Refresh merged-bundle count pins and make bundle drift loud in CI

[MaxGhenis]

What

tests/test_arch_bundle.py::test_build_bundle_writes_merged_consumer_contract fails on this branch with stale hardcoded counts (7,149 facts / 27 source packages), and CI never notices because the file is not in the "Test Arch surface" pytest whitelist. This PR refreshes the pins to the verified current build (10,268 facts / 39 built packages / 8 year-skipped), runs the file in CI as a standalone job, and fixes a required-check deadlock that any non-ledger PR into this branch — including this one — would otherwise hit.

Diagnosis: legitimate drift, not a regression

• The counts were last set 2026-05-28 (5ec0956). Fifteen source-package PRs (Add BEA NIPA source packages #34–Add SSA SSI Table 7.B1 source package #48: BEA NIPA/regional, CBO projections, ACS B01001, SOI state 2022 + congressional district, CMS ACA + Medicaid monthly, Census projections, LIHEAP FY2023, SSA SSI 7.B1, …) landed on main immediately afterwards, before this branch forked at 5e851c5. None updated the test — nothing ran it.
• The bundle built at the fork point (5e851c5) and at the branch tip (08d1001) produce byte-identical consumer_facts.jsonl (sha256 78ca9a51…). No branch-side commit (arch/core.py vocabulary widening, ledger appends, witness infrastructure) affects bundle output at all.
• Every count delta decomposes exactly into the fifteen pre-fork additions: bea +443, cbo +6, census_acs +468, census_population_projections +86, cms_medicaid +255, hhs_acf_liheap +1, irs_soi +1,444, ssa +416 = +3,119 = 10,268 − 7,149. Every pre-existing per-table count is unchanged, and entity/period deltas reconcile the same way (e.g. tax_unit +1,450 = SOI congressional district 1,440 + state totals 4 + CBO 6).
• The build stays fully valid: 0 errors, duplicates unchanged (0 aggregate / 3 semantic), same single warning.

The 8 skipped packages are the year-specific ACS-2024 and CMS-ACA vintages that cannot produce a year-2023 bundle; the test now pins them by name, mirroring the style main adopted for tests/test_ledger_bundle.py when it refreshed its own pins in #68.

CI placement: standalone job, deliberately outside the required whitelist

The merged build takes ~6 minutes (5:46 for the file locally). "Arch checks" is a required status check gating the Thesis resolver's daily append PRs and currently completes in ~3 minutes — putting the bundle build inside it would roughly triple required-path latency for a drift signal that appends cannot trigger (bundle inputs are frozen on this branch). Instead:

• New Arch bundle drift job in ci.yml runs uv run pytest tests/test_arch_bundle.py -q on every push and PR — loud and visible, but not blocking the append path.
• The test's docstring records that the whitelist omission is deliberate and how to regenerate the pins.
• The file joins the ruff lint whitelist.

Because bundle inputs are frozen on this branch, the refreshed test now acts as a tripwire: any future failure means something unexpectedly changed bundle behavior, not routine drift. (Main needs no change — its CI runs the whole suite, whitelist-free, since #68.)

Required-check deadlock fix

thesis-facts-append.yml carried a paths: filter, but branch protection lists "Append gate" as required: a PR into this branch that touches none of the gated paths never receives the check and deadlocks on "Expected". The filter is removed, so the gate now runs on every PR/push to the branch. For non-ledger PRs the append-only diff is trivially clean and the gate costs ~1 minute; this strictly widens enforcement, never weakens it.

Verification

• uv run pytest tests/test_arch_bundle.py -q → 5 passed locally on this branch.
• Dict literals AST-verified equal to the built bundle artifacts.
• python3 scripts/check_thesis_facts_append.py --base-ref origin/codex/thesis-ledger-facts → OK (143 rows, immutable prefix 128, +0 appended, release 0).
• Both workflows YAML-parse; ruff check tests/test_arch_bundle.py clean.

🤖 Generated with Claude Code