[adpena]

TEA Data publishes one immutable catalog for dataset periods, provenance, acquisition receipts, reference documents and source-specific value policies. Analysts and downstream apps share observed, suppressed, missing, not-applicable and invalid semantics while preserving raw values. Charter transfers retain the five-student midpoint scenario separately from observed transfers and disclosure bounds; TAPR enrollment remains distinct from membership.

Five analytical Parquet roles accompany the snapshot, entity, boundary and map artifacts. Analytical consumers can select columns and scan batches without hydrating the full entity engine; the existing object DSL is still eager and is not claimed to provide dataset/period partition pruning. SQLAlchemy round trips use portable UUID/JSON values, bounded upserts and caller-owned transactions. Private campuses use exact source-qualified identifiers and have no fabricated TEA ID or governing district; geographic containment remains separate. Charter districts do not acquire inferred boundaries.

The published v0.0.126 release corrects the Polars/pandas index-alignment error found in 0.0.125. Literal comparison with the selected publisher workbook matches all 9,084 campus and 1,208 district ratings, including scalar and metadata values. Two producer runs generated identical nine-role artifacts. The current tree retains only those nine canonical LFS artifacts; obsolete package/root cache pointers are retired. Published tags, releases and assets are preserved for reproducibility.

The immutable release binds commit bef127e and serves the manifest plus nine adjacent artifacts. GitHub release attestation and all ten asset sizes/digests were verified. This replaces raw GitHub delivery, which serves LFS pointers for artifact paths. An anonymous canonical DataRelease consumer fetched and verified the manifest and all nine artifacts (750,570,910 artifact bytes) from an empty cache; schema/catalog/snapshot framing checks passed and the temporary cache was removed.

The reader fix closes four owned SQLite connections explicitly in map and boundary readers, including cached-profile paths. Independent before/after cases preserve values and exceptions while eliminating dependence on garbage collection. Code-only checkouts document skipping automatic LFS hydration.

Catalog source/provenance projections now copy only the selected validated records. This removes 15 whole-catalog parses from the app's template context without adding a mutable app cache. The derived lookup is excluded from established snapshot state; controlled catalog and empty-engine snapshot serialization, public documents and the complete template context remain byte-identical. A retained-release metadata benchmark reduced traced peak allocation from approximately 816 KB to 169 KB, with a one-time decoded index cost of approximately 203 KB. This is metadata-only evidence, not a claim that the app's runtime memory growth is resolved. Published artifacts, versions, schemas, APIs and SQL remain unchanged.

All five one-shot snapshot data readers now open SQLite with explicit read-only access. BoundaryStore also uses an escaped absolute file URI, so spaces, ?, # and Unicode in a path cannot alter its URI parameters. These readers reject writes and never create a replacement database if the selected file disappears after discovery; connection lifetimes and existing error policies are preserved. Writers remain separate. This prevents requesting write access to immutable published data; actual container disk and memory effects still require new-image qualification.

Validation:

• The data/domain revision passed 503 tests on each supported Python 3.11–3.15 runtime, retained-bundle loading and source-free package checks. Actual PostgreSQL round-trip checks passed on Python 3.14/3.15.
• A real pre-push run exposed inherited Git repository context leaking into temporary test repositories. The shared checker now clears Git-owned local environment variables for explicit repository operations and check subprocesses. Real Git/UV hook regressions pass, including foreign and linked worktrees, preserved owner HEAD/index/configuration, and custom-hook protection.
• Published-data revision checks: 504 passed, one existing optional PostgreSQL skip, Ruff, typing, dependency and current-release validation; matching receipt verification and the normal pre-push hook passed. The nine LFS objects uploaded successfully.
• Current committed reader and metadata projection fixes at 031d3760: 535 passed and one expected external-PostgreSQL skip on each Python 3.14.10 and 3.15.2, plus Ruff, typing, dependency checks and explicit matching receipt verification. The checks retain 24 existing deprecated-style warnings from the legacy year-specific producer and one intentional optional-dependency warning; that producer is retired by stacked Prepare TAPR sources and reproducible historical refreshes #47. Independent review binds the 233-file source, the read-only reader regressions and the paired app pin/context change; the normal pre-push hook passed. Exact serialization and validation proofs are separate from code checks. No data release or runtime capacity pass is claimed.

This remains a coordinated draft with teadata-app#238. Production activation still requires final app pins, resource/readiness qualification and a reviewed migration/rollback cutover. No main merge, PyPI publication or app deployment is claimed. Available 2026 accountability revisions and the newer Comptroller TEFA roster are inventoried but not activated here; unknown historical acquisition dates, private-school periods and affiliation claims remain explicit. The bad 0.0.125 bundle must not be activated.