MaxGhenis · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/changelog.d/us-puf-recipient-share-bound.fixed.md b/changelog.d/us-puf-recipient-share-bound.fixed.md
@@ -0,0 +1 @@
+A single PUF-channel QRF draw can no longer carry more mass than the population slice its recipient stands for. The #982 income-rank predictor sends the top-ranked survey tax units, each standing for several hundred units, onto the PUF's top-ranked returns, which stand for one return or less: the synthetic Forbes-tail records weigh about 0.13 each. One such draw put $141B of line-32 mass on a single weight-644 unit in the #1251 rebuild. As an interim censor, until a tail stratum carries those donors at their own weights (#958, #964), QRF finalization now caps each raw amount draw at the positive mass, per unit of slice weight, of the donor's top slice of the recipient's own weight share, and floors losses from the bottom slice, on every amount output (booleans and origination years excepted). The cap limits a record to the mass of its slice; it does not remove concentration the slice itself has. The rule is bound into the primary PUF execution config, which moves to schema 6, and stacked pools recorded at schema 5 are no longer loadable. Every bounded output writes a tail-bound diagnostics record.
diff --git a/docs/evidence/spec-engine/us-f0-coverage.json b/docs/evidence/spec-engine/us-f0-coverage.json
@@ -6,7 +6,7 @@
   "country": "us",
   "documentation_sha256": "0931cbd3aae2abcd8c072b78eba40c1c006b1bf7fa23c6a6681f9a895e47070e",
   "field_usage": {
-    "authored_normative_field_count": 32404,
+    "authored_normative_field_count": 32414,
     "claim_count": 49,
     "claims": [
       {
@@ -274,8 +274,8 @@
         ],
         "mode": "compiler_semantic",
         "pointer_class": "all",
-        "pointer_count": 24488,
-        "pointer_sha256": "6382a3ed07016414c31462b8bedb24590d92b792405a89c927d85fa1bd2a8347",
+        "pointer_count": 24498,
+        "pointer_sha256": "92968ea779967b45e7ea5b60722a253239947806de05bf46437cf386b2ae6d23",
         "rationale": null,
         "relative_sink_prefix": null,
         "source_prefix": "/authored/spec~1imputation.yaml/producer_graph",
@@ -772,20 +772,20 @@
         "verifier": "vintages"
       }
     ],
-    "configuration_field_count": 42184,
-    "consumed_field_count": 42184,
+    "configuration_field_count": 42194,
+    "consumed_field_count": 42194,
     "generation0_effect_counts": {
-      "legacy_behavior": 38498,
+      "legacy_behavior": 38508,
       "no_generation0_effect": 3686
     },
     "mode_counts": {
-      "compiler_semantic": 27717,
+      "compiler_semantic": 27727,
       "front_end_validation": 354,
       "identity_only": 103,
       "legacy_behavior": 14010
     },
     "multiple_primary_use_field_count": 0,
-    "pointer_inventory_sha256": "8f655670b9794adae905ede64bdceba6395eeb8d642b6c5896d5c516f1f6a6a7",
+    "pointer_inventory_sha256": "4523cb2c2ccca11f484b6fdd1efb860652b1fb1622a4e39675ba652b9136f4f6",
     "resolved_binding_field_count": 9780,
     "unused_field_count": 0
   },
@@ -1338,12 +1338,12 @@
         ],
         "expected": {
           "nodes": 38,
-          "sha256": "40cd51ffdfe2e9d9d08d48c08e8ded9de1e4b134783bab05c4abc6ad5c72ca1e"
+          "sha256": "4e0b91fe9010f9cbb54648c024fce2808b1cd4b283005bf9e04d626f4281f878"
         },
         "failures": [],
         "observed": {
           "nodes": 38,
-          "sha256": "40cd51ffdfe2e9d9d08d48c08e8ded9de1e4b134783bab05c4abc6ad5c72ca1e"
