Exact holdout quotas need a fail-closed component allocator

General lesson: after joint exposure closure, distinguish full component membership from quota-bearing eligible rows. Select whole components with a deterministic exact-subset allocator for TEST and DEV; if either exact quota is unreachable because of component weights or remaining capacity, emit a capacity receipt and stop instead of silently lowering the quota or splitting a component. Training can then use a separately marked maximum whole-component subset under its cap. Keep ineligible rows in the graph as identity bridges, but require explicit eligible_target and training_selected flags before downstream retrieval.

Applicability and limits: this is useful for repeated-caller/entity or multi-occurrence datasets with prior holdouts. It only protects against registries and grouping identities actually retained; missing historical registries and unknown pretraining exposure remain explicit gaps. Determinism does not establish label quality or global freshness.

Evidence/example (2026-09-17): a private metadata-only preparation independently reproduced the same joint-closure capacity census, reserved exact evaluation quotas, and reported extra ineligible component members separately from context counts. Synthetic tests covered array/scalar identity bridges, protected precedence, exact-quota impossibility, cap preservation, malformed metadata, and row-order determinism. No call text, outcomes, labels, model inference, or backend writes were used.