From 3f657c26151871d8082a7a3d507e378ae4f3d79d Mon Sep 17 00:00:00 2001
From: Dennis <122734610+antunishdPursuit@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:13:45 -0400
Subject: [PATCH 1/7] fix: authenticate the accepted spectrum source pin
 refresh

---
 scripts/verify_pr_reconciliation.py | 34 ++++++++++++++-
 tests/test_pr_reconciliation.py     | 65 +++++++++++++++++++++++++++++
 2 files changed, 97 insertions(+), 2 deletions(-)

diff --git a/scripts/verify_pr_reconciliation.py b/scripts/verify_pr_reconciliation.py
index de2a019067..6a4d3a09c0 100644
--- a/scripts/verify_pr_reconciliation.py
+++ b/scripts/verify_pr_reconciliation.py
@@ -33,6 +33,37 @@ def check_batch1047_file(item):
     require(original.endswith(b'\n') and current.startswith(original), 'Historical Makefile content changed')
 
 
+def check_frontier890_file(item):
+    """Authenticate the exact spectrum pin refresh accepted in 02c46c7e.
+
+    Preserve the frozen frontier890 receipt. Sagar Thakrar's refresh changed
+    only the single_intersection.py source digest in SOURCE.json and RESULT.json;
+    every other byte, including all 41 mathematical cases, must still match.
+    Dennis with substantial OpenAI Codex assistance; Apache-2.0.
+    """
+    name = item['integrated_path']
+    current = (ROOT / name).read_bytes()
+    if hashlib.sha256(current).hexdigest() == item['integrated_sha256']:
+        return
+    predecessors = {
+        'research/single-intersection-spectrum-audit/RESULT.json':
+            '9cb2210e148b2cce3fe59cf529fbf99f3b663dc7673db2e3969246595692f580',
+        'research/single-intersection-spectrum-audit/SOURCE.json':
+            '610fb9887add31b4f597a39dc58b3beff0e14c91a5fd7ee340c3b2e7d4b0fb4c',
+    }
+    require(name in predecessors and item['integrated_sha256'] == predecessors[name],
+            'Changed integrated file: ' + name)
+    old = b'08ddae46e5621a5b4c525b504e67ae655abe9b49461d894feaa7abc89a51847d'
+    new = b'6874d41b75590369182ed61e0c6da5b547e035e0e43b50ea2b39e1f3861dca6d'
+    source = 'scripts/experiments/single_intersection.py'
+    require(hashlib.sha256((ROOT / source).read_bytes()).hexdigest().encode() == new,
+            'Changed spectrum successor source')
+    require(json.loads(current)['source_sha256'][source].encode() == new
+            and current.count(new) == 1, 'Changed spectrum source pin')
+    require(hashlib.sha256(current.replace(new, old)).hexdigest() == predecessors[name],
+            'Changed spectrum evidence beyond the accepted source pin')
+
+
 def check_family_decision(item, decision):
     """Bind projected ledger state to its authoritative, pinned family decision."""
     fields = ('number', 'reviewed_head', 'current_head', 'disposition',
@@ -416,8 +447,7 @@ def main():
                 if item['action'] == 'pending':
                     require(not decision['review_completion']['changed_file_coverage'], 'Incomplete review')
                 if item.get('integrated_sha256'):
-                    require(hashlib.sha256((ROOT / item['integrated_path']).read_bytes()).hexdigest()
-                            == item['integrated_sha256'], 'Changed integrated file: ' + item['integrated_path'])
+                    check_frontier890_file(item)
                 if item['action'] != 'retained':
                     require(bool(item.get('reason')), 'Missing scope or adaptation reason')
         print('PASS frontier890 batch: reviewed sources, finite replays, scoped claims and closure bindings')
diff --git a/tests/test_pr_reconciliation.py b/tests/test_pr_reconciliation.py
index db6b7a2ac2..1971754add 100644
--- a/tests/test_pr_reconciliation.py
+++ b/tests/test_pr_reconciliation.py
@@ -121,6 +121,71 @@ def read_text(path, *args, **kwargs):
             checker.main()
 