+          "sha256": "4e0b91fe9010f9cbb54648c024fce2808b1cd4b283005bf9e04d626f4281f878"
         },
         "status": "covered"
       },
@@ -1361,12 +1361,12 @@
         ],
         "expected": {
           "producer_count": 38,
-          "sha256": "cc34ba11288d01145fc2dc1a669df3f7c4ef2019d73afb02dd8eeee852b16d20"
+          "sha256": "7bc8373a649e36eacfa8e1f0fe5e57179979913c0ad2ebba2c4b29e4bd81684a"
         },
         "failures": [],
         "observed": {
           "producer_count": 38,
-          "sha256": "cc34ba11288d01145fc2dc1a669df3f7c4ef2019d73afb02dd8eeee852b16d20"
+          "sha256": "7bc8373a649e36eacfa8e1f0fe5e57179979913c0ad2ebba2c4b29e4bd81684a"
         },
         "status": "covered"
       },
@@ -1656,13 +1656,13 @@
           "compiler_ir.node_slices"
         ],
         "expected": {
-          "map_sha256": "41a64b8820bf161e316c49e3f2b666a247b58f6f6d50dd4395b89c8f5b1399f6",
-          "protocol_sha256": "0e4c8a4ace5e10747065669a009691d0eee9179ca42b344f8912c5ca239ebde6"
+          "map_sha256": "1cf6f86c3c7541bf2f8dd8909a9f42a5b4d2a2cf09bd72c0fe330ff8be12fa3d",
+          "protocol_sha256": "d56ecc1e77ccca082f76a06dafb8e2e83d1467a5883ab74d8e75d4265e3586a9"
         },
         "failures": [],
         "observed": {
-          "map_sha256": "41a64b8820bf161e316c49e3f2b666a247b58f6f6d50dd4395b89c8f5b1399f6",
-          "protocol_sha256": "0e4c8a4ace5e10747065669a009691d0eee9179ca42b344f8912c5ca239ebde6"
+          "map_sha256": "1cf6f86c3c7541bf2f8dd8909a9f42a5b4d2a2cf09bd72c0fe330ff8be12fa3d",
+          "protocol_sha256": "d56ecc1e77ccca082f76a06dafb8e2e83d1467a5883ab74d8e75d4265e3586a9"
         },
         "status": "covered"
       },
@@ -1677,7 +1677,7 @@
           "compiler_ir.seed_stream_map"
         ],
         "expected": {
-          "implementation_sha256": "0e4c8a4ace5e10747065669a009691d0eee9179ca42b344f8912c5ca239ebde6",
+          "implementation_sha256": "d56ecc1e77ccca082f76a06dafb8e2e83d1467a5883ab74d8e75d4265e3586a9",
           "protocol": "legacy-v1",
           "streams": [
             "build_model",
@@ -1698,7 +1698,7 @@
         },
         "failures": [],
         "observed": {
-          "implementation_sha256": "0e4c8a4ace5e10747065669a009691d0eee9179ca42b344f8912c5ca239ebde6",
+          "implementation_sha256": "d56ecc1e77ccca082f76a06dafb8e2e83d1467a5883ab74d8e75d4265e3586a9",
           "protocol": "legacy-v1",
           "streams": [
             "build_model",
@@ -1887,7 +1887,7 @@
             "alpha",
             "zeta"
           ],
-          "sha256": "3db095ce2d1ef89028d3862f0edc827d704f099c5b3323f9b115642a3c27e007"
+          "sha256": "5d06e498c2167a4b008db07bca3f82294f494fe071ab8de874094aaf6c59643f"
         },
         "failures": [],
         "observed": {
@@ -1911,7 +1911,7 @@
             "alpha",
             "zeta"
           ],
-          "sha256": "3db095ce2d1ef89028d3862f0edc827d704f099c5b3323f9b115642a3c27e007"
+          "sha256": "5d06e498c2167a4b008db07bca3f82294f494fe071ab8de874094aaf6c59643f"
         },
         "status": "covered"
       },
@@ -1975,7 +1975,7 @@
             "take_up_contract",
             "us_qbi_reconciliation_contract"
           ],
-          "sha256": "61a5484eab9fae1d6651b3ae15f1793d4934ea2f6ed2c08d05716b745c221014"
+          "sha256": "f02a16ff1365b1797ad34725980ec73155f613f72ce45f7a8cc8fd2a259615d0"
         },
         "status": "covered"
       },
@@ -2599,7 +2599,7 @@
       "country": "us",
       "schema_id": "country_spec",
       "schema_version": 1,
-      "spec_sha256": "3080fe938df62216dc4853c1163639817de3c537e0e932309642fbd3f7d8f266"
