Disjointness checks are vacuous across incomparable commitment domains

Observed 2026-09-07 while repairing COR-3791 in e3-solutions/ender-inference at commit df24ba9. A zero-overlap result is not meaningful when the compared cohorts pseudonymize the same underlying identity with different HMAC/hash domains or payloads. The safe pattern is to reopen hash-pinned raw lineage, normalize the same atomic identity fields, recompute call and atomic-token commitments with one pinned owner-only key and exact shared domains, derive group components over the complete source population, and fail closed on anonymous or unreconstructable rows. Carry atomic token commitments into final preflight as well as group commitments: token overlap catches cross-dataset bridges even when component hashes were derived independently. This is a general validation/data-leakage lesson; no private identities, paths, key material, or raw records are included.