UK rowwise local candidate: rulings, registers, receipts, and the dense release line (#762 PR B)

[juaristi22]

This completes PR B of #762, following the merged joint-solve machinery in #852: the measured UK local calibration doctrine, reviewed registers, census-vintage uprating, licensed-run receipts, and the dense dataset's assembly and validation path.

The retained R16/R17 candidate is release-blocked under the revised contract. Its historical shippable verdict and assembled-directory validation used the earlier policy. No calibration was rerun, historical result changed, or old gate report re-signed for these review fixes.

Build approach and reviewed scope

• Retain the reviewed stretch bound 10, grain_equal, K=15 and 1,500 epochs. Release candidates require one engine block and the rotated holdout.
• Uprate census household and eligible tenure cells with the common national household factor. Receipts now distinguish applied and skipped holds, including missing or incompatible vintage metadata.
• Retain the six binding adjudications (First calibrated rowwise UK local candidate (#495 increment 6) #762/Declare cross-grain target reconciliation for the UK local surface: national wins, sub-national rescales (#495 increment 6 companion) #802), two local support exclusions and 513 signed local deferrals. The five A16 measure exclusions retain their approval windows, expiring 2026-10-03, and track UK spine: savings interest income a third under HMRC SPI and five times under the ONS D.41 row — reconcile the target concept and review FRS interest capture #866–UK spine: JSA claimants 2.8× the DWP caseload — legacy-benefit reporting after the UC migration #869 individually. JSA arithmetic and the City of London ESS explanation are corrected without changing approvals.

Release checks strengthened after review

The four existing quality gates now block release with unchanged numerical limits: 25% target error, the existing hard family-fit rule, max/median weight ratio 100, and ESS fraction 0.01. The 10% family-fit diagnostic remains diagnostic.

Assembly and standalone validation require a complete incumbent-surface evaluation, authenticated against the candidate dataset, run manifest, diagnostics, Ledger and incumbent extraction. The checks rederive accuracy from finite row evidence, including measurable signed-deferred rows, and apply the existing absolute limits. Missing measurements or failed limits prevent release. The evaluation and its supporting manifests enter the artifact/checksum inventory.

The evaluator refuses engine-block counts other than one. Assembly and subsequent validation require measured clean source code and valid exclusion approval windows at the time of validation, closing the later-upload expiry gap. Signed gate reports remain bound to the candidate attempt, and score receipts remain joined to their inputs by hash.

Historical comparison and remaining data gaps

The run receipts preserve both comparisons. R16/R17 achieved 98.8% versus 60.4% within 10% on the selected comparison rows. R18's broader incumbent surface showed 62.7% versus 77.3% locally, exposing council-tax, housing-cost, program and demographic gaps. R17's max/median weight ratio was 400 against the unchanged limit of 100.

Holdout 0.1895 and incumbent fitted loss 0.1815 use different weighting and populations; they cannot be ranked directly. Scoring now carries and validates these separate bases. The review evidence is explicitly a transcription of published aggregates; original R18 row artifacts were unavailable for replay.

The assembly runbook covers microcosm-uk-2024-25-dense, its non-default inspect role and separate human publication step. No data was published.

Validation

At 35161003, rebased onto main at 5ab1b056, the final affected 17-module suite passed 355 tests on Python 3.13.14 and 355 on Python 3.14.6. Independent implementation and rebase verification are clean. Ruff, formatting of changed files, both census checks, reproducible target regeneration, CI inventory and diff checks pass. Hosted checks report separately. No fresh licensed build or calibration was run for these review fixes.

Refs #762, #495, #665, #736, #796, #802, #866, #867, #868, #869. Merge remains subject to María's explicit go-ahead.

[vahid-ahmadi]

Review pass at 9f4efc77 (Claude Code, high effort; worktree checkout, Python and committed registers read against the PR body; 21 suites run on the PR tree (844 passed, 0 failed) and again on a scratch merge onto origin/main (all passed, 0 failed, exit 0); both census --check tools current on both; ruff check and ruff format --check clean on all 34 changed Python files; git merge-tree onto main is conflict-free).

