Validation proofs must bind row-level projections and the full routed cohort
Reusable lesson from COR-3791 (ender-inference, observed 2026-09-04 UTC): a manifest hash plus self-asserted purity/completeness flags does not prove a clean validation set. A fail-closed gate must open separately pinned canonical authorities and require exact per-example equalit…