Build the national + local-area pair on policyengine-uk 2.151.0, and drop UK model-figure withholding

.github/workflows/test.yml

@@ -60,8 +60,9 @@ jobs:
 
   engine-free:
     runs-on: ubuntu-latest
-    # Successful legs took 26-48 min on 2026-10-07..08 (n=22).
-    timeout-minutes: 75
+    # Successful legs took 64-74 min on 2026-10-26, and a Python 3.14 leg on
+    # microcosm#1404 hit the old 75-minute cap; 120 is about 1.6x the slowest.
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:

changelog.d/1301-uk-dense-signoff-2026-10-26.changed.md

@@ -0,0 +1 @@
+Sign dense build 1's gate-only failures for the local line (microcosm#1301, attempt uk-local-candidate-f100-s42-20261026T091056Z-824870f6): 1 national target-fit row, 6 local target-fit cells and 0 areas below the support floor, approved 2026-10-26; 24 entries that build 2 would fail are retired. Every signed row stays bound in the solve, each entry suppresses only the local line's release fence, and a build in which a signed row passes fails its entry as stale.

changelog.d/uk-childcare-take-up-refit-2151.changed.md

@@ -0,0 +1 @@
+The UK childcare take-up rates are refitted with the tool-version-7 fitter on policyengine-uk 2.151.0, on the release-candidate spine built after microcosm#1383 (feed abf0921): Tax-Free Childcare 0.9134 (was 0.9697), working-parent hours 0.8217 (0.8262), targeted hours for 2-year-olds 0.8687 (0.6551) and under-2 usage at DfE age 0 0.7000 (0.6962). Age-1 usage stays at its upper bound of 1 and the conditional universal rate at its lower bound of 0, each with its reason restated on the new fit. The targeted rate rises because policyengine-uk 2.148.1 reads Universal Credit earnings before the work allowance, so fewer families qualify for the targeted two-year-old offer against the same DfE count. The DfE rows for working-parent children aged 2 to 4 and at 9 to 11 months and for early learning at 2 meet their targets; the age-1 row keeps its shortfall at the bound, and the two HMRC Tax-Free Childcare rows still cannot both be met. Each rate's fitting receipt names the input spine, engine and contract digests.

changelog.d/uk-dense-signoff-withheld-national-rows.fixed.md

@@ -0,0 +1 @@
+The dense sign-off drafter reads withheld national rows. Since María's rule of 2026-10-21 a thin national or regional row is withheld as a local cell is, so `targets.csv` leaves its figures blank; the drafter refused any such row, and it checked the national fit gate's withheld count against national rows alone, where the gate counts the surface's whole withheld set. It now carries the withheld national rows beside the local ones, signs none of them, matches the national gate's count, and compares them between the two builds.

changelog.d/uk-drop-model-figure-withholding.changed.md

@@ -0,0 +1 @@
+UK builds no longer withhold model figures (María's ruling of 2026-10-26: the releases go only to the licensed private repository, and their users need the full diagnostics). A target row resting on fewer than ten source households, and a row that would give one back by difference, keep their estimates and errors in the calibration diagnostics, `targets.csv`, the gate reports and the run's evidence summaries; the fit gates judge every row; totals, losses and the size receipt are the solve's own; staged epochs carry their loss; and BRMA rows no longer carry a carrier verdict. This removes the differencing check, which ran for hours on the dense surface, and `--withhold-thin-rows-only`. Release certification refuses a run built while rows were withheld, and the release contract still checks the withheld rows of earlier releases.

changelog.d/uk-orrery-publication-opt-in.changed.md

@@ -0,0 +1 @@
+UK builds no longer submit their saved graph to the public Orrery unless `--publish-orrery` asks for it (María's ruling of 2026-10-26). Before, a build that staged to Hugging Face published by default and `--no-publish-orrery` turned it off; that flag now states the default, and staging to the private repositories is unchanged.

changelog.d/uk-orrery-summaries-no-row-figures.changed.md

@@ -0,0 +1 @@
+The UK graph summaries that `--publish-orrery` submits no longer carry a target row's estimates and errors, the size summary's largest change in one row, or the gates' failure lines; a gate summary counts its failure lines instead. The build's private diagnostics and gate reports keep all of them. Since the build no longer withholds the rows resting on fewer than ten source households, the summaries could not tell those rows apart. The export now checks the summaries before it preserves anything for publication, and stops with the `unpublishable_summary` error code if one carries either. Without a preserved inventory, neither the build nor the emitter's retry command can submit them.