One process blocker, then substance

1. CI cannot run on this PR as filed. .github/workflows/test.yml:5-7 triggers on pull_request: branches: [main], and the PR's base is uk-rowwise-candidate-762, so "no checks reported" is structural, not a flake. The base branch is now identical to #852's merged head, but the merge-base with main is 8be32dc9, so the PR does not contain #852's final b875d4c4 merge-from-main and GitHub's "clean" status is against a stale base. My scratch-merge run stands in for CI here, but the PR should be retargeted to main so GitHub actually runs it before it merges.

Findings

2. Should-fix — the dense contract does not bind the signed gate report to the run it validates. _check_uk_dense_gate_report (contract.py:4278) verifies schema, digests, posture, HMAC, and attestation.release_id == report.release_id, but never compares the report's release_id to the build's attempt id, and _validate_uk_dense_release_dir only checks build_id == release_id. So a stale but validly signed shippable report dropped into a hand-assembled directory passes validate_release_dir. The assembler closes this (tools/assemble_uk_dense_release_dir.py:213-244 hash-joins the report to manifest.outputs.local_gate_report.sha256 and checks report.release_id against the Logbook build_id), but the contract is what a consumer runs against a directory it did not assemble. One equality check in the contract makes the two agree.

3. Should-fix — the A16 register's tracking field names the wrong issues. All five expires_on: 2026-10-03 entries in calibration_measure_exclusions.json carry tracking: microcosm#736; the PR body says they are tracked on #866–#869, and those issues exist with matching titles. tracking is what the expiry refusal, the manifest receipt and reviewed_limitations cite, so the pointer a reader follows in October should be the per-row issue.

4. Should-fix — the assembler does not hash-join the score to the candidate. assemble_uk_dense_release_dir.py:201, 253-254 copy score_vs_incumbent.json and --incumbent-manifest without checking them against the candidate; the scorer already pins --candidate-diagnostics-sha256 and writes an inputs block (score_uk_local_candidate.py:518), so comparing that to measured["diagnostics"] is the missing line. Related: build_manifest["code"]["git_dirty"] = False (:481) is asserted rather than measured, since the candidate manifest records only git_commit.

5. Should-fix — stale K in signed text. local_area_support_exclusions.json cites rows "at the ruled K=4 (17/49 at K=10)"; the band-H deferral rationale in the generator says "At the ruled K=10, 84 of 296"; local_doctrine.py:88-89 says K=10 refused 86 band-H cells. Doctrine is K=15, and 84 versus 86 disagree with each other. These are the sentences a later reader will trust.

6. Nit — the round-trip is not tested exactly. test_uk_rowwise_candidate.py:1186-1195 checks column names, row count and the weight total with pytest.approx after load_uk_rowwise_dataset; a table-equality assertion is what "undoes the export rename" needs.

Questions

• What retires a defer_if_compiles=True deferral? The A13/A14 deferrals live in generator code with no window and no re-measurement hook, and target_reference_authoring.py skips the stale-deferral raise for them by design. At K=15 City of London carries about 1.5× the K=10 rows; did R16's area_support_summary.csv still show both micro-LAs below the floor? If not, the A4 exclusion gate should have fired.
• Lookup fix. incumbent_surface_evaluation.py:307 accepts both target@area@period and target@area, but the test uses only the no-period form, and the tool derives bound via rsplit("@", 1)[0] (:137), which would strip the area if real diagnostics carry no period suffix. Which form do they carry?
• A17 versus cross-grain. National ons.tenure.* controls exist in uk_population_targets.json; if the country leg is bound, reconciliation rescales LA tenure and the A17 factor is moot on the final surface. R16's 87.3 → 99.2 jump suggests it is not bound. One line from you settles it.
• _is_census_vintage_hold hard-codes from in (2021, 2022); intended, but a 2031 hold will silently not uprate.