+      "spec_sha256": "fb7990d69e72cc1d333e7589e744e43eea7e938e16e99447819b3a4d1a96c4c8"
     }
   },
   "report_schema_version": 3,
@@ -2609,7 +2609,7 @@
     "country": "us",
     "schema_id": "country_spec",
     "schema_version": 1,
-    "spec_sha256": "3080fe938df62216dc4853c1163639817de3c537e0e932309642fbd3f7d8f266"
+    "spec_sha256": "fb7990d69e72cc1d333e7589e744e43eea7e938e16e99447819b3a4d1a96c4c8"
   },
   "status": "pass"
 }
diff --git a/docs/us-multispine-operator-ordering.md b/docs/us-multispine-operator-ordering.md
@@ -252,7 +252,8 @@ by_origin_battery
    QBI reconciliation contracts, the tail schema and support contract, and
    late-producer registry schema version 17, including execution-receipt
    contract 4, transition authority 2, and resource-semantics receipt 2. The
-   primary execution config is version 5, its portable worker identity is
+   primary execution config is version 6 (it binds the recipient-share bound,
+   #1259), its portable worker identity is
    version 1, and its checkpoint input sidecar is version 2. The companion pool
    manifest uses schema version 10.
    Older outer authority or materializer payloads are stale; primary-QRF

diff --git a/packages/microcosm-build/src/microcosm/build/spec_engine/field_usage.py b/packages/microcosm-build/src/microcosm/build/spec_engine/field_usage.py
@@ -26,9 +26,9 @@
 )
 from .schemas import load_schema_registry
 
-EXPECTED_AUTHORED_FIELD_COUNT = 32_404
+EXPECTED_AUTHORED_FIELD_COUNT = 32_414
 EXPECTED_RESOLVED_BINDING_FIELD_COUNT = 9_780
-EXPECTED_CONFIGURATION_FIELD_COUNT = 42_184
+EXPECTED_CONFIGURATION_FIELD_COUNT = 42_194
 
 
 class FieldUsageError(AssertionError):
@@ -421,8 +421,8 @@ def _path_inventory(rows: Sequence[tuple[str, object]]) -> tuple[int, str]:
         "e1dd7dc5123ab0f39d08ea4939d98dd09a6fdb8e7449a7ca3125fb1ddbd5b4e9",
     ),
     "imputation_producer_graph": (
-        24_488,
-        "6382a3ed07016414c31462b8bedb24590d92b792405a89c927d85fa1bd2a8347",
+        24_498,
+        "92968ea779967b45e7ea5b60722a253239947806de05bf46437cf386b2ae6d23",
     ),
     "imputation_transfer_execution": (
         97,

diff --git a/packages/microcosm-build/src/microcosm/build/spec_engine/inventory_coverage.py b/packages/microcosm-build/src/microcosm/build/spec_engine/inventory_coverage.py
@@ -350,20 +350,21 @@
     "acs_person_predictors": "878c788a6f037d7aca12b3586ea034eff04f3034ffa11935a736493042551f25",
     "authority": "9d4a9672a0f03039b1fe874b9fe21ed575be0d29f14afc396d03cdf5c809bdd2",
     "early_families": "4aa9f736fd76e83955477ad1667e58f48f264783f05bdc7f0102cd32d61323bd",
-    "full_checkpoint": "3db095ce2d1ef89028d3862f0edc827d704f099c5b3323f9b115642a3c27e007",
+    "full_checkpoint": "5d06e498c2167a4b008db07bca3f82294f494fe071ab8de874094aaf6c59643f",
     "gap_fill_schedule": "1c31f9868f7884347cc19cf1ff65da43f950b9114941a715bab168246db414a7",
-    "graph_nodes": "40cd51ffdfe2e9d9d08d48c08e8ded9de1e4b134783bab05c4abc6ad5c72ca1e",
+    "graph_nodes": "4e0b91fe9010f9cbb54648c024fce2808b1cd4b283005bf9e04d626f4281f878",
     "geography_assignment": "44e7f5f6cd7ceeef85d532c3d46306d03de4f4ee811376e6d29920742746b65c",
     "late_families": "d91f9ff0eb52f43e7b6eed3d5c58c37abe1620c3a11021da15dae9c10e16d382",
-    "late_resource_semantics": "cc34ba11288d01145fc2dc1a669df3f7c4ef2019d73afb02dd8eeee852b16d20",
+    "late_resource_semantics": "7bc8373a649e36eacfa8e1f0fe5e57179979913c0ad2ebba2c4b29e4bd81684a",
     "late_schedule": "e59c019d3d454eac99ac0ac209b6c5b6faaf9bdfcaeee18c36a25be19bf7da2f",
