EVGAP-01：target surface localization 抽取契约（contract-only；抽取待 SRCADM-01 授权） - #59

Freezes one evidence-extraction run that would discharge EVGAP-01, the gap
registered in PR #58 that blocks LOCK-01. Nothing is executed and Level 01
remains unauthorised, because EVGAP-02 is still open.

Governance finding stated up front: the data LOCK-01 needs already exists
locally in ADC_surfaceome_reference v0.3.0, but that database has never been
reviewed or approved. No review record in the repository mentions surfaceome,
and the approved evidence extraction in PR #31 declared ADC_internalization_
reference as its source without wiring this one in. That is why the approved
layer carries only transmembrane annotation: not because the data was missing,
but because it was never connected. This PR therefore asks to admit exactly one
pinned version, with the snapshot id, the raw manifest digest and four file
checksums recorded, aborting the run on any mismatch.

The case for admitting it is that its own build manifest already hard-codes the
guards this repository keeps enforcing, two of which are literally the blockers
from earlier rounds: membrane_topology_is_independent_surface_localization is
false, and absence_is_negative_evidence is false. It also excludes an RNA FPKM
source for not being a protein measurement, caps T7 confidence, and states that
it establishes no malignant-cell positive fraction or ADC accessibility. The
guards are built in, not bolted on by this contract.

RQ-01 keys on independent_evidence_family_count with a floor of two, over
curated knowledge, imaging and cell-surface capture MS. Topology and generic
membrane are already excluded from that count, so it cannot silently readmit
transmembrane annotation as localization.

RQ-02 needs two paths. UniProt derives its extracellular-domain field from the
TOPO_DOM records of transmembrane proteins, so GPI-anchored proteins with zero
TM segments read false regardless of biology. With only the topology path,
CEACAM5, MSLN, FOLR1 and MELTF would hold on a representation artefact while
being confirmed_surface with both a signal peptide and a GPI anchor. The second
path corrects that artefact rather than relaxing the bar. LAMP1 is the control:
transmembrane with a signal peptide but a lumenal domain and no extracellular
TOPO_DOM, so it holds under both paths, which is the organelle-membrane case the
reviewer required.

Five rules cover all 41 targets with no discretion and no exclusion: 22 eligible,
19 hold, 0 killed. not_surface_target and identity_unresolved stay unavailable.

MF-01 is recorded as a mandatory finding and tested rather than merely asserted:
GUCY2C holds, on one independent family and supported_surface rather than
confirmed_surface, which contradicts the earlier multi-model consensus and the
quarantined run's Tier A.

298 tests pass. Ten mutations caught and rolled back exactly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… PR #59

Both blockers accepted. Both were holes I left.

Blocker 1: a covered target whose RQ-03 provenance fails had no rule to land on.
The reviewer's combination is real - in the reference, RQ-01 satisfied, RQ-02
satisfied, no discordance, but source_evidence.tsv missing required fields - and
it matches none of the five rules, so VAL-E01's exactly-one-rule could not hold.
VAL-E05 said such a row degrades to hold without naming the rule or a rule_id.

E1-04b now covers it: in the reference but RQ-03 unsatisfied, giving
possible_surface_target, DEFER, hold. It sits third in the precedence, after
discordance and before both RQ checks, because when provenance fails the row's
evidence cannot be cited at all and arguing about topology or family counts is
moot. Its disposition can only be DEFER: RETAIN is impossible without a
traceable source, and EXCLUDE is wrong because missing provenance is not negative
evidence. Measured: all 37 covered targets satisfy RQ-03, so the rule is vacuous
on this snapshot and the totals are unchanged at 22/6/3/6/0/4. It still has to
exist, because provenance completeness is not something this contract guarantees.

Blocker 2: VAL-E05b demanded six absence columns while per_target_columns carried
only three of them, so an executor could not satisfy the schema and the validation
rule at once. That was a miss when I added blocker 3's fix last round. The three
reference columns are added, conditionally_required_columns now states which set
is mandatory for each provenance_kind, and the three are pinned to the admission
snapshot's dataset id, version and snapshot id rather than being free text, with
VAL-E05d enforcing it. A test asserts the required absence fields are a subset of
the schema columns and that the pinned values equal the admission dependency's
own fields, so bumping the admission version without updating the pins fails.

309 tests pass. Eight mutations caught and rolled back exactly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>