CG tail transfer: field-local donor quarantine + mass-conserving own-tail stratum + E01000 receipt (#567)

[MaxGhenis]

Phase 2 of the #567 charter, implementing the design adjudicated from the phase-1 diagnostic (receipts on #567): the dense netCG gap is a provable infeasibility — the QRF transfer truncates the donor CG tail at the ASEC topcode (frame max $1,999,998 vs donor max $22.1B), leaving design-weight CG × the hard 5× cap = $1.206T < the $1.271T target.

Four commits, in review order:

1. Quarantine PUF mortgage outliers by field — the $10M mortgage screen becomes field-local instead of whole-row; recovers up to $98.2B of donor CG that was collateral attrition; per-field provenance accounting in the donor summary.
2. Transfer the PUF capital-gains tail by weight split — the primary remedy: a deterministic, mass-conserving own-tail stratum through the existing clone seam (weight-splitting, never population-adding), consuming synthetic_tail_support_eligible (parsed since the disaggregation landed; first production consumer). Joint donor vectors — signed ST/LT together with linked Schedule-D quantities and lineage — never independently scaled legs (base-m collapses partnership_self_employment_net_earnings to signed near-cancellation (+47.7B/−48.1B legs) #432). Stage manifest with donor ids, boundary, masses, sha.
3. Receipt PUF E01000 capital-gains divergence — audit artifact reconciling source E01000 vs the P22250+P23250 carrier concept across aggregate/synthetic/screen/donor/frame stages (5.1% raw divergence documented; no carrier change).
4. Persist failed-release household weights — failed releases now write the final weight vector into the evidence dir (closes the completeness gap the diagnostic hit).

Verification: full packages/populace-build/tests/ shard green (verified independently by the dispatching session after rebase onto current main — the lane's stale-main mirror commit dropped cleanly as byte-identical to #565). +4,460/−88 across 26 files including two new test files (588-line tail-transfer suite, 339-line reconciliation suite).

Anti-charter honored: no loss shaping, no multipliers, no gate/envelope changes, no ratio changes, no re-disaggregation.

Exit criterion (build-level, next after merge): base-P3 rebuild → dense attempt where the 5× row ceiling exceeds the target with headroom and netCG passes the existing 0.25 gate on truthful inputs.

Fixes the netCG half of the dense-P3 publication path (#566 take-up design is the companion).

🤖 Generated with Claude Code

[MaxGhenis]

Round 2 pushed for both blockers: (1) the evidence writer now persists the ordered household ids beside the weight vector (second npy) with an ordering hash, and binds the pair to the run's target-frame identity — record-level reattachment is possible from the evidence alone; (2) the write moved inside the terminal_gate_failures branch — the no-H5 failure class it exists for — with green-run absence enforced structurally via the #443 AST-guard pattern (sole main() call site must sit in that branch; late gates raise after the H5 write, so their failures retain weights in the dataset). The test-quality finding on the SSI clone-2 test is folded too: it now mints a real weight-split clone (new household, weight subtracted from the source, total mass asserted conserved, PUF-channel row) rather than relabeling a full-weight row. Your High (#462 concentration not bounded by construction on the two flagged columns) stands as the stated build-time acceptance: the rebuilt frame's tail gate is the arbiter, and the register-or-redesign fork is pre-declared on #567. Full shard rerunning; targeted files green.

[MaxGhenis]

Round 3 pushed: (1) blocker — the green continuation now unlinks all three evidence files immediately after the batched gates pass and before the certified dataset write, so a green retry reusing --out/--release-id can never carry a superseded attempt's weights next to a certified H5; (2) the e2e identity assertion rebuilds the expected identity from the captured materializer context (the existing cache_context pattern) and asserts full equality — truncated identities now fail; (3) AST guard v2 enforces if-body placement (else-branch would run on green), evidence-before-raise ordering, and stale-cleanup-before-write_dataset on the green path. Builder test file green locally; full shard rerunning.

[MaxGhenis]

Round 4: the certified-first sequence is closed by refusal per your prescription — _refuse_certified_release_dir_reuse raises at setup when the release dir already carries release_manifest.json (certified ids are immutable; launchers mint timestamped ids, deliberate reruns remove the dir), with a direct unit test. The failed→green cleanup stands as adjudicated. Guard v3 binds the cleanup to a For whose iterable names all three filename constants with an unlink in its body — decoy unlinks and dropped tuple entries now fail. Builder file green locally; full shard rerunning.

[MaxGhenis]

Round 5: refusal now precedes every side effect — an early call the moment --release-id is known (before the base download; the auto-id path derives its id from the base digest so its refusal is necessarily later, but still before any output mkdir via the second, unconditional call at release_dir computation, ahead of _resolve_checkpoint_paths/all mkdirs). An AST ordering test pins both placements (2 refusal calls: one before _download_base_h5, one before every mkdir). Guard v4 requires the cleanup iterable to literally be a tuple naming all three filename constants (slices fail) with unlink called on the loop target (in-loop decoys fail). The Low TOCTOU race stands as the accepted residual you marked. Builder file green locally; full shard rerunning.