changelog.d/uk-ship-area-support-figures.changed.md

@@ -0,0 +1 @@
+UK dense releases ship per-area support figures again (María's ruling of 2026-10-26, which drops the withholding of microcosm#1301): the area-support gate states an area's rows, Kish ESS and distinct sources beside the floors it misses, in its failures and its reviewed exclusions, and reports each level's minima; the weakest-area and support-limited rows of the diagnostics carry the figures beside `support_below_floor`; and the candidate manifest's support block states the minima. The release contract, the candidate pre-flight and the sign-off drafter's verify no longer walk the shipped files for these figures. The drafter still walks the entries it drafts, which go into a public pull request.

changelog.d/uk-small-cell-rules-flag-only.changed.md

@@ -0,0 +1,4 @@
+A stage receipt's small-cell rule no longer fails a UK build (María's ruling of 2026-10-26); it flags.
+- The gambling top-up and the annual-income stage refuse only when their fits cannot run: fewer than two donor households on either side of a gambling key, or no household reporting both pay measures. With one to nine, they run, and the receipt prints "<10" as before. A pay-concept ratio measured on one to nine households is held to its plausibility bounds rather than refused; on ten or more, a ratio past them still refuses.
+- A stage gate that reads a figure its receipt prints "<10" now names what it left unchecked in its details, and passes on it. That covers the gambling key withheld nationally, a property purchase kind, a UC family type's caseloads, the annual-income ratios, a region's rewritten rows, the excise residuals and the legacy-closure flags.
+- Counts a gate requires to be zero, and the declared donor-support floors, fail as before.

changelog.d/uk-under-two-usage-signal-bound.changed.md

@@ -0,0 +1 @@
+The take-up signal gate holds the under-2 usage share (`max_free_entitlement_hours_used`, over the children of DfE age 0 or 1 in units that claim the working-parent hours) to ±0.10 of its ages' weighted contract rate, and every other flag to ±0.05 as before (`under_two_usage_maximum_share_deviation` in `uk/gates.json`). DfE's working-parent row at 9 to 11 months binds a thin cell of that draw's children: on the spine's own weights the draw meets its rates, but the calibrated weights move the share further from them than they move any other flag's, and the first national on policyengine-uk 2.151.0 failed release-cut certification on that share alone. The gate report records each flag's bound. The battery and release-cut gate digests are re-pinned; the spine, calibration-seam and dense local-gate digests do not move.

docs/gate-battery-contract.md

@@ -128,7 +128,7 @@ Canonical artifact keys:
 | `parity_evidence` | the UK national build | `export_surface`, `target_surface`, `target_fit` |
 | `input_mass_reference` | the UK national build, when the licensed sidecar is supplied | `input_mass_parity` (UK override) |
 | `reviewed_input_mass_exclusions` (optional override) | the UK national build | `input_mass_parity` (UK override) |
-| `uk_area_support_summary`, `exclusions_evaluated_on` | the UK local rowwise build | `area_support` (UK binding; reviewed exclusions name the floors the area misses, never its figures, and stale entries fail; they are gate-only and defer none of the area's cells, microcosm#1301) |
+| `uk_area_support_summary`, `exclusions_evaluated_on` | the UK local rowwise build | `area_support` (UK binding; reviewed exclusions state the area's figures beside the floors it misses, and stale entries fail; they are gate-only and defer none of the area's cells, microcosm#1301) |
 | `local_target_diagnostics`, `exclusions_evaluated_on` | the UK local rowwise build | `per_family_fit` (the diagnostics only); `target_fit` on `surface: local_candidate` (UK binding; the local cells stand on `local_target_fit_reviewed_exclusions.json`, keyed `family/area_code/metric`, which lifts the fence only and is evaluated on the build's review date, microcosm#1301) |
 | `cgt_projection` | the UK calibration seam: read from the installed engine's growth path and exempt amounts, or stated from the manifest pins when no engine is installed (the receipt's `projection_engine` names the source, and the release certifier refuses a seam part whose fence read the pins) | `cgt_projection_entrants` (UK binding; the count is a cumulative stock by year, the bound is the vendored HMRC thin-band taxpayer count as a plausibility ceiling, and the growth path and exempt amount are pinned in the manifest and drift-checked, microcosm#970) |
 

