Integer donor-support snapping for discrete transfers; stacked-aware release gates

PROGRESS.md

@@ -1,4 +1,193 @@
-# Gate-failed base-pool release lane
+# Weeksgate: stacked release gates and integer-week provenance
+
+## State
+
+Complete on 2026-08-27. Real-pool provenance has refuted the proposed
+post-transfer amount-mapping mechanism: every fractional week is an ACS-origin
+non-native clone prediction outside the calibration's clone-0 recipient scope.
+The source codec, weeks-gate architecture, source-scope, clone-layout, and
+stable-identity repairs are implemented and focused-tested. The complete
+release-call roster is classified; six archived-model input assumptions require
+owner rulings and are deliberately reported instead of guessed. Repository-wide
+Ruff, the CI inventory verifier, and all five full pytest shards pass in their
+required independent processes. The completed provenance, audit, verification,
+judgment calls, and host-owned checkpoint-rerun consequence are in `out.md`.
+No network access, artifact build, publication, push, pool build, or release
+build is in scope.
+
+## Done
+
+- Read `CLAUDE.md` and the GitNexus debugging workflow.
+- Confirmed branch `stacked-release-gate-alignment` is clean at `4f453746`.
+- Confirmed the local GitNexus CLI is installed but the repository is not yet
+  indexed. Its offline analyzer parsed the repository but could not register
+  the index because the sandbox forbids writes to `~/.gitnexus`; the generated
+  local index was moved out of the worktree to `/private/tmp`.
+- Recorded the four requested workstreams: fractional-week provenance and PUF
+  misclassification; integer-support calibration repair; stacked/legacy weeks
+  gate alignment; and the full release-side gate archaeology sweep.
+- Recorded the required verification boundary: repository Ruff plus one pytest
+  process per shard, with no pool/release builds.
+- Read the fixed-format HDF5 blocks directly and classified all 369 noninteger
+  `weeks_unemployed` rows: 360 are ACS clone 1 (355 UC=0, 5 UC>0) and 9 are ACS
+  clone 2 (all UC=0); all are positive, all 369 values are distinct, and the
+  exact range is 1.0003521955067698--37.796501228614694.
+- Confirmed zero nonintegers on ASEC rows and ACS clone 0. The receipted
+  calibration covers exactly the 856,626 ACS clone-0 rows, maps 8,419 carrier
+  amounts onto observed ASEC support with zero donor-support violations, and
+  records QED 0.5882352941176471 to 0.0.
+- Reproduced the 5,218-row false "PUF" classification: the legacy role helper
+  calls every clone index above zero `puf_tax_detail`, regardless of raw source
+  channel. The rows are all ACS-origin clones: 4,733 integer clone-1 rows, 355
+  fractional clone-1 rows, 121 integer clone-2 rows, and 9 fractional clone-2
+  rows with nonzero weeks while UC is nonpositive.
+- Traced the actual fractional mechanism to the ACS transfer target codec:
+  PolicyEngine-US declares `weeks_unemployed` as physical `float`, so the
+  generic QRF path treats it as continuous even though its reviewed source
+  contract is integer-supported. The later calibration repairs clone 0 only.
+- Bound every final fractional value bit-for-bit to the late-transfer target
+  bank. Its raw QRF draw contains 711 nonintegers: 342 ACS clone 0, 360 clone 1,
+  and 9 clone 2. Post-transfer calibration changes 13,417 clone-0 rows and
+  eliminates all 342 clone-0 fractions; the 369 out-of-scope clone fractions
+  pass through unchanged.
+- Added `weeks_unemployed` to the ACS transfer's authority-bound discrete
+  numeric target registry. The existing codec now snaps every prediction to
+  actual observed ASEC donor support, and the execution-contract identity
+  receipts the policy alongside the two mortgage-year targets.
+- Added a focused ACS-transfer regression proving weeks predictions retain
+  observed integer support and the execution contract declares the target.
+- Regenerated the checked-in US imputation authority so
+  `transfer_execution.discrete_numeric_targets` includes `weeks_unemployed`.
+  The generator's compile and byte-staleness checks pass at bundle spec SHA
+  `821d5838da3ac368170e61e017f1a72648f93e8a011aa40e33b8c2b4b14511f3`
+  at that source-fix step; the later runtime/seed identity repin below
+  supersedes this intermediate digest. The spec-bundle and imputation-
+  semantics suites pass.
