[jm-rivera]

Part of #101

Five fixes from the SDK end-to-end follow-ups and a Codex review of #113.

A sole slot value claimed from a recall sample was never checked against the family. _validate_sole_option_bindings knew whether a claim rested on the whole family or a sample and dropped that knowledge, and the member walk then read the family filtered by the untested claim, so a one-member sample asserting gender=Female answered the female series where the question asked for the total. A sample-only claim now carries sampled (excluded from every dump and schema, so no prompt, cache key or spec_id moves); the walk reads that slot open, and _judge_sampled_claims confirms the claim on the walked members or unbinds it. An unsettled walk leaves the claim under membership_unverified. No extra member read. The last box of #101 needs the omitted-slot fill of #99, which follows as its own PR. The paired eval caught one consequence: bind_shared_values binds the value an unexported family is told apart by (IDS debt service, financialFlowType=ServicingPayment), and it skipped a slot a sampled claim held, so the walk refuted the claim and "total debt service of Kenya" served interest payments too; a sampled claim now leaves the slot to that rule.

A submission that found a done operation could answer 202 done, which a contract client cannot follow, and for a subject served in two renderings the poll then served a stale version. OperationStore.create_or_get now resets every done row a submission finds, and the run serves what the head rule gives at run time; the rejected-version plumbing through submit_over_budget, current and spec_id, and the refresh door's dead done branch and RefreshRebuildUnservable, are removed. Because every reset goes through backlog admission, serve_mint and the definition door's _materialise_and_record now re-read the head when admission refuses and answer 200 when it serves, so a finished result is never refused 503. C187, the datasets README and docs/datasets-sync-ceiling.md state both rules. The 202 failed reply's empty error member is #117.

The Congo wording fix in #113 renamed every place to its span, so "aid from Congo to Congo" collapsed both ends into one choice. _recover_entity_surfaces renames only when no other name would carry the same text, the parsed door's one-text-one-place rule.

Corpus case dq-dac-016 "GNI of Denmark" now expects dac1.gni, pinned to the DFO series that carries NY.GNP.MKTP.CD, and its known failure under a missing issue goes. The recall gap behind it is #115 and #116.

The spec-kit pins move to 0d19172 (DevelopmentFinanceObservatory/spec-kit#20), the contract DevelopmentFinanceObservatory/sdk#9 syncs to.

A reviewer should check _judge_sampled_claims, the interleaving argument in the backlog recheck commit, and the C187 wording.

Testing: CI passed at 125f216 (one shard rerun after a timing test went over its 0.5 s bound under load; it passes locally on repeat), and the paired eval passed on that head after blocking on dq-ids-001, 002, 014, 020 and 035 at caf1154. Locally tests/engine, render, eval, datasets_api, dataset_store, platform and contract passed, as did the live-postgres store tests, ruff, ty check and the eval corpus check.