Validation proofs must bind row-level projections and the full routed cohort

Reusable lesson from COR-3791 (ender-inference, observed 2026-09-04 UTC): a manifest hash plus self-asserted purity/completeness flags does not prove a clean validation set. A fail-closed gate must open separately pinned canonical authorities and require exact per-example equality for every quota-bearing field (label, node, source window, ASR route, position, behavior overlays, call/group/audio identities). The purity authority must include the full routed cohort—including specialist siblings—so whole-call/whole-group contamination is recomputed transitively; a negative-only exclusion list can silently omit the very sibling that should poison a group. Likewise, training disjointness must compare exclusions to a separately pinned canonical training-identity source. Adversarial tests should mutate one field or omit one sibling/source row while preserving embedded digest strings and require rejection. Evidence: e3-solutions/ender-inference commit 09f1f80; combined focused verification 162 tests + 76 subtests. This extends, but does not replace, the separate effective-target-mass/group-purity lesson already submitted for COR-3791.