fix: close primary-source release gates

[ryanduguid]

Summary

• adds a dated primary-source release review and refreshes the legal-content date to 15 August 2026
• pins the controlling out-of-cycle instrument to F2026L00784, removes the unsafe missing-next-payday fallback, and keeps termination/QE classification human-only while LCR 2026/D1 remains draft
• updates the original D1-D4 position: LCR 2026/1, /2 and /3 are final; only D1 remains draft
• fails closed across the LCR 2026/1 transition until an operator confirms the employee-by-employee old-quarter allocation; the confirmation is written to affected report rows
• verifies regulations 11-13D against compilation F2026C00535 and records the direct ATO $270,830 maximum-contribution-base source
• distinguishes display-level ROUND_HALF_UP from the Commissioner's TAA 1953 s 16B final-assessment rounding, and labels every exposure amount experimental
• replaces generated holiday assumptions with official jurisdiction provenance, excludes locally substitutable WA King's Birthday and Melbourne Cup dates, confirms the 2026 Victorian grand-final holiday, and fails closed after 31 August 2027 while the exact 2027 grand-final date remains unpublished
• makes raw calendar-generator output provisional until a human primary-source review raises its coverage

Primary sources

• F2026L00784 — final out-of-cycle determination
• LCR 2026/1 — transition
• LCR 2026/2 — contributions
• LCR 2026/3 — calculation and assessment
• LCR 2026/D1 — qualifying earnings, still draft
• SGAR 2018 compilation 8 — regulations 11-13D
• ATO maximum contribution base
• TAA 1953
• ATO business-day guidance

The eight jurisdiction links, claim-by-claim runtime comparison and source residuals are in docs/primary-source-review-2026-08-15.md.

The earlier review used “LI 2026/20”. The Federal Register as-made page does not display that shorthand, so this change does not present it as a verified identifier; F2026L00784 and its registered text control.

Validation

• uv lock --check
• uv run --locked --extra dev pytest -q — 451 passed
• uv run --locked --extra dev python -m build — sdist and wheel built successfully
• uv run --locked --extra dev --with "pip-audit==2.10.1" pip-audit --local --strict — no known vulnerabilities
• clean Python 3.12 wheel install: unconfirmed transition exits 1 without writing a report; confirmed path exits 2 and writes the experimental label; packaged calendar/data checks pass
• git diff --check

Residual release limits

• LCR 2026/D1 is still draft pending the appeal from Department of Education v Commissioner of Taxation [2026] FCA 898. Raw-pay and termination classification therefore remain human-only.
• The maximum contribution base remains warning-only because cumulative employee/employer financial-year earnings are not input facts.
• Exposure output remains experimental. The checker does not reproduce the Commissioner's final assessment or TAA s 16B five-cent assessment rounding.
• Calendar completeness ends on 31 August 2027, before the unpublished 2027 Victorian grand-final holiday. Later deadlines retain a fail-closed horizon result until an official-source override is supplied.
• Choice loading, exceptional-circumstances discovery, late-payment penalty, post-assessment GIC, fund deeds, awards and enterprise agreements remain out of scope.
• The checker does not pay super, post payroll, lodge a disclosure or SG statement, accept an assessment, or make an accounting decision.

Draft only: this PR does not merge or cut a release.