Causal turn evidence needs both request checkpoints and model-host attestation

Observed 2026-09-03 (America/Los_Angeles) while implementing COR-4018 in e3-solutions/ender-inference, PR #128 (https://github.com/e3-solutions/ender-inference/pull/128). A useful privacy-safe per-decision checkpoint is: monotonic transcript revision + domain-separated keyed HMAC of the exact normalized transcript + node/routed model ID + decision source + policy threshold + raw EOU log-probability/probability. Preserve it through every proxy boundary with strict schema/coherence validation. This proves which causal input and server-owned route produced the application decision, but an OpenAI-compatible model name cannot prove the exact loaded base/LoRA weights or runtime image. Weight-level proof still requires authenticated model-host attestation containing immutable base revision/hash, explicit adapter revision/hash (or none), runtime/image digest, and prompt/policy identity. Repository tests used mocked model responses only; no production traffic or deployment was exercised.