Tooling: bind review-ledger metadata to pinned family decisions

[roife]

The offline review-ledger checker accepted a PR626 row with both commit heads replaced by forty zeroes. It also accepted an unsupported superseded disposition, an unrelated integration location, a removed closure receipt, and a contradictory GitHub state. The pinned family decision and source receipts remained unchanged in every case.

This binds the ledger fields projected by reconcile_pr_queue.py to the final authoritative family decision, preserving the existing source/receipt checks and legitimate partial-review semantics. JSON booleans remain distinct from integers. All 89 current family records already agree with their decisions: no corruption of the committed ledger or mathematical certificate was found.

Status: research consolidation / tooling improvement; no new κ claim. The selected construction, selected-result record and upstream/ are unchanged.

Reproduce the complete before/after experiment from a clone retaining the base commit:

python3 -B research/ledger-decision-binding/reproduce.py

Expected: both checkers accept the unchanged ledger; the baseline accepts all five mutations; the fixed checker rejects all five. RESULT.json records exact hashes, mutations and outcomes. The script only replaces the ledger read in memory and never writes a ledger or contacts GitHub.

Validation:

• 14 focused tests pass, covering all 89 family projections, removed/replaced fields, null closures, boolean/integer confusion, legacy records and partial reviews. Checked under Python 3.9.6 and Python 3.12.13, including optimized Python.
• Full offline reconciliation passes for the unchanged 528-PR ledger; the before/after replay uses the final checker.
• The selected-record/source inventory check and git diff --check pass.
• All make verify targets passed across a sequential interrupted/resumed run, including the selected PR626 cold replay, 557 tests in 84 isolated modules, and 20 patch-application checks. The first interruption was a missing default Boost include path; the second was Apple Clang rejecting -fopenmp. Resuming with the installed Boost headers and GCC completed the remaining targets. Regenerated tracked artifacts are unchanged. This is local macOS evidence; hosted CI is separate.

Exact base: 66849e1475c930fd7732b1a0067ffee7e1e95f60. OS-random seed 99, research consolidation. No pinned coordination issue existed; the narrow claim is recorded in CLAIM.json. The final overlap review covered 518 open PRs through #698, followed by a latest-arrival check through #700. PR675 separately audits PR626 mathematical owner boundaries, and PR695 reconciles Linux CI evidence; neither changes this ledger validator, and none of these contributions depends on the others.

Prepared by roife with substantial OpenAI Codex assistance, including a separate agent's review and regression-test work. The original reconciliation/evidence infrastructure is credited to Douglas R. Colkitt. Existing supplier and contributor attribution is retained. Apache-2.0. This verifies finite metadata consistency, not the multiplication theorem or live GitHub state.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.