refactor(baseline): harden reconciliation invariants

[stacknil]

Stack relationship

PR #64 merged as 95bda2e3. This follow-up now targets main and contains only the state, reuse, and performance hardening commits.

Summary

• encode valid BaselineDecision state and suppression invariants at construction time
• make audit projection exhaustive over reconciliation classifications
• cache weak identities lazily so exact fingerprint matches stay on the fast path
• track suppression by stable reconciliation indexes instead of object identity
• centralize baseline finding coercion and simplify phase policies
• add regression guards for invalid decisions and exact-path normalization work

Design decision

reconcile_baseline() remains the only matching semantic core. Projections consume validated decisions, while ambiguous candidates stay visible, unmatched, and unconsumed. Exact fingerprints remain globally prior to weaker identities.

Main risk

The internal matching engine was substantially reorganized. The primary risk is a phase-order or consumption regression under duplicate identities. Exhaustive small-domain permutation checks and the existing reconciliation matrix cover this boundary.

Compatibility impact

No CLI or serialized report shape changes are intended. coerce_baseline_finding remains importable from repo_sentinel.baseline; this change only centralizes its implementation. Suppression, prune, and audit outputs retain the #64 contract.

Rollback path

Revert commits 1f8c605 and 01ecc12. #64 remains independently functional without this stacked hardening.

Validation

• python -m pytest -q — 194 passed
• targeted reconciliation/rule-version/v0.8 semantics — 44 passed
• python -m ruff check . — passed
• python -u tests/validate_pre_commit_provider.py — passed
• python -m build + python -m twine check + wheel content inspection — passed
• changed-files self-scan — no findings
• exhaustive in-memory oracle — 924 cases / 5,809 permutations passed
• 5,000-pair benchmark: exact 0.776 s; relocation 1.333 s

[stacknil]

Delayed post-CI final diff review

Re-reviewed the complete hardening diff after the delay window and after rebasing onto main at merge commit 95bda2e3: 3 changed files and 2 commits. No additional correctness, privacy, packaging, or compatibility issue was found.

• Design decision: validated BaselineDecision states make illegal classification/suppression combinations unrepresentable, while lazy identity caching keeps exact fingerprint reconciliation on the fast path.
• Main risk: reorganizing phase state could regress duplicate-identity ordering or consumption. The existing exhaustive oracle covered 924 cases / 5,809 permutations; the delayed compatibility run passed 44 tests and the full suite passed 194 tests.
• Compatibility impact: no CLI or report-schema change; coerce_baseline_finding remains available from repo_sentinel.baseline, and fix(baseline): centralize reconciliation semantics #64 suppression/prune/audit semantics are unchanged.
• Rollback path: revert 1f8c605 and 01ecc12; merged PR fix(baseline): centralize reconciliation semantics #64 remains independently functional.

Final evidence: the branch is 2 commits ahead and 0 behind origin/main, the diff is whitespace-clean, the worktree is clean, Ruff passes, and the fresh Ubuntu/Windows Python 3.11-3.14, provider, build, artifact, and repository-gate checks all pass. No bot or reviewer comments are outstanding.