docs/orrery-publication.md

@@ -2,9 +2,10 @@
 
 UK full, dense, size and national builds export `graph.orrery.json` from the
 saved graph schema and recorded execution evidence. They preserve the explicit
-public-safe file inventory in the attempt directory, attempt publication before
-Hugging Face artifact staging, and register graph/evidence files and an
-`orrery.publication.json` receipt snapshot in the artifact manifest.
+allowlisted file inventory in the attempt directory, attempt publication before
+Hugging Face artifact staging when `--publish-orrery` asks for it, and register
+graph/evidence files and an `orrery.publication.json` receipt snapshot in the
+artifact manifest.
 
 When execution was recorded, they also write the execution overlay that
 `graph.orrery.json` embeds as `graph.execution.json` and register it in the
@@ -55,10 +56,28 @@ publication API. Producer tests do not contact either hosted service.
 No new Microcosm runtime variable or secret is required. Tests isolate ambient
 credentials and caches and use fake HTTP or explicit loopback services.
 
-`--staging-local-only`, `--no-staging` and `--no-staged-dataset` export locally
-without remote submission. `--publish-orrery` explicitly enables submission;
-`--no-publish-orrery` disables it independently. A publication failure does not
-replace the dataset's validation result or prevent HF artifact staging.
+A build exports locally without remote submission unless `--publish-orrery`
+enables it (María's ruling of 2026-10-26), whatever its staging:
+`--no-publish-orrery` states the default, and `--publish-orrery` submits even
+when dataset staging is local-only. A publication failure does not replace
+the dataset's validation result or prevent HF artifact staging.
+
+Since the same ruling the build no longer withholds the figures of target rows
+resting on fewer than ten source households, or the per-area support figures
+in the gates' failure lines, so the summaries never carry them:
+
+- a calibration summary keeps each target row's target, tolerance and source,
+  but no row's estimates or errors, and the size summary keeps the losses but
+  not the largest change in one row;
+- a gate summary keeps each gate's verdict and its count of failure lines, but
+  not the lines.
+
+The build's private diagnostics and gate reports keep all of them. Before it
+preserves anything for publication, the export checks the summaries and stops,
+with the `unpublishable_summary` error code, if one carries a row's estimates
+or a failure line. With no `orrery.upload.json` inventory written, neither the
+build nor the retry command below can submit them (Vahid's review of
+microcosm#1396).
 
 Failed builds preserve recorded graph evidence before temporary-file cleanup.
 They publish it, with an `orrery.failure.json` marker, to `orrery-failure/` in

docs/uk-dense-release-assembly-runbook-762.md

@@ -120,6 +120,15 @@ at `<candidate-dir>/.graph-store` unless `--graph-store` says otherwise, and
 `--input-h5` must be a spine whose gate manifest matches the branch's gate
 declarations.
 
+**Every row's figures ship (María's ruling of 2026-10-26).** The build no
+longer withholds the model figures of rows resting on fewer than ten source
+households, nor of the rows that would give them back by difference
+(microcosm#1262, #1383). Every row is judged by the fit gates and carries its
+figures in the diagnostics, the targets table and the gate reports, so a
+release goes only to the licensed private repository. The graph's evidence
+summaries carry them too, which is why a build publishes to the public Orrery
+only on `--publish-orrery`.
+
 ### Sized release (microcosm#1124)
 
 A release candidate may add `--dataset-households 150000` to ship the exact-k
@@ -253,10 +262,11 @@ tool cannot template it checks in three ways, and only these three:
   comment cited as "issue comment <id>", a date far from today (`2045-12-31`)
   and any other number (`K=15`, `150,000 households`, a plan code such as
   `c9`, a bare year), before the build is read.
-- The drafted entries then go through the release contract's disclosure walk,
-  and a finding refuses the draft, though on a release directory the walk only
-  warns. On text, the walk catches only an area's support worded with its
-  measured value, such as `rows 7 < 50`.
+- The drafted entries then go through the contract's disclosure walk, and a
+  finding refuses the draft: the entries go into a public pull request, though
+  a release directory itself ships per-area support figures since María's
+  ruling of 2026-10-26. On text, the walk catches only an area's support
+  worded with its measured value, such as `rows 7 < 50`.
 
