Build J: full eCPS-exported-column coverage as a HARD release gate + asset-column restoration (SSI reforms score $0)

The failure (Max's directive: "DO NOT STOP UNTIL WE HAVE THIS! it must be an actual gate!!")

An SSI asset-limit reform ($10k/$20k) scores exactly $0.000B on the newly certified default (Build I) — probe-verified, not inferred — because ssi_countable_resources is 0 for every record: the asset input columns were dropped at the base pool and are absent from the export. This is the #361/#356/#340/#278 family: 94 input columns the sparse national-only release never persists, so the engine silently defaults them and every reform that binds through them scores $0. Build I restored 7 of 94 (IRA/SE-pension intents, hours family, immigration/ssn) — none of the assets. The incumbent July 1 default had the identical hole; certification never blocked on it because export-mass parity (35 weighted-mass columns) is not column coverage.

Deliverable 1 — the HARD GATE (ship first; it must fail today's builds by design)

Extend the #350 mechanism (US_RELEASE_REQUIRED_PERSON_SOURCE_COLUMNS + assert_required_us_release_source_columns, which hard-fails the export before write_dataset) from its current 5 SNAP columns to a declared full coverage contract:

• Required set = every input column the reference eCPS exports (the #340 inventory: 94 columns incl. assets #356, tips/overtime/auto-loan/education/retirement-contribution/casualty/misc-itemized/childcare #340, IRA/HSA #278), maintained as a versioned manifest in-repo — additions to the engine's input surface extend it (the #323 assignment flow).
• Gate = presence as an H5 key AND non-degenerate signal (constant-at-default requires a reviewed exclusion with an issue link, same #286 "cannot rot" semantics — stale excuses fail the gate).
• Reform-coverage smoke: a pinned set of reform probes that must score nonzero where the policy mechanically binds (first entry: SSI asset limits $10k/$20k — currently +$1.6B on dense-native per the populace#356-era dense runs; also no-limit ≈ +$16.1B). A $0 on a bound reform fails the release.
• No certification without this gate passing. No exceptions list longer than the reviewed-exclusion mechanism allows.

Deliverable 2 — restore the asset columns (the data)

Assets are SCF-imputed in the retired pipeline; port that stage into populace (the #293/#350/#352 port pattern Daphne established), so ssi_countable_resources derives correctly. Then the remaining #340 families (tips/overtime/education/retirement-contributions/casualty/misc-itemized/childcare — childcare's raw CPS signal already sits unused in the file) and #278 leftovers. Base pool rebuild carries them; dense + sparse re-run under the gate.

Sequencing (Build J)

1. Gate PR (fails current artifacts — that is the point; merge with the gate ON).
2. Asset-stage port + base rebuild + probe passes (SSI reform scores plausibly vs the dense-native reference numbers).
3. Remaining families in tranches; each tranche shrinks the reviewed-exclusion list.
4. Re-certify dense + sparse under the full gate; default flip only when the SSI probe (and the rest of the smoke set) is green.

Refs: #340, #356, #361, #278, #350 (mechanism), #286 (cannot-rot semantics), #323, #359 (Build I verdict carrying the caveat), policyengine.py#463 (the flip this gate should have blocked).

Start with the #350 mechanism, especially US_RELEASE_REQUIRED_PERSON_SOURCE_COLUMNS and assert_required_us_release_source_columns, then review the #340 inventory and the retired SCF-imputation stage. Run the pinned SSI asset-limit reform probes against the current artifacts and inspect policyengine.py#463. Done means the full manifest gate blocks incomplete exports, asset columns are restored, and dense and sparse builds pass the smoke set before recertification.