Preserve optional intake metadata in ledger verification

[roger-sato]

Summary

• Fix the current ledger checker crashing on incremental intake decisions that omit closure. The committed intake contains 24 such decisions: four inherit an explicit null from earlier family decisions, one new row records null in the ledger, and 19 new rows omit the field. The previous checker rejects all 24, including KeyError: 'closure' on PR1365 in the existing Ubuntu tooling run.
• Accumulate only optional closure, review-completion and evidence fields in authoritative family order. Mandatory fields still come from the latest decision. Source-declared nulls and receipts still require the ledger key and exact, type-sensitive equality; a never-recorded closure permits only absence or literal null. Companion review uses the same effective projection. Raw decisions remain separate for historical receipt equality.
• Keep the ledger, intake decisions, frozen evidence, source pins and selected result unchanged. Refresh the null-closure regression to use its immutable historical PR620 decision, because the latest PR620 record now has a closure receipt.

Canonical base: 20ecf2891d80b5acf18d980b2164fb44ea7faa90, priority revision 6. This is offline metadata integrity maintenance, not a scientific or live GitHub-state audit. Credit roife's PR704 for the original binding and rejection controls, Douglas R. Colkitt for the reconciliation infrastructure, and Dennis / antunishdPursuit's PR2026 and PR2859 for historical replay maintenance. Fresh open/closed PR and Discussion overlap checks found these predecessors, with no matching pending repair; this is not a novelty guarantee.

Test plan

• macOS 27 arm64, CPython 3.12.14: 24 focused tests pass normally and with optimized Python, including all 2,947 current authoritative projections, inherited receipts/nulls/completion evidence, explicit overwrite, missing mandatory fields, invented closures, boolean/integer confusion and companion review.

  PYTHONPATH=tests python3.12 -B -W error -m unittest test_pr_reconciliation.FamilyDecision test_pr_reconciliation.ReviewCompletion test_companion_completion -v
  PYTHONPATH=tests python3.12 -B -W error -O -m unittest test_pr_reconciliation.FamilyDecision test_pr_reconciliation.ReviewCompletion test_companion_completion -v

• Independently reviewed the production diff and projection semantics. No registered live SOURCES.json/VERIFY.json pin requires modification; historical PR704/721 coverage retains its original snapshot paths.

• Ran the actual python3.12 -B scripts/replay_historical_check.py tooling-ledger once in a complete isolated checkout containing this checker plus the exact documentation-admission change from pending PR3648. The former closure failure is resolved. The command then rejects the unchanged canonical PR3107 starting-head mismatch; no metadata or validation bypass was added. The production checker tested is identical to this PR; PR3648's change is not included here.

• Ran the complete test_pr_reconciliation.py module: 29 of 30 tests pass. The remaining AssertionSafetyRefresh.test_exact_accepted_successors_pass failure rejects the canonical live run_isolated_tests.py successor and also occurs on untouched base. That separate allowlist repair is now PR3688. This diff does not change the allowlist.

• In a disposable copy of this exact commit 932f3b1ef707733643b5e318c4bf134436ddd766 plus only PR3688's two-file patch, all 31 reconciliation unit tests pass normally and under -O, both with -W error.

• Full tooling CI is not green: the fork push run stops at the existing documentation guard addressed by PR3648. Even with that admission and PR3688, the canonical starting-head inconsistency remains separate. No complete historical ledger replay success is claimed. Upstream Actions require maintainer approval.

Prepared with substantial OpenAI Codex assistance for investigation, implementation, regression controls, execution, independent agent review and writing. Apache-2.0.

Local integration follow-up (2026-10-19 JST): PR3692 repairs the initial-head mismatch using authenticated existing receipts. A disposable canonical-base tree combining its af040ab4 change with exact PR3648 a0d88d68, PR3686 932f3b1 (checker and tests), and PR3688 3463ba61 passes all 38 reconciliation tests normally and under -O, both with -W error, on macOS arm64 / CPython 3.12.14. One 600-second-capped tooling-ledger replay passed the repaired boundaries and batch1047, then stopped after 29.76 seconds at the separate canonical PR1048 detailed-review/evidence mismatch against historical batch1099. The untouched canonical checker independently reproduces that mismatch. Ledger, intake and frozen evidence remain unchanged; full ledger/CI success is still not claimed.