "a history is not legitimate" and "legitimacy never attaches to a trajectory as a world" are withdrawn. The window: the formation point is canonical, r(t) = the later of the last restoration at or before t (a disclosure, under disclosure-cures) and the opening of the consultation current at t, computed from the history (Headline.FormationData.point), and L_t(h) is Headline.Legitimate, a function of the history and t only; LegitAt with a free r stays as the window form for the map. The score's uses: a decided period is compromised iff L_t fails at some t in it (PeriodCompromised); an evaluation at e counts iff L_e (EvaluationCounts); together they are the landed gate on the decision's segment (split_iff_legitimate), with no condition on restorations inside the segment. On the consultation model r(t) is the round's opening (formation2_point), the landed formation-segment predicate from it is L_e and the landed trajectory predicate is "not compromised" (legitimate2_iff_evalLegitOn2, trajLegitOn_iff_not_compromised, split_iff_legitimate2), every row keeping its verdict (rows_keep_verdicts_canonical). Where a consultation spans a decision boundary the adjustment is r_d(t) = max(r(t), d), formation data the general theorem accepts; no second predicate. Semantics unchanged.