Fix stacked gap-fill producer ordering and housing direction provenance (#578 smoke rounds 1-3)

[MaxGhenis]

The first two production 1% smoke builds of the stacked spine (#624 ladder, post-#631) failed closed at the gap-fill activation authority. This PR carries the fixes from three verification rounds, each driven by a real build's receipts. The authority checks themselves are untouched in strictness — every fix is to plan declarations, ordering, or provenance, never to the gates.

Round 1 — early surface ran before its producers (smoke: 584s failure)

~40 declared asec_survey_to_acs targets were absent at the early check: they are operator- or PUF-produced, not survey-carried. Fix (1a372e16→1a827706): split the 118-target surface into an early cross-origin surface (48) and a new declared post-PUF transfer stage (70) that runs after PUF materialization and source completion, with its own activation authority, byte-compared producer snapshots, and a zero-residual-nulls outcome gate.

Adversarial verification of round 1 (two criticals, fixed)

• Producer failures could be laundered as recipient nulls — a nulled ASEC clone-0 is_pregnant was QRF-filled instead of failing closed. Target-specific producer masks, producer-null checks, cross-grain clone validation, and immutable snapshots now prevent it (e0112838).
• A NON-CANONICAL test-seam receipt could reach simulation_ready; production now validates the exact canonical receipt at cold execution, checkpoint emission/resume, manifest construction, and publication (8533131c).

Round 2 — housing direction had donor and recipient inverted (smoke: 1700s, first direction passed and banked)

acs_housing_to_asec declared ACS the rent donor; the assembled checkpoint showed pre_subsidy_rent null for exactly the 34,293 ACS-origin persons. The operator-ordering doc is explicit that ACS RNTP/GRNTP are predictors and pre_subsidy_rent is produced by with_us_housing_inputs on the ASEC-evidenced projection. Fix (99f71c1a+): the direction is now asec_housing_to_acs; the 1,895 native ACS group-quarters people carry exact structural-absence authority and are never synthesized to zero (037bbcd1).

The permanent guard

A channel-aware producer schedule now requires, for every declared target: exactly one known producer, known execution scope, correct donor channel, and a producer stage strictly preceding that direction's activation check — and the schedule is bound into checkpoint identity (2cdebe97). A direction-by-direction audit of all 118 targets under this schedule found no further latent ordering failure. Stacked authority and checkpoint materializer versions are now 5; v≤4 checkpoints and banks are structurally non-resumable.

Evidence

• Full workspace battery: 5,503 passed, 58 skipped, 0 failed; One-pool multispine builder: assemble-first build path with the agreement gate terminal (#578 increment 2) #583 guard exactly 495.
• Smoke round 3 (1% rung, authority v5) is running against this exact HEAD; its Logbook row and terminal receipts will be posted here. Merge gate = green CI + that build clearing both gap-fill directions.
• Rounds' Logbook rows: round 1 refused as second genesis (operator error, guard held); round 2 chained on f3cffe94… awaiting archive append.

Fixes the smoke-blocking failures under #578 / #624.

🤖 Generated with Claude Code