test(recall): specify B4 rejoin fidelity gate

[laynepenney]

Summary

• Adds the implementation-ahead B4 rejoin mechanism gate for all five canonical guards.
• Builds every action fixture through real identify, extract_batch 0.6.0, and _decide_actions output.
• Pins synapt-extract 0.6.0 in the test extra so CI cannot silently skip the real-path suite.
• Leaves production code unchanged.

Contract coverage

• Count invariant, singleton and unaddressed pass-through, invented-index ignore, mixed real/invented per-group rejection, duplicate-membership whole-cluster fail-open, and create-only scope.
• Prompt-level anti-corruption instructions for negation, convention, relation, cause, and qualifier drift.
• Tag union, category majority with first-member tie break, B2 source attribution, durable member digest provenance, and real reconcile shape.
• Identical-bound carry, conflicting-bound precision split, non-overlapping one-sided-bound split, and exactly-one-non-null carry.
• Loud B4_COMPOSE_FAIL_OPEN degradation for parse, shape, and inference failures.
• Candidate-count-scaled output budget and B2 to B4 to B3 insertion.

Verification

• Expected RED on sprint-41: 23 failed in 6.65s. The absent surfaces are B2 source_unit_id, _rejoin_create_actions, and B4 stage wiring.
• Original reference-shim satisfiability check outside the worktree: 21 passed. The two added edge contracts separately passed 2 of 2 under a focused reference shim. Both shims were deleted and are not part of this PR.
• Twelve targeted mutations went RED, including filtering an invented index then composing the survivors and synthesizing a range from different members one-sided bounds.
• Existing decomposed-path baseline: 89 passed against the published synapt-extract 0.6.0 wheel.
• Broader baseline collected cleanly and reached 68 passed, 5 skipped with no failures before a manual stop after six minutes in an unrelated long storage test.

[laynepenney]

REVIEWER 1 (Opus) — APPROVE. Whole-artifact review: all 696 lines read, suite executed in a throwaway worktree at cfd9bcb.

FIXTURE PROVENANCE (the load-bearing check): _real_pipeline drives REAL _extract_cluster_units (B1) → REAL _decide_actions (B2); fakes control model text only, and the fixture asserts the envelope shape (source_unit_id format, per-unit prompt binding) so upstream drift breaks loudly instead of being proxied. The truth_fruit corpus memorializes Phase C's ACTUAL corruption cases (the LOW-severity convention, the PR#867-closes-#865 relation) — the anti-corruption pins are tested against the real failure classes, not hypotheticals.

CONTRACT COVERAGE — all 5 guards + all 4 contract answers encoded:

• G1: count-invariant/never-drop (unaddressed pass-through, invented-index ignore, singleton-unchanged), create-only scope (corroborate/contradict excluded from prompt AND untouched in output), no-creates→no-inference, duplicate-membership→WHOLE-cluster fail-open + marker (Q2 exactly).
• G2 (Q1): prompt-level pins for negation/convention/relation/cause/qualifier + faithful-response-not-rewritten; no runtime entailment invented.
• G3 (Q4): tags-union + category-majority (tie→first member in MODEL-GROUP order — Apollo: implement group-order), decision-log binds member_indices + source_unit_ids + sha256 digests + composed content, reconcile-ignores-unknown-keys VERIFIED via real persist, full shape-preservation through real _apply_consolidation_result.
• G4 (Q3): identical→carry; conflicting→split-to-originals, one inference call, no reuse of the cross-bound composition (precision-first — this IS the pinned v1 semantics); mixed→carry the single non-null member's bound (the contract answer, exact).
• G5: parametrized unparseable/wrong-shape/exception → fail-open + B4_COMPOSE_FAIL_OPEN + cluster id + reason fragment.
• Mechanics: single inference call asserted throughout; budget scales with member count and must exceed 800 (kills the flat-floor bug class); wiring test pins B2→B4→B3 with decision_log_path threading.

TDD VERIFICATION (fruit): 21/21 fail on exactly the three unimplemented surfaces — 18x AttributeError _rejoin_create_actions, 2x KeyError source_unit_id (B2 enabling change, correctly test-first), 1x unwired _run_extract_path. Zero fixture-internal failures. pyproject synapt-extract==0.6.0 test pin is correct and necessary (my venv still carried 0.1.1 — proved live).

Premium boundary: core OSS (consolidation pipeline) — correct.

Reviewer 2 = Apollo via the TDD contract-read (read every assertion, post the read to #dev, Sentinel responds, then implement).