 
+class SpectrumRefresh(unittest.TestCase):
+    def setUp(self):
+        coverage = json.loads((ROOT / 'research/community-frontier890-audit/CONTENT-COVERAGE.json').read_bytes())
+        self.items = [deepcopy(item) for row in coverage['pull_requests'].values()
+                      for item in row['files'] if item.get('integrated_path') in {
+                          'research/single-intersection-spectrum-audit/RESULT.json',
+                          'research/single-intersection-spectrum-audit/SOURCE.json'}]
+        self.old = b'08ddae46e5621a5b4c525b504e67ae655abe9b49461d894feaa7abc89a51847d'
+        self.new = b'6874d41b75590369182ed61e0c6da5b547e035e0e43b50ea2b39e1f3861dca6d'
+
+    def test_exact_accepted_refresh_and_original_bytes_pass(self):
+        self.assertEqual(len(self.items), 2)
+        for item in self.items:
+            checker.check_frontier890_file(item)
+            current = (ROOT / item['integrated_path']).read_bytes()
+            original = current.replace(self.new, self.old)
+            self.assertEqual(sha256(original).hexdigest(), item['integrated_sha256'])
+            with patch.object(Path, 'read_bytes', return_value=original):
+                checker.check_frontier890_file(item)
+
+    def test_any_other_proof_or_metadata_edit_is_rejected(self):
+        for item in self.items:
+            current = (ROOT / item['integrated_path']).read_bytes()
+            for mutated in (current.replace(b'"assignment_seed": 65', b'"assignment_seed": 66'),
+                            current + b' ', current.replace(self.new, b'0' * 64),
+                            current + self.new):
+                self.assertNotEqual(mutated, current)
+                original_read = Path.read_bytes
+                def read(path):
+                    return mutated if path == ROOT / item['integrated_path'] else original_read(path)
+                with patch.object(Path, 'read_bytes', read), self.assertRaises(ValueError):
+                    checker.check_frontier890_file(item)
+
+    def test_changed_mathematical_case_is_rejected(self):
+        item = next(item for item in self.items if item['integrated_path'].endswith('RESULT.json'))
+        current = (ROOT / item['integrated_path']).read_bytes()
+        mutated = current.replace(b'"binary_rank": 3,', b'"binary_rank": 4,', 1)
+        self.assertNotEqual(current, mutated)
+        original_read = Path.read_bytes
+        def read(path):
+            return mutated if path == ROOT / item['integrated_path'] else original_read(path)
+        with patch.object(Path, 'read_bytes', read), self.assertRaisesRegex(ValueError, 'beyond'):
+            checker.check_frontier890_file(item)
+
+    def test_forged_historical_pin_is_rejected(self):
+        for item in self.items:
+            item['integrated_sha256'] = '0' * 64
+            with self.assertRaisesRegex(ValueError, 'Changed integrated file'):
+                checker.check_frontier890_file(item)
+
+    def test_successor_helper_drift_is_rejected(self):
+        original_read = Path.read_bytes
+        def read(path):
+            return b'changed helper' if path == ROOT / 'scripts/experiments/single_intersection.py' else original_read(path)
+        with patch.object(Path, 'read_bytes', read):
+            for item in self.items:
+                with self.assertRaisesRegex(ValueError, 'Changed spectrum successor source'):
+                    checker.check_frontier890_file(item)
+
+    def test_unrelated_file_changes_still_fail(self):
+        item = {'integrated_path': 'CONTRIBUTING.md', 'integrated_sha256': '0' * 64}
+        with self.assertRaisesRegex(ValueError, 'Changed integrated file'):
+            checker.check_frontier890_file(item)
+
+
 class ReviewCompletion(unittest.TestCase):
     def setUp(self):
         self.decision = {

From c58dc836c8993ef09ad0415baede96baf80940a4 Mon Sep 17 00:00:00 2001
From: Dennis <122734610+antunishdPursuit@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:15:55 -0400
Subject: [PATCH 2/7] fix: retain source binding after isolated runner
 assertion safety update

---
 scripts/verify_pr_reconciliation.py | 26 ++++++++++++++++--
 tests/test_pr_reconciliation.py     | 41 +++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 2 deletions(-)

diff --git a/scripts/verify_pr_reconciliation.py b/scripts/verify_pr_reconciliation.py
index 6a4d3a09c0..dc99dec226 100644
--- a/scripts/verify_pr_reconciliation.py
+++ b/scripts/verify_pr_reconciliation.py
@@ -64,6 +64,29 @@ def check_frontier890_file(item):
             'Changed spectrum evidence beyond the accepted source pin')
 
