Local-area publish refused: the donor must be a published release, so fold the reported-receipt columns into the national build #978

What happened

A publish of the full-scale local ACS hours rebuild (record: #974; artifact populace-us-2024-buildo-acs-local-cadaf4180-20260922T074911Z, sha256 b65c30ec…) was attempted on 2026-09-22 with the packaged manifest's own recipe (tools/publish_release.sh <release_dir> --no-latest --artifact-root <run> --repo-id policyengine/populace-us) and was refused by the release contract before any remote mutation:

us_source_coverage.json is missing the local-area provenance key 'donor_release' (or it is null).

The staging tool pins donor_release only when staged with --donor-release-manifest, and that path verifies the donor H5's digest against a published release manifest's microdata artifact (tools/_legacy/build_us_acs_multispine_base.py::_donor_release_identity). This build's donor was the receipt-qualified child of the national default produced by #972 (populace_us_2024_receipt_qualified.h5, sha256 00946972…, parent 6496cc43… = populace-us-2024-spm-20260909 / -20260915). A qualified child has no published manifest, so no local-area release built on it can satisfy the contract. Nothing reached the Hub.

The contract is right: a local-area release should name a published donor. The gap is that the national default does not carry the three reported-receipt inputs the ACS transfer needs (receives_wic, receives_snap, receives_tanf), which is why #972 exists (microcosm#591).

Options

1. Fold the reported-receipt columns into the national build so the next national default carries them natively and the local chain stages from a published donor with --donor-release-manifest. Root-cause fix; also the release PolicyBench v2 would draw from.
2. Publish the qualified donor as its own release (a derivative of the national default with three added columns and its receipt), then re-stage the local build against its manifest. Faster; puts a derivative national file on the Hub.
3. Extend the contract to accept a qualified donor by parent release plus qualification receipt. Weakens the provenance the contract exists to enforce; not recommended.

Either of 1 or 2 means the local chain reruns from staging (about five hours on this machine at totals-mode targets; the guarded full-SOI selection in #969 adds a dense matrix of roughly 26 GiB and probably belongs on Modal).

Related

• acs-local: weekly_hours_worked_before_lsr defaults to 40, silently nulling SNAP ABAWD analysis #765 (hours), Recover ACS usual hours and validate local release inputs #923, Gate the ACS local-area finalize on the usual-weekly-hours surface (#765) #941 (fixed by the rebuild), Qualify a pinned Build P lineage donor with the reported-receipt inputs the ACS staging gate requires #972 (qualification tool), Refuse to package a capped ACS local-area staging run #973 (package guard), Record the full-scale local ACS hours rebuild of 2026-09-22 (#765 build evidence) #974 (record), Re-pin the US Chronicle feed to a labelled export rebuilt from targeted package runs #955 / Accept a restated Ledger filter bound only where it agrees with the compiled constraint #969 (feed and target contract), Epic: publish the US default from the graph-native build #956 (epic).