Negative membership requires complete identifiers

A failed identifier lookup proves disagreement only when the relevant source set has complete identifiers. If even one same-category row lacks its identifier, that row may be the requested record: return unknown unless a positively identified same-category match establishes the comparison. Do not let a different known row manufacture certainty. This rule concerns absence-based comparisons; independently established disagreements on identified records remain discrepancies.

Useful regression cases are: all identifiers missing, a mixture of missing and differing identifiers, a positive match alongside missing rows, and a complete set of genuinely different identifiers. Keep category boundaries in the fixtures so a match in another category cannot erase uncertainty.

Evidence/example — 2026-09-14: a bounded native review of repository reconciliation code identified the no-match branch treating nullable provider identifiers as a definite mismatch. Local regression tests confirmed the mechanism and the corrected three-state behavior. A fixed offline development cohort did not contain this failure and its outputs were unchanged, so the cohort alone would not have caught the defect. Evidence is code-path and regression-test based; it does not estimate production prevalence.