 
+def check_batch932_file(item):
+    """Bind the exact assertion-safety update accepted in 2b7dc6cf.
+
+    Credit woklerx for keeping assertions enabled in child research processes.
+    These two exact successor blobs are an explicit maintenance adaptation,
+    not permission to change any other bytes or the frozen batch932 receipt.
+    """
+    name = item['integrated_path']
+    digest = hashlib.sha256((ROOT / name).read_bytes()).hexdigest()
+    if digest == item['integrated_sha256']:
+        return
+    successors = {
+        'scripts/run_isolated_tests.py': (
+            '96ea543e6c707424afe247e77bd86c82152f90fc76a0773c4232145da5cdf8d1',
+            'b1c645e815a6abfbfdc2d77c4121c543ed0ca958095e97e1181d64e84cac0ed8'),
+        'tests/test_isolated_test_runner.py': (
+            '628391b6abfbc8674ceec1751867a4392f2cc0b5b66886243e139af86cf355ac',
+            '8262f36202e426b849a925123ff789843115d5e564962710c31ab14f84c88067'),
+    }
+    require(name in successors and successors[name] == (item['integrated_sha256'], digest),
+            'Changed integrated file: ' + name)
+
+
 def check_family_decision(item, decision):
     """Bind projected ledger state to its authoritative, pinned family decision."""
     fields = ('number', 'reviewed_head', 'current_head', 'disposition',
@@ -474,8 +497,7 @@ def main():
                 if item['action'] == 'pending':
                     require(not decision['review_completion']['changed_file_coverage'], 'Incomplete review')
                 if item.get('integrated_sha256'):
-                    require(hashlib.sha256((ROOT / item['integrated_path']).read_bytes()).hexdigest()
-                            == item['integrated_sha256'], 'Changed integrated file: ' + item['integrated_path'])
+                    check_batch932_file(item)
                 if item['action'] != 'retained':
                     require(bool(item.get('reason')), 'Missing scope or adaptation reason')
         print('PASS batch932 batch: reviewed sources, finite replays, scoped claims and closure bindings')
diff --git a/tests/test_pr_reconciliation.py b/tests/test_pr_reconciliation.py
index 1971754add..87f5027edb 100644
--- a/tests/test_pr_reconciliation.py
+++ b/tests/test_pr_reconciliation.py
@@ -186,6 +186,47 @@ def test_unrelated_file_changes_still_fail(self):
             checker.check_frontier890_file(item)
 
 
+class AssertionSafetyRefresh(unittest.TestCase):
+    def setUp(self):
+        coverage = json.loads((ROOT / 'research/community-batch932-audit/CONTENT-COVERAGE.json').read_bytes())
+        self.items = [deepcopy(item) for row in coverage['pull_requests'].values()
+                      for item in row['files'] if item.get('integrated_path') in {
+                          'scripts/run_isolated_tests.py', 'tests/test_isolated_test_runner.py'}]
+
+    def test_exact_accepted_successors_pass(self):
+        self.assertEqual(len(self.items), 2)
+        for item in self.items:
+            checker.check_batch932_file(item)
+
+    def test_assertion_guard_removal_and_other_byte_edits_fail(self):
+        original_read = Path.read_bytes
+        for item in self.items:
+            current = (ROOT / item['integrated_path']).read_bytes()
+            mutations = [current + b' ']
+            if item['integrated_path'].startswith('scripts/'):
+                mutations.append(current.replace(b"env.pop('PYTHONOPTIMIZE', None)", b'pass'))
+            for mutated in mutations:
+                self.assertNotEqual(current, mutated)
+                def read(path):
+                    return mutated if path == ROOT / item['integrated_path'] else original_read(path)
+                with patch.object(Path, 'read_bytes', read), self.assertRaises(ValueError):
+                    checker.check_batch932_file(item)
+
+    def test_forged_predecessor_and_cross_file_successor_fail(self):
+        for item in self.items:
+            item['integrated_sha256'] = '0' * 64
+            with self.assertRaises(ValueError):
+                checker.check_batch932_file(item)
+        other = (ROOT / self.items[1]['integrated_path']).read_bytes()
+        with patch.object(Path, 'read_bytes', return_value=other), self.assertRaises(ValueError):
+            checker.check_batch932_file(self.items[0])
+
+    def test_unrelated_file_still_needs_exact_bytes(self):
+        item = {'integrated_path': 'CONTRIBUTING.md', 'integrated_sha256': '0' * 64}
+        with self.assertRaises(ValueError):
+            checker.check_batch932_file(item)
+
+
 class ReviewCompletion(unittest.TestCase):
     def setUp(self):
         self.decision = {

