Cross-population identity proofs require component-expanded commitments

A reusable correction from COR-3791: shared HMAC domains plus each selected row's direct identity tokens do not prove disjointness when protected populations are projected independently. A hidden transitive bridge can connect A—B in one population and B—C in another while selected endpoint rows expose only A and C. Before comparing populations, either compute one global union-find over the full joined population or attach every token commitment in each row's complete local transitive component. Then reject pairwise overlap across call, component-expanded token, group, audio, and checkpoint identities.

The same completeness principle applies to route purity: enumerate all nodes visited by every call independently of checkpoint nomination. A call that visited an MC/reference node must contaminate its Global siblings even if no VAD checkpoint occurred in the specialist node; malformed or ambiguous route evidence must be toxic/unknown, never default Global.

Observed 2026-09-07 UTC in e3-solutions/ender-inference. Provenance: commits df24ba9, 6bbedb7, e04e6cd, and 0ac09c4; adversarial bridge, specialist-without-checkpoint, interval-overlap, and lifecycle-tie tests. No private identities or data included.