+- Passed the complete ACS-transfer test file (65 tests), the complete
+  post-transfer calibration receipt-contract file (47 tests), focused Ruff,
+  and `git diff --check` using the prebuilt `.venv` directly. A task-local
+  `UV_CACHE_DIR` later allowed the required `uv run --no-sync` commands to run
+  against that same prebuilt environment without accessing `~/.cache/uv`.
+- Modernized the weeks summary/gate to derive its roster from actual assembled
+  source channels, while retaining the legacy ASEC/PUF role path. The ASEC
+  source-validity scope, direct native-clone reconciliation scope, and reviewed
+  UC-constraint scope are now distinct and explicitly receipted in details.
+- Kept all four plausibility-band tuples and every numeric threshold unchanged;
+  non-ASEC assembled channels use the unchanged legacy recipient band.
+- Added stacked ASEC+ACS and legacy ASEC+PUF fixtures covering roster detection,
+  raw-source scoping, native reconciliation, and UC constraint ownership. The
+  complete weeks file passes (26 passed, 1 skipped) with focused Ruff.
+- Replayed the updated gate over the supplied pool's exact live arrays and
+  weights. It now reports 234,133 valid ASEC source rows, 108,073 exact native
+  reconciliation rows, 982,686 UC-constrained rows, zero source/UC failures,
+  both unchanged channel bands passing, and only the genuine 369 nonintegers.
+- Added a centralized provenance-owner API that distinguishes validated
+  physical source channels from legacy clone-operator roles. The weeks gate
+  now consumes that API rather than reading provenance columns directly, and
+  both repository source-blindness tripwires pass alongside the stacked and
+  legacy provenance/weekly-signal suites.
+- Made WIC's deterministic draw key prefer the assembly-unique
+  `person_source_id` on multispine frames, before the source-local raw identity
+  triple. Distinct ASEC/ACS records can no longer collide when their vintages
+  align, while all support clones of one assembled person retain the same draw
+  and the legacy key order remains unchanged.
+- Completed the release-tool call-roster audit. It found unambiguous physical
+  ASEC scoping repairs in SSI take-up, workers' compensation, alimony,
+  retirement contributions/distributions, and Medicare; clone-2 layout fixes
+  in Head Start, voluntary filing, and prior-year income; and a stable-key fix
+  in WIC. Archived ASEC-only predictor assumptions in SSI disability, SCF
+  wealth, SCF auto loans, and SIPP vehicles require explicit model-owner
+  rulings and will be reported rather than guessed.
+- Reworked the assembled Head Start and voluntary-filing receiver layouts to
+  key by assembly-unique source ID plus explicit clone index, accept clone 2
+  and later, reject duplicate source/clone rows, choose clone 0 (or the lowest
+  surviving clone) deterministically, and fan one source-level decision to all
+  clones. Their legacy role-only duplicate contract remains unchanged.
+- Replaced occurrence-pair clone diagnostics in voluntary filing and
+  prior-year income with all-clone grouping on assembled source IDs, so a
+  clone-2-only divergence is now detected. Focused tests and Ruff passed for
+  all three module/test pairs.
+- Scoped Medicare and retirement release diagnostics to physical ASEC source
+  rows, separating raw-source validity from native direct-carry reconciliation
+  where transferred clones intentionally differ. Kept the producer kernels
+  origin-blind: the authenticated-pool release path skips those producers, and
+  indirect physical-source routing would violate the repository's population-
+  operator boundary. Their 60 focused module/source-blindness tests and Ruff
+  pass after that review correction.
+- Scoped alimony and workers' compensation raw validity to every physical ASEC
+  clone and exact source-carry checks to physical ASEC native rows, leaving all
+  clone-operator plausibility bands unchanged. Stacked ASEC+ACS and legacy
+  ASEC+PUF fixtures pass (28 alimony and 21 workers' compensation tests).
+- Changed SSI reporter-lineage capture to validate `SSI_VAL` only on physical
+  ASEC rows and accept null ACS raw-source cells. Assignment remains source-
+  blind: it consumes the source-ID set captured before L0, or obtains that set
+  through the reporter helper when no explicit set is supplied. The complete
+  SSI take-up file passes (71 tests).
