[MaxGhenis]

Fixes #719. Replaces #745 (closed: it predated the #720 restoration and the ACS release join, and could not rebase across 1,600 commits). Delivers #922 item 5 at the code level.

What

Every released US person record carries three new PolicyEngine-US inputs (engine side: policyengine-us#9311, in the locked 2.2.1), next to detailed_occupation_recode:

column	meaning	ASEC	ACS 2024
detailed_industry_recode	industry of the longest job last year, 23 groups	WEIND	INDP → ACS_INDP_TO_WEIND
major_industry_recode	same job, 15 groups	WEMIND	WEIND_TO_WEMIND of the above
worked_last_year	worked at any time last year	WKSWORK > 0	WKWN > 0

The design reuses existing boundaries rather than adding a stage:

• ASEC (and PUF-support clones): asec_census_person_columns (Pooled ASEC 2022/2023 vintages lack the NOW_* coverage recodes: reported Medicaid at interview thins to 24.6M vs ~58M survey under 65 on the certified artifact #720) now also restores WEIND/WEMIND for every vintage from its pinned Census person member by exact PERIDNUM join before pooling. No H5 vintage carries them, so they are recorded as beyond the 8/23 offline-fix receipt.
• ACS: the release predictor join (acs_release_predictors, crosswalk v2, digest re-pinned) maps native INDP/WKWN onto the same three raw columns, exactly as it maps OCCP onto POCCU2.
• Every row: the release-time org_wages carry emits the three columns beside occupation; source_stages.json declares them; they join the post-reference required release inputs (coverage manifest: 170 required).

Why WEIND/WEMIND and WKSWORK > 0: they describe the longest job last year, the same job as POCCU2 and the same year as the income; the survey-week A_DTIND/A_MJIND would describe the current job. In all three pinned members WEIND carries a worker code exactly where WKSWORK > 0, while WORKYN = 1 misses ~600 allocation rows per year.

The ACS crosswalk takes each civilian code's group from the pinned 2025 ASEC member (same 2022 Census code list as ACS 2024 INDP; INDUSTRY determines WEIND exactly there) and reviews the eight ACS-only codes (seven Armed Forces branches → 22, as CPS's single 9890; 9920 → did-not-work 23). Blank INDP mirrors the OCCP rule (0 below 16, age 15 kept out of universe; 23 from 16, only ESR 6 may be blank).

Invariants (stated and executed)

1. Nesting: WEMIND == WEIND_TO_WEMIND[WEIND] — checked in the ASEC restoration, by construction in the ACS join, and in the org_wages carry and gate.
2. Forward worker identity: WKSWORK > 0 ⇒ WEIND in 1–22 — all three sites, every spine.
3. Converse (ASEC only): WEIND in 1–22 ⇒ WKSWORK > 0 — checked only in the restoration, where rows are known to be ASEC. Intended asymmetry: ACS INDP covers a job in the past five years, so the release carry does not check it.
4. Round trip: the carry emits its inputs unchanged; worked_last_year == (WKSWORK > 0).
5. ACS universe: below 16 all outputs 0; blank INDP from 16 → 23; observed INDP → table; WKSWORK = WKWN or 0.

test_us_work_experience_properties.py checks all five with Hypothesis (200 examples each) plus a differential test running the same generated rows through the ASEC restoration and the release carry, requiring each to accept exactly when its stated identities hold. The differential draws both independent codes and nested industry pairs with any weeks, so each worker check decides some cases; deleting any of the three checks fails it.

Real-data evidence (in docs/us-work-experience-columns.md)

• ASEC pppub23/24/25.csv: nonzero INDUSTRY→WEIND/WEMIND functional (263/263/259 codes; INDUSTRY = 0 covers both WEIND 0 and 23), WEIND→WEMIND the same function in all three, zero universe violations; weighted nonzero-industry shares 0.822–0.824, worked 0.520–0.523.
• All 3,422,888 ACS 2024 persons (the release-pinned archive) through the join: no refusal fires, every INDP code mapped, WKWN>0 iff WKL=1, the 264,806 people with an industry but no weeks equal the WKL=2 count exactly; weighted nonzero-industry 0.812, worked 0.538. Gate bands bracket both spines.

Pins moved (all explained)

ACS crosswalk digest (v2); frozen source_stages.json digest; spec-engine inventory (source-manifest, resource-semantics, full-checkpoint and tail digests; tail control fields 934 → 937 = the three tail-contract columns); field-usage counts (+11 configuration fields = 3 derive inputs + 3 outputs + 2 nonnegative + 3 tail-contract) and the affected pointer claims; coverage evidence JSON regenerated by its tool.

Repinner (tools/repin_us_spec_engine_contracts.py)

The documented re-pin sequence regenerates every F0 pin. Three bugs were fixed during review:

• Calibration projection. The tool hashed the compiled bundle, whose loader writes 5.0 as 5. It now builds the contract exactly as the semantics-test fixture does (pin aa65317d…). Stripping this PR's three tail names reproduces main's 05cb099e… from the raw contract, but not from the bundle.

• Count pins found by old value. Pins were located by their old value, taken from the evidence JSON or the module's own pins, so a merge that moved one copy hid a stale other while --check passed. That happened in a trial merge with Add 2023 county-equivalent geography to US household ladders #1376. Every field-usage and coverage-test count is now refreshed by its asserted expression or key:

  • totals, claim count, inventory counts and the breakdown dictionaries;
  • the "<N> unclaimed normative field" expectation.

  Planting stale values makes --check fail and the tool restore them.

Merge with #1376

Merged after #1376, #1377 and #1378. The combined ledger has 42,229 configuration fields (main +12: 11 here, 1 from #1376) and passes 41/41 inventory checks. The pool tool's runtime graph has 80 modules. The bundle spec hash is 53fb8de6….

Not in this PR

Released files carry the columns once the pooled base and multispine pool are rebuilt and a release runs (#922 sequencing step 1). Until then the release input-coverage gate is red on these three columns by design (notes in the manifest).

axiom: n/a: data pipeline only (no policy rule changed)

🤖 Generated with Claude Code

[MaxGhenis]

Round-2 delta review (GPT-6.1 Sol, Subfleet 20261024-015826-lwi-r2-1039): APPROVE at 558d5b6, no findings.

• The repinner's fixture_calibration_contract() and the semantics-test fixture produce identical raw bytes, so the pin is aa65317d….
• Stripping the three new tail names reproduces main's 05cb099e… from the raw contract and 40b952b7… from the loaded bundle.
• Full --check passes across all 18 pin paths.
• The new nested-pair property strategy kills all three worker-check mutants (minimal counterexample ([1], [1], [0])).
• The docs now qualify nonzero INDUSTRY.

Merging on green CI; if #1376 lands first, this branch takes main and re-pins with the fixed tool.

[MaxGhenis]

Reviews since 558d5b6 (GPT-6.1 Sol via Subfleet), all APPROVE with no findings:

• R3 at 4280262: keyed count breakdowns. The merge replay reproduced the stale-literal bug and the fix.
• R4 at 9e8acf9: main merge with Add 2023 county-equivalent geography to US household ladders #1376/US county calibration pilot for the LWI County Files #1377/Add county calibration rung to US ACS-local release #1378. Nothing from either side dropped; 80-module graph; all 18 pin paths and coverage 42,229/42,229 match a fresh run.
• R5 at 7ab3a77: unclaimed-count rewrite (selection expands to 87; a planted 86 is refused and restored), plus Add 2023 county-equivalent geography to US household ladders #1376's seed note restored byte for byte.

Merging when CI is green at 7ab3a77.