Verified good

• Doctrine (A): constants at local_doctrine.py:63, 74, 82, 92, pin test updated; _validate_cli_args under --release-candidate refuses the weight rule, epochs ≠ 1500, clones ≠ 15, measure exclusions, skip-holdout, engine blocks > 1 and sample fraction ≠ 1; uniform stays allowed and receipted as {"default": "grain_equal", "effective": "uniform"}.
• A15/A17 uprating (B): the factor is computed from the ons.households_total fact with an exactly-one match (else ValueError), 29,003,000 / 28,060,832 = 1.0335759; applied to the census-household rows at both grains and to ons.tenure.* cells with a 2021/2022 hold only; an absent fact yields applied: False and the release posture raises; receipted under ladder_household_uprating and tenure_cells; the membership recount gives 359 tenure cells per target with 327 + 32 holds = 1,436, matching R16's 1,308 + 128.
• A16 (C): the window is enforced at apply time — outside approved_on..expires_on raises, within seven days warns — and the two land rows are absent; 49 exclusions total.
• Registers (D): 6 adjudications, 2 support exclusions, 19,105 active and 513 signed-deferred (19,618 − 19,105), every deferred cell carrying a reason id; no timestamps in committed registers.
• Signing (E): signer, battery and contract share one byte-identical _canonical_json_bytes; a missing key appends a failure rather than passing; tests cover tampered signature, post-signing edit, dev posture, failing blocking gate and missing key; the dense digests are lockstep-tested against the live manifest.
• Evaluator (F): the regional roll-up reindexes household weight to persons and masks by region and closed age band; council-tax bands by household mask; an unknown region raises.
• PR A residuals (G): test_candidate_multi_block_engine_run_is_never_releasable asserts releasable: False with single_block_engine: False; the golden target_frame is now check_exact=True. Thank you for taking both.
• No gates.json, roster or spec changes in the diff.

Needs the licensed engine or data

That ons.households_total resolves to exactly one fact on the real Ledger; K=15 support for E06000053 and E09000001 and band H; the frame's council_tax_band string form; the real diagnostics name format; R17 = R16 byte identity; every R16–R18 fit number; and the regional fixture's 207 rows against the body's 198.

---

No code-level blocker. Retarget to main so CI runs, then 2 and 3 are the two I would land before merge — the contract binding because it is what a consumer runs, the tracking ids because they are what the October expiry points at. 4 through 6 are tightening. The uprating, the expiry refusal, the single canonical form with tamper tests and the assembler's hash-join are the substance, and they check out.

[juaristi22]

Thanks. Retargeted to main (rebased onto b875d4c) so CI runs; fixes in 5c86c5f.

(2) The contract now binds report.release_id to build_manifest.attempt_id and refuses a build manifest without one.

(3) The five A16 rows track #866–#869 per row.

(4) The assembler hash-joins score.artifacts.candidate_diagnostics.sha256 to the diagnostics bytes and the two incumbent digests to --incumbent-manifest outputs; git_dirty is measured by the driver and recorded as measured or unmeasured, never asserted.

(5) The three sentences now state K=15 with history: Scilly 24 rows / ESS 8.1, City of London 72 / 11.0 on R17; band H unsupported in 76 of 296 authorities at K=15; K=10 refused 86 authority cells, 84 of them band H. Register regenerated from the pinned feed, rationale strings only.

(6) Round-trip is exact, weights compared as the typed vector.

Questions: a defer_if_compiles deferral retires on regeneration once the support exists, and the A4 exclusions still bind at K=15; diagnostics names carry @2025 and both forms are tested; no country-level ons.tenure.* control is bound (declared at local_authority only), so A17 is live on the final surface; _is_census_vintage_hold now takes its years from the ladder's oa_vintage.

[vahid-ahmadi]

Second pass at d5f04a80 (Claude Code, high effort; worktree checkout, the fix commit 5c86c5fd and the two later commits read against the dispositions; the 21 suites from round one: 853 passed, 0 failed, 0 skipped; both census tools current; ruff check clean; the merge from main carries only #849 with an import reconciliation in one test file and no evil-merge content).

All six findings closed as described, with tests that fail on the previous head where a failing test is possible.

2. Verified. The contract reads build_manifest.attempt_id, fails on a missing or empty value, and _check_uk_dense_gate_report fails when report.release_id differs from it (contract.py:4230-4242, :4290-4332); build_manifest.json is a required release file so a missing manifest cannot bypass it. The two new contract tests — a validly signed report from another attempt, and a manifest with the attempt id deleted — both fail on 9f4efc77. The driver signs with state.build_id and the assembler already writes the Logbook build_id as attempt_id, so an R17-style directory still validates.

3. Verified. Savings interest → #866, housing benefit → #867, both plan-2 stocks → #868, JSA → #869, matching the issue titles, pinned in test_uk_measure_simulation.py. One pre-existing slip in a row the fix touched: the JSA reason says "1.8x at initialization" while 199k against 71k is 2.8×, which is what #869's title says.

