docs: the four decisions and the review ledger, which #24 merged without

[sinkog]

PR #24 merged an earlier head than the branch carried. Measured against devel after the merge:

DECIDED blocks:        0
trust-boundary section: absent
disposition ledger:     absent
reconciliation tool:    absent

11 files, 462 lines — none of it there

This is the second time a merge has taken a head that was not the branch's. The first was #8, which merged into a base that had already merged to main and left a commit behind. Both were invisible until something was looked for and not found — a force-push and a merge race, with no check comparing what a PR claims to carry against what the target ends up holding.

Nothing here re-derives anything: same content, restored onto current devel, derived values recomputed.

What was lost and is back

Four decisions, each with what was refused and why:

	choice
D-1	scalar_type constrains, no coercion, belongs to D-5 — a contract cannot be evaluated without a type: range: [1, 100] against "50" has no answer
D-2	rejection — a complete set crosses into a module, so a declared position with no value is not a state the boundary can be in. required: true keeps a sharper meaning: the instance must supply it
D-5	enforce access and contract — one question, answered once
D-6	restrict declared names; opaque keys exempt and not addressable

And the section three of them turn on, which was written down nowhere:

Materialize is the pre-entry step, so the untrusted edge is there and at ValidateCanonicalDocument — not at the module boundary, which receives a complete set. Resource budgets belong at the first two.

The review ledger and its gate. reviews/cbaf928.disposition.md carries one row per finding; tools/check_review_ledger.py reconciles the findings the threads raise, the ledger rows, and the decisions.

It exists because the decisions list lost two findings — claim/F-08 and claim/F-10 were raised, measured, confirmed, and then appeared nowhere.

14 closed, 10 partial, 13 open, of 37. A partial is not a closed one.

Plus three false claims: make conformance calling a target that does not exist, "32 of 34 invariants" against 46 and 40, and "no module and no boundary" long after go/module/ existed.

---

make ci passes.