Normalize KEGG compound xref annotations without changing identities

[realmarcin]

Summary

Fixes #1259.
Fixes #1261.

Normalize only the exact historical kegg.compound:cpd:C[0-9]{5} spelling in
emitted node xrefs. Preserve the original SSSOM, lookup keys, precedence and
identity decisions. The test-only CodeSpell exception is limited to one valid
negative-control literal.

Independent review and completed checks

• Independent adversarial code review: no scoped blocker; 51 focused cases pass.
• Actual full-artifact reader comparison: 211,331 lookups unchanged; 120,183
  entities reviewed, with 15,311 annotation-only normalizations. Its receipt is
  bound to actual execution at 980c8234..., not restamped. The later Preserve valid hsa namespace fixture under CodeSpell in #1259 tests #1261
  comment-only change has independently verified unchanged AST and literals.
• Exact final head: 02f6e128dce6c16a95230266cd9123a69530b9e1, clean.
• poetry run pytest: 5,228 passed, 18 skipped.
• poetry run tox: all six default environments pass, including isolated
  pytest with 5,229 passed, 17 skipped.
• poetry check --lock and generated merge-config check both pass.
• Both exact-head CI runs 36581704129 and 36581705262 pass all three Python jobs.
• Actual isolated MediaDive replay and independent comparison pass: all 113,926
  edges byte-identical, all 32,135 nodes retained, exactly 11 redundant xref
  spellings removed. No new canonical xref claim; all other cells unchanged.
• All 225 material-audit rows retain complete claims and raw recipe evidence;
  only the explicitly approved worktree path relocations differ.
• Independent final annotation acceptance: no remaining scoped blocker.

Evidence directory:
data/issue1224-quarantine-20260929.xjuS9H/issue1259-diagnosis.7T9Jn8/.

Receipt	SHA-256
Full repository gates	495065dad3785fcddb8d7a4ee630c58e2c14fab5ed73e1d4177570dd34266420
Actual source replay	5fd7838b44387f23fa49cbd1a1d45766d2863832f74b242a57666d8a958f1146
Actual annotation comparison	72c9a0cca834d0ef1d651c9a3d6f0f15a3e022f9dfacd3c95f88c1c32cee9a92
Independent final acceptance	2963b5ffeb45650eada089263e3d84a0421d398aea99d32c4e942ad8d07f3d42

Earlier failed CI and interrupted local gates remain historical failures, not
relabelled as passing. All owned gate and replay groups have settled.

Boundaries

This annotation correction does not approve inherited material-to-molecule
assignments discovered during node review. They are separate upstream mapping
work and must be resolved before the full production rebuild. The chemical
mapping skill kept the current change within output annotations; the supported
MIM table and immutable pin remain unchanged.

Umbrella issues #650 and #286 remain OPEN. The fresh all-source transform,
candidate-only merge and source/KG/model/path acceptance are still required.
The canonical archive and user statistics are protected and unchanged.
Admin bypass of the required collaborator approval was explicitly authorized
only after independent review and green CI; those scoped conditions now hold.

[realmarcin]

Independent adversarial code review cleared the three-file #1259 patch with no
actionable findings. Commit 980c8234b990f8e4914671a142e9a7ff131fab41 contains
the exact reviewed source/test/documentation bytes:

• reader: 8e4f9df3df56d903cc3c52ac489c1a814b7f8d64ca5b6a6a54a796cebe42ebb8
• tests: e2d0e910a124e99efc2bd9c660deb8d2d1c903b1c9d8def5dfa2f291d7d4b857
• scope documentation: 7abf60b6e790418ca8dbcf63afcbf5d30051ddf73cf4e5ec4050b64efc4a5487

The reviewer ran 51 passing hermetic cases, including 16 independently authored
negative/conflict probes and AST comparison proving existing identity-loading
and routing definitions are unchanged. Five conflicting canonical/alias shapes,
both alias-only shapes, ordering/reload behavior, literal query normalization,
raw index immutability, finite ASCII grammar, bundle and actual tiny producer
routes were covered. This is not a scientific resolution of historical
multi-target mapping claims.

Review report SHA-256:
ee9c4cb592e7dda2fed0b7dad14e7b3d9564333139473125113e8728682c86cd.
Evidence directory:
data/issue1224-quarantine-20260929.xjuS9H/issue1259-diagnosis.7T9Jn8/.

The separate full-artifact reader comparison, all four repository gates and
exact-head CI remain pending. No merge or graph-release acceptance is asserted.

[realmarcin]

Actual full-artifact reader comparison passes for #1259 at 980c8234b990f8e4914671a142e9a7ff131fab41, against frozen 1329368… and the unchanged 67c48e1b… artifact.

• All 211,331 actual lookup results are unchanged, including the five potential canonical winner flips, all 35 historical alias/canonical differences, and the two alias-only canonical misses.
• All 120,183 entity enrichment outputs were compared. Exactly 15,311 annotations change through the approved exact KEGG spelling normalization/deduplication; names, synonyms, other namespaces and all 12 underlying indices remain unchanged.
• CHEBI:7070 now returns cas:75-57-0|kegg.compound:C11335, without the malformed doubled-prefix xref.
• Both fresh processes exited 0; all 19 input guards, 15 saved artifacts and intended import origins were independently checked. Supported MIM and its immutable pin are unchanged.

Evidence: issue1259-diagnosis.7T9Jn8/reader-comparison-8p5y7cpm/result.json, SHA 7543eb05cfd2927feabe717d2a744d9712e9fd2844936b56b22726ee4b1d5d57; detailed review: ACTUAL-READER-ACCEPTANCE.md.

The actual comparison preceded the later #1261 test-only CodeSpell suppression for hsa:12345; it is not restamped as an execution at a newer head. That follow-up's test continuity is reviewed separately, with reader/data bytes unchanged.

This validates reader compatibility, not physical SSSOM cleanup or historical chemical-conflict resolution. Full gates/CI and subsequent production rebuild, emitted-output and merged-KG acceptance remain separate requirements.

[realmarcin]

#1261 one-comment fix: independent clearance

Compared the W10 test to commit
980c8234b990f8e4914671a142e9a7ff131fab41. The entire byte change is exactly
one substitution:

-        "hsa:12345",
+        "hsa:12345",  # codespell:ignore hsa

The complete parsed AST is identical, including all assertions and all 123
string constants. The valid non-target KEGG organism identifier remains tested;
it was not respelled to appease the dictionary. No runtime or other test change
is present (git diff --numstat: one insertion and one deletion in this file
only).

Verified SHA-256 before and after checks:
e09939effd09d3211d321423d0e96a994698f9c785806cc2b038424cdd3f9c6e.

The 35 focused tests passed in 4.34 seconds (exit 0, four dependency warnings),
using the pinned Python 3.10 environment, explicit W10 PYTHONPATH, -B, and
no pytest cache provider. CodeSpell 2.4.3 from
combined-materials-worktree/.tox/codespell-write/bin/codespell checked only
tests/test_chemical_xref_annotations.py, without a write flag, and returned
exit 0. Its invocation did not change the file's bytes.

No actionable finding. This clears the comment-only fix; restarted full gates
and CI remain separate. The reviewer created no W10 file and changed no source.