     "ownership": "5f64f0aac49e2313177564f71876bffc8c81b3ded4df701e70930e60e9c98356",
     "primary_tuples": "fdf23da429f8c501e198a2f5b719763d523a41565c2153fdf17b0344f21bcd7c",
     # #1178: puf_support's source bytes attest CPS Social Security preservation.
     # RNG rules and the ordered QRF targets are unchanged. microcosm#104 moves
-    # both again: the protocol attests microcosm.calibrate.solve.
-    "seed_map": "41a64b8820bf161e316c49e3f2b666a247b58f6f6d50dd4395b89c8f5b1399f6",
-    "seed_protocol": "0e4c8a4ace5e10747065669a009691d0eee9179ca42b344f8912c5ca239ebde6",
+    # both again: the protocol attests microcosm.calibrate.solve. The
+    # recipient-share bound in puf_support moves both again (#1259).
+    "seed_map": "1cf6f86c3c7541bf2f8dd8909a9f42a5b4d2a2cf09bd72c0fe330ff8be12fa3d",
+    "seed_protocol": "d56ecc1e77ccca082f76a06dafb8e2e83d1467a5883ab74d8e75d4265e3586a9",
     "source_manifest": "f4f8bfeb79268a4043a843b47cec1d1c0e58e9f5dd6bc23417ada95446dd7b8e",
     "take_up": "9522ce40f7dea569312dd7a7beb474e5a5afadd2f1e10cb5876534c3ef623d35",
     "tail": "ac92829c88a1a4fb6460d61190918d5d99c6c377fc8dd8f62f02b332d09bf59c",

diff --git a/packages/microcosm-build/src/microcosm/build/spec_engine/schema/imputation.schema.json b/packages/microcosm-build/src/microcosm/build/spec_engine/schema/imputation.schema.json
@@ -3274,6 +3274,53 @@
                   "non_sch_d_capital_gains"
                  ]
                 },
+                "recipient_share_bound": {
+                 "type": "object",
+                 "additionalProperties": false,
+                 "properties": {
+                  "rule": {
+                   "type": "string"
+                  },
+                  "schema_version": {
+                   "type": "integer"
+                  },
+                  "scope": {
+                   "type": "string"
+                  },
+                  "excluded_output_classes": {
+                   "type": "array",
+                   "items": {
+                    "type": "string"
+                   }
+                  },
+                  "recipient_share": {
+                   "type": "string"
+                  },
+                  "cap": {
+                   "type": "string"
+                  },
+                  "floor": {
+                   "type": "string"
+                  },
+                  "snapped_outputs": {
+                   "type": "string"
+                  },
+                  "seam": {
+                   "type": "string"
+                  }
+                 },
+                 "required": [
+                  "rule",
+                  "schema_version",
+                  "scope",
+                  "excluded_output_classes",
+                  "recipient_share",
+                  "cap",
+                  "floor",
+                  "snapped_outputs",
+                  "seam"
+                 ]
+                },
                 "worker_execution": {
                  "x-spec-surface": "execution_profile",
                  "type": "object",
@@ -3347,6 +3394,7 @@
                "required": [
                 "invocation_mode",
                 "tail_bound_quantiles",
+                "recipient_share_bound",
                 "worker_execution"
                ]
               },

diff --git a/packages/microcosm-build/src/microcosm/build/us/spec/imputation.yaml b/packages/microcosm-build/src/microcosm/build/us/spec/imputation.yaml
@@ -4397,14 +4397,26 @@ producer_graph:
       resolution: static_exact