+- Fixed SSI-disability's non-fatal clone-divergence diagnostic to group every
+  assembled clone by source person, so clone-2-only divergence is reported.
+  The existing decision not to make divergence gate-fatal remains unchanged
+  for an owner ruling; the complete focused file and source-blindness checks
+  pass.
+- Narrowed physical-channel resolution to a gate/reporter-only provenance API,
+  removed its general runtime/PUF-support re-exports, and added a static exact-
+  caller contract (including internal mask-helper callers). A future derive,
+  impute, or wrapper use now fails the source-blindness suite instead of
+  passing through indirection.
+- Replayed the repaired release gates read-only against the supplied pool.
+  Alimony, Medicare, retirement contributions/distributions, workers'
+  compensation, and SSI reporter capture pass; the weeks gate now fails only
+  on the genuine 369 fractional values. Prior-year income remains outside its
+  unchanged availability band and WIC finds pregnant nonfemale rows, both
+  genuine data/spec outcomes rather than stacked-layout archaeology.
+- Completed an adversarial review of the repaired code and focused tests with
+  no additional implementation defect found. It confirmed six owner-ruling
+  items: SSI disability criteria, SCF wealth, SCF auto loans, SIPP vehicles,
+  SIPP tips, and ORG wages/FLSA all consume ASEC-only archived predictors on a
+  frame whose 1,736,840 physical ACS rows carry null source cells. ORG is
+  guaranteed to fail its unchanged race/occupation bands; SIPP tips' unchanged
+  tipped-occupation band passes while the ACS channel is dead.
+- Passed repository-wide Ruff and the CI test-group inventory verifier. The
+  calibrate, data, fit, and frame shards pass in four independent pytest
+  processes.
+- Corrected the reviewed WIC seed protocol to match the implemented assembled-
+  multispine key precedence: assembly-unique `person_source_id` first, then the
+  unchanged legacy raw/support/person fallbacks. An exact seed-grammar test now
+  binds that order.
+- Re-pinned the fail-closed spec-engine proof after adding one authored
+  transfer-execution field and one resolved seed-protocol field: 42,122 total
+  fields (32,352 authored and 9,770 resolved), complete exact-pointer claims,
+  and all 41 inventory checks. Regenerated the committed coverage report and
+  validated the final US spec SHA
+  `5f44d96d45e9aabcea2d565ef063d68bfc0652df1b38b08aa31ce6896d15f371`.
+- Verified in a detached `origin/main` worktree, using the same prebuilt venv,
+  that the old BE, UK, and minimal-spec golden vectors still pass there. Their
+  current repins therefore reflect this branch's attested runtime and seed-
+  protocol changes rather than environment drift. All 102 tests in the eight
+  directly affected spec-engine files pass; generated-bundle and coverage-
+  report byte checks, focused Ruff, and `git diff --check` also pass.
+- Ran the full build shard after that coherent spec repin. It reached 100% with
+  exactly one failure and no errors: the multispine constants-adapter fixture
+  still expected the former live US spec SHA. Updated only that live-binding
+  expectation to the regenerated final SHA; the separate arbitrary checkpoint
+  identity fixture remains deliberately unchanged.
+- Passed the complete multispine-pool-tool file after that correction and
+  committed the coherent fixture repin as `12a918ed`.
+- Reran the entire build shard from zero in one process: 6,608 tests collected,
+  100% reached, and pytest exited 0 with expected skips only. All five full
+  package shards, repository-wide Ruff, generated-artifact checks, the spec
+  coverage proof, the CI test inventory, and `git diff --check` are green.
+- Wrote the final provenance tables, mechanism verdict, per-file rationale,
+  exhaustive release-gate audit, owner-ruling list, verification evidence, and
+  judgment calls to `out.md`.
+
+## Next
+
+- Host session: rerun `late_transfer -> simulated -> terminal-gates` from the
+  candidate checkpoints because the discrete weeks codec changes pool content.
+- Review the six archived-model owner rulings in `out.md`; do not reinterpret
+  their missing ACS predictors through a gate-only threshold/scope change.
