Require review, not failure, for narrowly matched data-limited UK replay regressions

[MaxGhenis]

Fixes #653

Proposed, not yet adopted. Under cos d1344's delegation, this rule change takes effect only after an independent review agrees with both the decision record and the code. That review is running. Max can veto before merge.

Why

#2241 correctly charges SDLT higher rates on purchases, but no uk-data release has the purchase input yet (policyengine-uk-data#573). So every candidate since then replays the AB2024 additional-dwelling surcharge as £0 for 2025–2029, against £2.50bn under the old stocks-as-purchases bug. The gate fails any receipt whose integrity failed, and d1344 bars accepting it on review. So no pe-uk after #2241 can be certified, which would leave the 28 October Budget on 2.130.1, without #2240, #2242, #2428, #2436, #2437 and the pension fixes in review.

Change

• Registry: src/policyengine/data/qualification/uk_replay_exceptions.json, with one entry: ab2024-sdlt-hrad-purchase-input, covering construction_inert and lost_response for autumn_budget_2024__sdlt_additional_dwelling_surcharge_2pp, 2025–2029, while additional_residential_property_purchased is missing.
• Narrow match: code, event, measure key and year must all match, and the same attempt's digest-bound budget_inputs evidence must report every required input missing. A present-but-degenerate input doesn't authorise it.
• Failed receipts: evaluation continues only when every integrity failure is a matched construction_inert and the execution identity, corpus and sealed results exist. No vendored schema or validator is weakened.
• Verdict: matched regressions become needs_review items, never qualified; promotion still needs a named reviewer's acceptance of the exact receipt.
• Self-expiry: once the data has the input, the measure must move, or it fails as before.
• Recording: the applied measure-years and codes, the registry SHA-256 and the input-result digest are kept in the gate evidence. Finalization re-evaluates the saved replay bytes against the current attempt inputs.
• Policy: replay_policy.md gains a "Data-limited exceptions" section, and the id moves to d1344-replay-regressions-v2. No scorecard-facing request embeds the id.

Invariants (each held by tests in tests/test_replay_exceptions.py)

1. An applied exception never produces qualified (Hypothesis).
2. An unmatched code, event, key, year or input status, or an extra integrity failure, still fails (Hypothesis, plus partial-subset tests).
3. With an empty registry, results equal main's. This is a frozen-main differential over every replay evaluation in the 314-test contracts suite; only the new v2 metadata and digest fields are normalised.
4. Adding a regression never improves a verdict (Hypothesis).
5. Determinism of verdicts and recorded digests (Hypothesis).
6. The real 2.134.7 receipt gives needs_review with exactly 5 applied measure-years and 195 other flagged moves left for review; without the missing-input evidence, or with an extra failure, it fails.

Mutation: 9 of 9 executed mutants are killed, including dropping the missing-input condition, matching any year, accepting any rather than all failures, and letting the exception pass.

Verification

1,037 tests pass (CPython 3.13, frozen UK and dev extras, serial). Ruff check and format pass on the changed files; repo-wide lint already fails on main with 68 UP038 findings.

Built on a Subfleet lane (GPT-6.1 Sol). Decision record: ~/reviews/budget-coordinator/replay-data-limited-exception/decision.md on the coordinator's machine; its rule is reproduced in replay_policy.md.

🤖 Generated with Claude Code

[MaxGhenis]

Independent review round 1 (GPT-6.1 Sol, head 27b42d4): RULE: AGREE WITH CHANGES, CODE: DISAGREE. Two P2 findings, both accepted:

1. Contradictory receipts became reviewable: an excepted SDLT measure-year reporting £1bn while claimed inert returned needs_review. The fix requires a £0 candidate effect for every excepted measure-year.
2. Missing data isn't causal proof, and expiry could reverse: a dataset that later loses a supplied input would reactivate the exception, and a model bug could hide behind missingness. The fix adds a lineage rule (the previous certified pair must never have had the input usable), a positive-input probe on the exact candidate model (synthetic household; the reform must move SDLT with the input set and leave it unchanged at zero), and a publication designation (not computable).

The decision record now has these as items 7–10, and round 2 is building. This stays a draft until a review agrees with both the rule and the code.

[MaxGhenis]

Rounds 3–4 and merge status:

• Independent review: round 3 (GPT-6.1 Sol) gave CODE: AGREE WITH NITS at dbc1806; RULE: AGREE was given at round 2. Round 4 (8cc4872) fixes the one P3 (history-marker consistency) and records adoption in the registry. An independent Opus delta check gave DELTA: AGREE: the fix fails closed, the new tests fail on round-3 code, and 173 + 764 tests pass.
• Main merged in: at 0ef4a12, bringing in Check statutory resumption after a freeze: Budget reform contract 2.0.0 (cos d1344) #627 (contract 2.0.0) and Import the UK model module directly in the contract's household route #651. The only shared file, tests/test_uk_candidate_gates.py, merged cleanly. Local runs on the merged tree give 701 passed (candidate gates, replay exceptions, qualification contracts) and 528 passed, 3 skipped (replay-exception and UK-qualification files).

This merges with a merge commit once CI is green at 0ef4a12.