docs: close R2 reproducibility checkpoint

docs/reviews/findings-ledger.md

@@ -101,6 +101,16 @@ did not find an actionable exception beyond the documented classes.
   dedicated tool build gate. Move truly historical one-off probes out of the
   maintained build surface with an explicit archival label.
 
+**Post-baseline maintained-.NET-tool checkpoint (2026-08-18, `c38f6b88`):**
+all 13 tracked `.NET` tools now use repository-owned project references or
+central package references, build warning-free, and are members of
+`AcDream.slnx`. The release gate fails if any future project under `src/`,
+`tests/`, or `tools/` is omitted from that graph. `tools/README.md` records each
+tool's purpose and runtime prerequisites. This resolves the supported `.NET`
+tool portion of F-004. The older PowerShell/Python/CDB scripts and historical
+root launchers described above remain open for the later R6 archival decision;
+F-004 is therefore not closed wholesale.
+
 ## F-005 — Mandatory reference workflow depends on repositories absent from the repository
 
 - **Severity:** P1 high
@@ -489,12 +499,25 @@ actual GitHub execution after publication.
   that proves a clean checkout. Keep tool-only exceptions explicit rather than
   allowing per-project drift.
 
-**Post-baseline partial checkpoint (2026-08-18, `2ac05486`):** `global.json`
-pins SDK feature band `10.0.300` with `latestPatch` roll-forward, and all five
-CI setup sites now consume that file. `docs/release-gate.md` documents the one
-complete command and its evidence. F-019 remains open: common compiler/package
-settings are still duplicated, there are no package lock files or locked
-restore, and the unsupported tool-project decisions have not been made.
+**Post-baseline resolution (2026-08-18, `2ac05486` and `c38f6b88`):**
+`global.json` pins SDK feature band `10.0.300` with `latestPatch` roll-forward.
+`Directory.Build.props` now owns the repository-wide compiler, analyzer,
+warnings-as-errors, deterministic-build, and lock-file policy;
+`Directory.Packages.props` owns all 30 direct package versions; and
+`NuGet.Config` clears machine fallback folders and sources in favor of the one
+declared `nuget.org` source. Every one of the 44 supported projects commits a
+neutral dependency graph, and all 14 source projects also commit `win-x64` and
+`linux-x64` graphs. The custom `packages.<graph>.lock.json` names avoid NuGet's
+special precedence for conventional `packages.lock.json` while allowing the
+neutral and two RID graphs to coexist. The release gate uses forced locked
+restore, hashes all 72 graphs, and builds every supported project. A clean,
+exact-commit `c38f6b88` gate on SDK `10.0.300` passed with 0 build warnings,
+14,742 passed / 77 skipped / 0 failed across 12 test assemblies. A separate
+empty-package-cache locked restore succeeded using only the declared source,
+and locked neutral/RID re-evaluation changed zero lock hashes. F-019 is
+resolved on the campaign branch. Hosted GitHub Actions remain deliberately
+parked; the documented local command is the release authority until runner
+policy is restored.
 
 ## F-020 — The issue ledger is an unbounded mixed tracker, research log, and archive