+
+# Historical: gate-failed base-pool release lane
 
 ## State
 

changelog.d/stacked-release-gate-alignment.fixed.md

@@ -0,0 +1 @@
+Preserve integer support for transferred ``weeks_unemployed`` values and align US release-side source, clone, and deterministic-identity checks with stacked ASEC+ACS pools while retaining legacy ASEC+PUF behavior and every existing plausibility threshold.

docs/evidence/spec-engine/us-f0-coverage.json

@@ -6,7 +6,7 @@
   "country": "us",
   "documentation_sha256": "4b39450dbdb8dafb83c3b627123b8026c6f82c660b66fe76f341a67c4f37c77b",
   "field_usage": {
-    "authored_normative_field_count": 32351,
+    "authored_normative_field_count": 32352,
     "claim_count": 49,
     "claims": [
       {
@@ -220,8 +220,8 @@
         ],
         "mode": "legacy_behavior",
         "pointer_class": "all",
-        "pointer_count": 79,
-        "pointer_sha256": "1575513251c72be60edc75f378221fa878ea76e009512f1352a111586d0a60f8",
+        "pointer_count": 80,
+        "pointer_sha256": "10bd811f86dae7941035533cfe0d51d81cd632f5995c1adb80234bc7ecbf6565",
         "rationale": null,
         "relative_sink_prefix": null,
         "source_prefix": "/authored/spec~1imputation.yaml/transfer_execution",
@@ -736,8 +736,8 @@
         "legacy_sinks": [],
         "mode": "compiler_semantic",
         "pointer_class": "all",
-        "pointer_count": 823,
-        "pointer_sha256": "c05ebb88538195798e9365f325381c14d92b74007f846f1fef50a08268e6d27d",
+        "pointer_count": 824,
+        "pointer_sha256": "7537385c3fd399a2dbb7dcd8ed7cf1ff2481ed336db621eafcbfd741d5792f40",
         "rationale": null,
         "relative_sink_prefix": null,
         "source_prefix": "/resolved/seed_protocol",
@@ -772,21 +772,21 @@
         "verifier": "vintages"
       }
     ],
-    "configuration_field_count": 42120,
-    "consumed_field_count": 42120,
+    "configuration_field_count": 42122,
+    "consumed_field_count": 42122,
     "generation0_effect_counts": {
-      "legacy_behavior": 38443,
-      "no_generation0_effect": 3677
+      "legacy_behavior": 38444,
+      "no_generation0_effect": 3678
     },
     "mode_counts": {
-      "compiler_semantic": 27699,
+      "compiler_semantic": 27700,
       "front_end_validation": 348,
       "identity_only": 103,
-      "legacy_behavior": 13970
+      "legacy_behavior": 13971
     },
     "multiple_primary_use_field_count": 0,
-    "pointer_inventory_sha256": "bc4a948ab632191954600da8474c5b011f977a65e24c399d126f3dc4a79f23e5",
-    "resolved_binding_field_count": 9769,
+    "pointer_inventory_sha256": "ae7881c07c6137037f43a5992b3e8fffbbdbd5ddf2e1b70956986cb9df043f71",
+    "resolved_binding_field_count": 9770,
     "unused_field_count": 0
   },
   "inventory_coverage": {
@@ -1361,12 +1361,12 @@
         ],
         "expected": {
           "producer_count": 38,
-          "sha256": "3850554eb804fde5e4f86a34ac1bb8a7a07aafff7e8b48396a3d5fca844798e8"
+          "sha256": "ef491637933945e28645479da70646d9c50366213b6f70477de445ab9e4bb1cf"
         },
         "failures": [],
         "observed": {
           "producer_count": 38,
-          "sha256": "3850554eb804fde5e4f86a34ac1bb8a7a07aafff7e8b48396a3d5fca844798e8"
+          "sha256": "ef491637933945e28645479da70646d9c50366213b6f70477de445ab9e4bb1cf"
         },
         "status": "covered"
       },
@@ -1656,13 +1656,13 @@
           "compiler_ir.node_slices"
         ],
         "expected": {
-          "map_sha256": "36a9d819ef196c312888591936d49c025b0407df9928440cceefabc5458f72af",