4. Verified. The assembler requires the score's candidate_diagnostics.sha256 to equal the measured diagnostics digest and the two incumbent digests to equal --incumbent-manifest outputs (assemble_uk_dense_release_dir.py:255-283); git_dirty is taken from the candidate manifest when it is a bool and recorded as unmeasured otherwise (:504-518), with the driver measuring it by git status --porcelain --untracked-files=no and returning None outside a repository. Three new assembler tests, all failing on the old head. One policy observation rather than a finding: the dense contract never inspects git_dirty, so a candidate measured dirty, or unmeasured, still assembles and validates with exit 0 — the new test asserts exactly that. "Never asserted" is satisfied; whether a dirty candidate should ship is a call for María.

5. Verified and internally consistent. The three sentences agree on K=15 with the K=10 history (84 band-H plus the two micro-authorities = 86), and the receipts corroborate the K=10 line. The K=15 figures themselves (Scilly 24 rows / ESS 8.1, City of London 72 / 11.0, 76 of 296) are not in the receipts file, so they rest on R17. The membership regeneration is rationale strings only: 298 leaf changes, 297 of them rationale text and one the disclosed source_fact_feed rename. One wording note: with 72 rows City of London now clears the 50-row floor, so "unreachable by clone count" is true only of the ESS leg.

6. Verified. Per-entity assert_frame_equal on all columns and the household weights compared as the written column with assert_array_equal. check_dtype=False is unnecessary — it passes with dtypes checked — so it could be tightened.

Questions. _is_census_vintage_hold now derives its years from the ladder's oa_vintage; the new test fails on the old head. One residual: a hold from a non-census vintage is skipped silently — tenure_cells counts only uprated cells, and if oa_vintage were missing the year set would be empty while applied could still read true. A count of skipped holds in the receipt would close that. Both bound-name forms are tested. The A17 answer (no country-level tenure control bound) settles that question.

Nit. ruff format --check flags one long assert in test_uk_council_tax_targets.py:97 from 88c45551; CI runs only ruff check, so not blocking.

---

Approving. The two things worth a line from you rather than a change: whether a measured-dirty candidate should be allowed to assemble, and a skipped-hold count in the uprating receipt.

[anth-volk]

I found six release-affecting issues in this revision. I think the first two should be resolved before publication.

1. High — Failed accuracy checks still permit release. Local target accuracy, per-program accuracy, weight concentration, and effective sample size are configured with criticality: diagnostic, meaning their failure is only recorded and does not prevent release (configuration). The release decision excludes those failures (release decision), and a test explicitly accepts a weight ratio above the limit while asserting releasable is True (test). The real run recorded a maximum-to-median weight ratio of 400 and 42 local targets more than 25% wrong, yet was accepted (run record). These limits should prevent release, with tests proving that excessive program totals and concentrated weights are rejected.

2. High — The comparison that exposed the worst results is optional. The release assembler requires score_vs_incumbent.json but not the later evaluation against the current dataset's own target set (assembler inputs, packaged evidence). The required comparison reports 98.8% versus 60.4% on this branch's selected targets, while the omitted evaluation finds only 62.7% of local targets within 10%, versus 77.3% for the current dataset, as well as very large council-tax and program discrepancies (results). The assembler should require and preserve this evaluation, then apply explicit limits to the reported discrepancies. The assembler test currently uses only 30 households and two targets, so it cannot exercise these real-output conditions (test fixture).

3. High — The evaluation tool permits a processing mode already proven to multiply national totals. --engine-blocks accepts any integer and passes it directly into the calculation (argument and use, calculation call). The branch documents that processing 15 groups inflated corporate land value exactly fifteen-fold, from £2.04tn to £30.7tn (evidence). This evaluator should reject every value except 1, and an end-to-end command test should verify the refusal.

4. Medium — The reported held-back score is not comparable to the fitted scores shown beside it. Held-back targets are weighted to give geographic categories equal influence and exclude national targets (calculation). The fitted candidate and current-dataset scores instead give each target row equal influence (scoring). Using the same per-row error cap does not put differently weighted results on one scale, so the direct comparison of 0.1895 with 0.1815 is unsupported. Existing tests verify the cap and fold count but not loss_weight_scale or the target-weighting rule (tests). All displayed scores should be recomputed with one weighting method, or clearly separated and no longer compared directly.