       binding:
         resource_kind: primary_puf_execution_config
-        schema_version: 5
+        schema_version: 6
         qrf:
           invocation_mode:
             predictors: canonical_default
             person_outputs: canonical_default
             tax_unit_outputs: canonical_default
           tail_bound_quantiles:
             non_sch_d_capital_gains: 0.999
+          recipient_share_bound:
+            rule: recipient_share_slice_mass
+            schema_version: 1
+            scope: every_amount_output_of_the_invocation
+            excluded_output_classes:
+            - boolean_person_outputs
+            - discrete_tax_unit_outputs
+            recipient_share: household_design_weight_over_puf_recipient_total
+            cap: top_slice_positive_mass_per_slice_weight
+            floor: bottom_slice_negative_mass_per_slice_weight
+            snapped_outputs: bounded_on_snap_grid_values_cap_lowered_onto_positive_grid
+            seam: raw_tax_unit_draws_after_tail_bound_quantiles
           worker_execution:
             surface: execution_profile
             resolve_as: worker_execution

diff --git a/packages/microcosm-build/src/microcosm/build/us_runtime/h5_io.py b/packages/microcosm-build/src/microcosm/build/us_runtime/h5_io.py
@@ -1050,18 +1050,22 @@ def _current_worker_execution_authentication(
 ) -> dict[str, object]:
     """Derive current authentication evidence from the signed nested worker."""
 
+    from microcosm.build.us_runtime.stacked_spine import (
+        PRIMARY_PUF_EXECUTION_CONFIG_SCHEMA_VERSION,
+    )
+
     config, worker = _stacked_primary_execution_config(
         manifest, manifest_path=manifest_path
     )
-    if config.get("schema_version") != 5:
+    if config.get("schema_version") != PRIMARY_PUF_EXECUTION_CONFIG_SCHEMA_VERSION:
         raise ValueError(
             f"US stacked pool manifest {manifest_path} primary execution-config "
             "version changed."
         )
     return worker_identity_runtime.current_worker_execution_authentication_receipt(
         worker,
         manifest_schema_version=US_MULTISPINE_POOL_MANIFEST_SCHEMA_VERSION,
-        execution_config_schema_version=5,
+        execution_config_schema_version=PRIMARY_PUF_EXECUTION_CONFIG_SCHEMA_VERSION,
         boundary=f"US stacked pool manifest {manifest_path} primary-QRF worker",
     )
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		A single PUF-channel QRF draw can no longer carry more mass than the population slice its recipient stands for. The #982 income-rank predictor sends the top-ranked survey tax units, each standing for several hundred units, onto the PUF's top-ranked returns, which stand for one return or less: the synthetic Forbes-tail records weigh about 0.13 each. One such draw put $141B of line-32 mass on a single weight-644 unit in the #1251 rebuild. As an interim censor, until a tail stratum carries those donors at their own weights (#958, #964), QRF finalization now caps each raw amount draw at the positive mass, per unit of slice weight, of the donor's top slice of the recipient's own weight share, and floors losses from the bottom slice, on every amount output (booleans and origination years excepted). The cap limits a record to the mass of its slice; it does not remove concentration the slice itself has. The rule is bound into the primary PUF execution config, which moves to schema 6, and stacked pools recorded at schema 5 are no longer loadable. Every bounded output writes a tail-bound diagnostics record.