 None of these checks catches a figure written in words, so scan the outputs as
 described under "The sign-off PR" below. The degenerate register is never
@@ -399,9 +409,7 @@ Verification fails unless all of these hold:
   local line's input-mass entries included), has not passed.
 
 It warns when build 2 did not reuse build 1's solve, when its per-row errors
-differ, when the disclosure walk a release directory gets finds a per-area
-support figure in the signed local report, and when the assembly deadline is
-two days away or less. The entries
+differ, and when the assembly deadline is two days away or less. The entries
 expire: retire or renew them before `expires_on`, because
 engine-free tests evaluate the committed registers at today's date.
 
@@ -422,15 +430,10 @@ exclusions and their windows, the holdout (recorded as not requested, or, when
 `--rotated-holdout` asked for it, measured with five folds and a finite mean,
 and in agreement with the request), the Logbook row, the artifact digest.
 
-It also runs the release's disclosure walk over the files assembly ships byte
-for byte: the candidate manifest, the original diagnostics, the signed local
-report and, when the run directory holds them, `score_vs_incumbent.json` and
-`incumbent_surface_evaluation.json`. Add `--incumbent-manifest
-<incumbent-dir>/incumbent_local_surface_manifest.json` to walk the extraction
-manifest you will attach too. Each file is read as the contract reads it, so
-one carrying NaN, or nested too deep to walk, is reported as a file the walk
-cannot rule out. A finding prints a `WARN` line naming the file and the paths,
-never a value, and never fails the pre-flight.
+`--incumbent-manifest <incumbent-dir>/incumbent_local_surface_manifest.json`
+checks that the extraction manifest you will attach exists. The pre-flight no
+longer walks the shipped files for per-area support figures: a release ships
+them since María's ruling of 2026-10-26 (microcosm#1301).
 
 ## Optional diagnostics (microcosm#1301)
 
@@ -538,20 +541,11 @@ directory with
 `releases/microcosm-uk-2024-25-dense/`. Re-assembling requires removing the
 previous directory first. The JSON summary prints the publication command.
 
-The validator's disclosure walk warns rather than refuses (microcosm#1301). A
-shipped JSON document carrying an area's rows, ESS or distinct sources, or a
-minimum, maximum or median of one, prints a `warning:` line naming the file and
-the first paths to the figures, never their values, and the summary lists it
-under `warnings`; so does a shipped JSON document the walk cannot read. Weigh
-each warning before publishing. A figure in the signed `uk_local_gates.json`
-cannot be edited out without failing its signature, nor one in
-`source_calibration_diagnostics.json` without failing the candidate manifest's
-hash of it; a figure in a file the assembler writes is fixed at its source and
-the directory re-assembled. The pre-flight's `--candidate-dir` runs the same
-walk over the files the assembler ships byte for byte (step 3), so a finding
-shows right after each build. The walk reads key names and the shortfall
-wording only: a figure under another name, in other prose or outside the
-top-level JSON files is not found, so the manual scan stays.
+A release directory ships per-area support figures (rows, Kish ESS and
+distinct sources, and their minima) in the signed `uk_local_gates.json`, the
+diagnostics and the candidate manifest: María's ruling of 2026-10-26 dropped
+their withholding and the validator's disclosure walk with it (microcosm#1301).
+The release goes only to the licensed private repository.
 
 The manifest's `reviewed_limitations` record what the release does not claim,
 and the contract checks them against the coverage: `engine_measurement`
@@ -605,12 +599,12 @@ uv run python -m microcosm.data.publish_cli releases/microcosm-uk-2024-25-dense
 revision without a main-branch commit. The artifact is reachable by its tag and
 by the registry key `("uk", 2025, "dense")` only.
 
-The disclosure walk's warnings reach the publisher's JSON output as well as
-stderr: `--preflight-only` adds them to its verdict under `contract_warnings`,
-and publication lists them the same way beside the pointer it prints. Neither
-refuses on them. The immutable tag's message records that the release was
-published past them and how many there were, never what they say, since they
-name paths in the shipped files.
+A contract warning reaches the publisher's JSON output as well as stderr:
+`--preflight-only` adds it to its verdict under `contract_warnings`, and
+publication lists it the same way beside the pointer it prints. Neither
+refuses on one. The immutable tag's message records that the release was
+published past them and how many there were, never what they say. No dense
+release raises any since the disclosure walk was dropped.
 
 ## Promotion is a separate change