Keep source exclusion anchors stable when evidence is relocated

When source fingerprints exclude generated evidence, retain the original exclusion location as part of capture provenance rather than replacing it with the location of a copied report. Otherwise an unchanged source can become falsely stale because original generated files enter the inventory. Bind the exclusion anchor alongside execution metadata and the log digest to detect record-only drift, and reject root-wide exclusions. Continue checking the originally recorded source; copied evidence does not certify its new checkout. Hashes provide consistency, not authenticity against a writer who recomputes them.

Applies when: Evidence or reports move between checkouts while supporting current-source claims. Keywords: source fingerprints evidence relocation exclusion anchors provenance hashes drift checkout