From 7ef00f0692774daeea6e369f142dc398775de46b Mon Sep 17 00:00:00 2001
From: Dennis <122734610+antunishdPursuit@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:18:39 -0400
Subject: [PATCH 3/7] fix: use authenticated reconciliation replay in the
 aggregate audit

---
 .github/workflows/community-tooling799.yml | 9 +++++++++
 scripts/verify_pr_reconciliation.py        | 7 ++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/community-tooling799.yml b/.github/workflows/community-tooling799.yml
index 2fed4190c8..dbedc44d9a 100644
--- a/.github/workflows/community-tooling799.yml
+++ b/.github/workflows/community-tooling799.yml
@@ -11,6 +11,10 @@ on:
       - 'research/sw4-owner-optimality/**'
       - 'research/pr695-digest-audit/**'
       - 'scripts/verify_pr_reconciliation.py'
+      - 'scripts/replay_historical_check.py'
+      - 'scripts/historical-ci-inputs/**'
+      - 'tests/test_pr_reconciliation.py'
+      - 'tests/test_historical_check.py'
       - 'tests/test_reconciliation_archive.py'
       - '.github/workflows/community-tooling799.yml'
   pull_request:
@@ -22,6 +26,10 @@ on:
       - 'research/sw4-owner-optimality/**'
       - 'research/pr695-digest-audit/**'
       - 'scripts/verify_pr_reconciliation.py'
+      - 'scripts/replay_historical_check.py'
+      - 'scripts/historical-ci-inputs/**'
+      - 'tests/test_pr_reconciliation.py'
+      - 'tests/test_historical_check.py'
       - 'tests/test_reconciliation_archive.py'
       - '.github/workflows/community-tooling799.yml'
 permissions:
@@ -53,6 +61,7 @@ jobs:
       - name: Current ledger and archive integrity controls
         run: |
           python -B scripts/verify_pr_reconciliation.py
+          python -B -m unittest discover -s tests -p 'test_historical_check.py' -v
           python -B -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
           python -B -O -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
       - run: git diff --exit-code
diff --git a/scripts/verify_pr_reconciliation.py b/scripts/verify_pr_reconciliation.py
index dc99dec226..483117fffd 100644
--- a/scripts/verify_pr_reconciliation.py
+++ b/scripts/verify_pr_reconciliation.py
@@ -8,6 +8,8 @@
 import tempfile
 import json
 import zipfile
+import subprocess
+import sys
 
 ROOT = Path(__file__).resolve().parents[1]
 AUDIT = ROOT / 'research/pr-reconciliation-20261012'
@@ -625,7 +627,10 @@ def main():
         runpy.run_path(str(historical_five), run_name='__main__')
     reconciliation92 = ROOT / 'research/community-reconciliation92-audit/verify.py'
     if reconciliation92.exists():
-        runpy.run_path(str(reconciliation92), run_name='__main__')
+        # The original checker binds the pre-PR154 Makefile. Reuse the
+        # authenticated isolated replay rather than weakening that pin.
+        subprocess.run([sys.executable, '-B', str(ROOT / 'scripts/replay_historical_check.py'),
+                        'reconciliation92'], cwd=ROOT, check=True)
     third100 = ROOT / 'research/community-reconciliation-third100-audit/verify.py'
     if third100.exists():
         runpy.run_path(str(third100), run_name='__main__')

From 7428274cc7b4a9d9b8bc89a8cd118e1d728d726f Mon Sep 17 00:00:00 2001
From: Dennis <122734610+antunishdPursuit@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:20:45 -0400
Subject: [PATCH 4/7] ci: run scoped reconciliation checks on contributor
 branches

---
 .github/workflows/community-tooling799.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/community-tooling799.yml b/.github/workflows/community-tooling799.yml
index dbedc44d9a..b0e57b08cf 100644
--- a/.github/workflows/community-tooling799.yml
+++ b/.github/workflows/community-tooling799.yml
@@ -1,8 +1,8 @@
 name: Community exact tooling and scoped audits
 on:
   workflow_dispatch:
+  # Keep these path-scoped checks available on contributor fork branches.
   push:
-    branches: [main]
     paths:
       - 'research/clifford-state-performance/**'
       - 'research/gram-prefix-performance/**'

From c58c177852c4e146bad711f8f211a6b005ed76d3 Mon Sep 17 00:00:00 2001
From: Dennys <122734610+antunishdPursuit@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:16:00 -0400
Subject: [PATCH 5/7] fix: replay frozen skip-clone checks with authenticated
 PR53 source

Keep the PR53 SOURCE.json, original acceptance suite, frozen certificate,
producer, selected frontier and updated live exclusion circuit unchanged.
Run both the clones CI group and the affected isolated unittest module in
temporary tracked-file snapshots with the exact predecessor script retained
in research/exclusion-embedding-masks/baseline.py, preserving all other live
inputs. Permit only the historically pinned byte hash or Wentao Li's exact
reviewed support-mask successor; reject unrelated source drift and corrupted
baseline bytes in negative controls. Retain all existing CI diff gates.

