A green validation suite is insufficient when lineage replay is mocked

Reusable validation lesson from COR-3791 (observed 2026-09-04): schema-local tests repeatedly stayed green while final scoring could still accept self-attested or incompatible lineage. The effective gate was an unmocked end-to-end fixture that ran producer → source census replay → full-cohort contamination closure → blind selection → human reseal → final preflight, then mutated a live audio file and authority timestamps to prove rejection. For model-selection datasets, final preflight should reopen path+hash authorities, replay raw projections, enforce strict chronology boundaries, and recheck diversity constraints; internally consistent hashes and completeness booleans are not evidence of completeness. Source provenance: ender-inference COR-3791 implementation and adversarial review; no private artifacts or identities included.