5. Medium — A release produced from uncommitted code is accepted. The specialized UK validator reads the build description but does not call the general validation that requires code.git_dirty to be false; it checks only the build identifier and attempt identifier in this section (validator). The assembler test explicitly accepts both an unknown state and git_dirty: true (test). This can produce data from code that differs from the recorded commit. The specialized validator should require a measured, clean working tree and test both rejection cases.

6. Medium — Time-limited exclusions can expire after assembly without preventing upload. Expiry is checked while preparing the candidate (preparation check), but the assembled release validator only checks the copied coverage data structurally and the upload path only calls that validator (assembled validation, upload path). Several exclusions expire on 2026-10-03, so a release assembled in September could still be uploaded after its approvals expire. Publication should re-check every required expiry date, and tests should cover both expired and missing dates.

I ran all 17 changed test modules relevant to this work; they passed, as did git diff --check. I could not reproduce the full UK calculation because its private input data is not present locally. The real-output evidence above is therefore based on the committed run records; a sanitized machine-readable result should be retained and exercised by the release tests.

[juaristi22]

@vahid-ahmadi @anth-volk Thanks for the reviews. I've addressed Anthony's findings and Vahid's second-pass points, and rebased onto main at 5ab1b056. The current head is 35161003.

For Anthony's six findings:

1. Quality gates now block release. Target fit, family fit, weight concentration and ESS failures are no longer diagnostic-only. All numerical thresholds and the existing family-gate rules are preserved, including the diagnostic within-10% measure. Regression tests exercise actual excessive errors and problematic weights, rather than only substituting a failed gate status.

2. Evaluation on the incumbent's target surface is required. Assembly and standalone directory validation now require authenticated, complete row evidence covering the pinned 637 national and 23,545 local targets, including measurable deferred rows. The evaluation binds the candidate dataset, original manifest, diagnostics, Ledger and incumbent inputs. Validation recomputes the summary and verdict from finite row measurements using the existing absolute limits; missing, mismatched or failing evidence refuses release. National rows compare against the incumbent's target values; local rows also require its realized estimates. No national realized estimates or new relative-to-incumbent tolerance are implied. The retained original inputs and copied release metadata are cross-checked, and the data validator remains independent of the build package and engine.

3. Evaluator block count is enforced. evaluate_uk_incumbent_surface.py rejects every --engine-blocks value except 1 during argument parsing, before reading files or loading the engine. The regression invokes the actual CLI with unavailable input paths.

4. Fitted and holdout losses are explicitly separated. The producer records the actual weighting rule, scale, population and grains, and the scorer validates that basis. The report and runbook withdraw the direct ranking of the historical fitted and holdout losses; their numerical values remain unchanged.

5. Release code provenance must be measured and clean. Both assembly and later directory validation require code.git_dirty to be exactly false; missing, null, malformed and dirty states are rejected. Diagnostic runs remain possible.

6. Exclusions are checked at validation/upload time. Original approval and expiry records are retained and checked against the current date. Copied coverage records must match those originals exactly. Independent verification exposed and then confirmed the repair of an expiry-extension bypass: editing a copied date and refreshing packaging checksums can no longer hide an expired original approval. Deletion is covered too. Upload invokes the directory validator before sending bytes; separate indefinite support/binding adjudications remain unchanged.

For Vahid's second pass, I've corrected the JSA ratio to 2.8×, clarified that City of London's 72 rows meet the row floor while ESS 11 remains below 50, enabled exact dtype checks in the roundtrip test, and formatted the council-tax assertion. Tenure-uprating receipts now distinguish attempted, eligible, applied and skipped holds with vintage/reason metadata, including missing and non-census cases; preflight checks the actual tenure holds. The dirty-code question is addressed above. These rationale edits preserve the approval fields.

The rebase preserves main's 314 newly activated PIPR rows and all 513 signed deferrals, giving 19,419 active references. Regeneration from the authenticated updated Chronicle feed is reproducible, and both census checks pass.

Final validation on the rebased code: 355 tests passed on Python 3.13.14 and 355 on Python 3.14.6 across the affected 17 modules. Independent implementation and rebase verification are clean; Ruff, changed-file formatting, CI inventory and diff checks pass. Hosted CI is still running, with no completed failures at posting time.

The runbook, historical receipts and PR description now state the release limitation explicitly. No licensed build or calibration was rerun, no approval was renewed, and no historical verdict was re-signed. The additional review evidence is labelled as a transcription of published aggregates, not an original R18 replay. The existing dense candidate remains blocked from release.