-          "protocol_sha256": "15840b380329410a7094f60b0f1dad453457fc785859f0c372f2c8e2d59b0246"
+          "map_sha256": "ee1ad8d5196ca48d70657675237294c2dd925a520900d4d476d256a1b514b283",
+          "protocol_sha256": "c7df307cba6b20cc26f4aeeb1ee5eae246362318cef885cd747c64349e08cc41"
         },
         "failures": [],
         "observed": {
-          "map_sha256": "36a9d819ef196c312888591936d49c025b0407df9928440cceefabc5458f72af",
-          "protocol_sha256": "15840b380329410a7094f60b0f1dad453457fc785859f0c372f2c8e2d59b0246"
+          "map_sha256": "ee1ad8d5196ca48d70657675237294c2dd925a520900d4d476d256a1b514b283",
+          "protocol_sha256": "c7df307cba6b20cc26f4aeeb1ee5eae246362318cef885cd747c64349e08cc41"
         },
         "status": "covered"
       },
@@ -1677,7 +1677,7 @@
           "compiler_ir.seed_stream_map"
         ],
         "expected": {
-          "implementation_sha256": "15840b380329410a7094f60b0f1dad453457fc785859f0c372f2c8e2d59b0246",
+          "implementation_sha256": "c7df307cba6b20cc26f4aeeb1ee5eae246362318cef885cd747c64349e08cc41",
           "protocol": "legacy-v1",
           "streams": [
             "build_model",
@@ -1698,7 +1698,7 @@
         },
         "failures": [],
         "observed": {
-          "implementation_sha256": "15840b380329410a7094f60b0f1dad453457fc785859f0c372f2c8e2d59b0246",
+          "implementation_sha256": "c7df307cba6b20cc26f4aeeb1ee5eae246362318cef885cd747c64349e08cc41",
           "protocol": "legacy-v1",
           "streams": [
             "build_model",
@@ -1736,7 +1736,7 @@
         },
         "failures": [],
         "observed": {
-          "sha256": "99710bf212c3801cfd0434d56d2d1d2e4902a2a958978cdbd91cd9acce81d2fb",
+          "sha256": "a0366cd518f42a240b589af3ef6580aac44ad7ed70969bcc669b365d315146ab",
           "sites": 53
         },
         "status": "covered"
@@ -1887,7 +1887,7 @@
             "alpha",
             "zeta"
           ],
-          "sha256": "a128a85f877fb32def9382b841b8b340f974e8a9148ac029c1f04becdc956c18"
+          "sha256": "1fa30ae9213c19607168df3cf0035478b9c96f815e1541cc97f4e1b8e7246935"
         },
         "failures": [],
         "observed": {
@@ -1911,7 +1911,7 @@
             "alpha",
             "zeta"
           ],
-          "sha256": "a128a85f877fb32def9382b841b8b340f974e8a9148ac029c1f04becdc956c18"
+          "sha256": "1fa30ae9213c19607168df3cf0035478b9c96f815e1541cc97f4e1b8e7246935"
         },
         "status": "covered"
       },
@@ -1975,7 +1975,7 @@
             "take_up_contract",
             "us_qbi_reconciliation_contract"
           ],
-          "sha256": "91c65a9ff36839d575036264c4bf57ffde6457e8fd180a0856f9be712ada371d"
+          "sha256": "001a2bdc700615cd96771fc258abf5f769d67ea41687efd8cc2ad30361619057"
         },
         "status": "covered"
       },
@@ -2599,7 +2599,7 @@
       "country": "us",
       "schema_id": "country_spec",
       "schema_version": 1,
-      "spec_sha256": "5378bb9189aec96f50da22aac71e5bd2c3d919e9795f6ef2147e0bc9c739dd8e"
+      "spec_sha256": "5f44d96d45e9aabcea2d565ef063d68bfc0652df1b38b08aa31ce6896d15f371"
     }
   },
   "report_schema_version": 3,
@@ -2609,7 +2609,7 @@
     "country": "us",
     "schema_id": "country_spec",
     "schema_version": 1,
-    "spec_sha256": "5378bb9189aec96f50da22aac71e5bd2c3d919e9795f6ef2147e0bc9c739dd8e"
+    "spec_sha256": "5f44d96d45e9aabcea2d565ef063d68bfc0652df1b38b08aa31ce6896d15f371"
   },
   "status": "pass"
 }