Tooling: source-versioned PR799 evidence coverage with fresh replay and corruption controls

[nightangelflowerwin-ops]

Tooling follow-up to Lucas (@ljste)'s #838: the complete selected PR799 binding accepts 112 altered-evidence cases; the enforced path rejects all 118 tested mutations and accepts valid historical/current replays. This adds an explicit source-versioned 22-stage/44-artifact ancestry contract, PR799's own execution-log/result checks, and early rejection of incomplete reuse. No new kappa.

Both Make replay targets and their existing CI workflows use the gate. Historical hash-pinned runners/bindings and selected proof records stay byte-identical. The public runner keeps historical output in work/replay/ and publishes its top-level result only after coverage succeeds. Existing PR799 test fixtures use ordinary copies so Windows symlink privilege is unnecessary.

Concurrent work: Chinmay (@chinmayarvind23)'s #847 at 72b8406b96ea2e0f37bb5143f594e12d4817c92a arrived during validation with the basic Make/CI coverage integration and separate success publication. That work is credited; no discovery or integration priority is claimed. This independent implementation adds pinned producer/consumer contract versions, strict metadata, current PR799 reachability, native/top-level log and stored-result coverage, source-drift controls, and a fresh native/global replay. No #847 code is imported. #851's bit bridge identities and #841's proof pointers remain separate scopes.

Reproduce:

python -I -B research/required-replay-coverage/verify.py
python -I -B research/required-replay-coverage/check_package.py
python -B -m unittest discover -s tests -p 'test_replay_coverage.py' -v
python -B -m unittest discover -s tests -p 'test_frontier7*bindings.py' -v

Expected primary status: PASS_REQUIRED_REPLAY_COVERAGE 112 original PR799 accepts; 118 enforced rejections; valid historical and selected replays accepted.

Validation on Windows CPython 3.11.9: full mutation matrix, actual public CLI witness/rejection, pre-launch reuse rejection, 3 contract tests and 6 existing binding tests, isolated optimized checking, minimal offline relocation, source/version corruption controls, and publication against real archived evidence pass. A fresh PR799 native/global run passes all 95 endpoint controls, all 2949 phase edges, wrappers, owner/invoice/assembly, independent local and independent-price checks. It explicitly reuses complete source-bound archived PR741 ancestry; it is not a fresh bit/SW4 reconstruction. Final coverage/publication functions were rechecked on the real fresh output after the output-layout hardening. FRESH-REPLAY.json retains the stages and binding. Selected-record integrity and Make recipe/YAML checks pass.

make verify stopped in an unchanged historical test: eleven optimized-entrypoint subprocess checks in test_recycled_bit_integration.py exceeded their ten-second timeout under Ubuntu WSL. Earlier long historical producer checks passed; the aggregate stopped at verify-recycled-bit. No repository-wide or hosted-CI pass is claimed. The initial isolated historical-CLI import failure and corrected successful replay are documented. Input archives/checkers are pinned at base f567884aeb8851b6e794af1184119a3bfbe1e631; no selected certificate, construction source or upstream/ byte changes.

Credit Lucas's #838, Chinmay's concurrent #847, Douglas Colkitt's reviewed checkers/replays, Chafik Boukhalfa's #741, the #799 construction, DreamingOfClouds/eumemic's #589/#555 lineage and retained predecessors. Prepared for nightangelflowerwin-ops with substantial OpenAI Codex assistance, under Apache-2.0. This enforces evidence coverage, not execution authentication or a full multiplication theorem; inherited compiler/realization/hosting/precision/tape/analytic assumptions remain.