Predecessors: PR53 skip-clones by Chafik Boukhalfa and collaborators;
Wentao Li's accepted ExclusionCircuit support-mask optimizations #2001.
Prepared by Dennis (antunishdPursuit) with substantial OpenAI Codex
assistance. Apache-2.0; no new mathematical acceptance claim.
---
 .github/workflows/verify.yml       |  3 ++-
 scripts/replay_historical_check.py | 36 +++++++++++++++++++++++++++++-
 scripts/run_isolated_tests.py      | 16 +++++++++++--
 tests/test_historical_check.py     | 29 ++++++++++++++++++++++++
 tests/test_isolated_test_runner.py |  8 +++++++
 5 files changed, 88 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 4446616e87..0b88bd2639 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -37,7 +37,8 @@ jobs:
       - name: Check arithmetic, source hashes, finite identities, and patches
         run: |
           if [ "${{ matrix.group }}" = clones ]; then
-            make skip-clones-verify split-skip-producer
+            python -B scripts/replay_historical_check.py skip-clones
+            make split-skip-producer
             python -B scripts/replay_historical_check.py split-skip
           else
             make verify-${{ matrix.group }}
diff --git a/scripts/replay_historical_check.py b/scripts/replay_historical_check.py
index ef23ca1a13..0a04783d8b 100644
--- a/scripts/replay_historical_check.py
+++ b/scripts/replay_historical_check.py
@@ -48,6 +48,34 @@
 }
 
 
+# Keep PR53's frozen source pin intact while replaying against the reviewed
+# successor of the faster exclusion support-mask checker. Original exact bytes
+# are retained by the linked baseline package (Wentao Li / VictorLiwentao).
+# Dennis with substantial OpenAI Codex assistance; Apache-2.0.
+CONFIG['skip-clones'] = {
+    'manifest': 'research/skip-clones/SOURCE.json',
+    'field': 'files',
+    'path': 'scripts/exclusion_circuit.py',
+    'input_from_root': True,
+    'input': 'research/exclusion-embedding-masks/baseline.py',
+    'sha256': 'b253f9d7318becda1c1f3b24e2287ed44a9c27fcea00cf9d531afb950d0457a0',
+    'accepted_live_sha256': [
+        'f9fbcd6e85e442cbd0926ac0887414e20735b2dc923d2d5822c803ceb46726d3',
+    ],
+    'commands': [
+        ['research/skip-clones/producer.py'],
+        ['research/skip-clones/witness.py', '--output',
+         'research/skip-clones/certificate.json'],
+        ['-m', 'unittest', 'discover', '-s', 'tests',
+         '-p', 'test_skip_clones.py', '-v'],
+    ],
+}
+CONFIG['skip-clones-tests'] = {
+    **CONFIG['skip-clones'],
+    'commands': [CONFIG['skip-clones']['commands'][-1]],
+}
+
+
 def require(condition, message):
     if not condition:
         raise ValueError(message)
@@ -67,7 +95,13 @@ def authenticated_input(root, config, inputs=INPUTS):
         require(entry.get('representation') == 'bytes', 'Expected exact byte representation')
         entry = entry.get('sha256')
     require(entry == config['sha256'], 'Missing or changed predecessor source pin')
-    data = safe_path(inputs, config['input']).read_bytes()
+    # A replay must not hide an unrelated live source mutation.
+    if 'accepted_live_sha256' in config:
+        live = hashlib.sha256(safe_path(root, config['path']).read_bytes()).hexdigest()
+        require(live in (config['sha256'], *config['accepted_live_sha256']),
+                'Unrecognized live source update: ' + config['path'])
+    input_root = root if config.get('input_from_root') else inputs
+    data = safe_path(input_root, config['input']).read_bytes()
     require(hashlib.sha256(data).hexdigest() == entry, 'Changed historical input')
     if config.get('preserve_prefix'):
         require(data.endswith(b'\n') and safe_path(root, config['path']).read_bytes().startswith(data),
diff --git a/scripts/run_isolated_tests.py b/scripts/run_isolated_tests.py
index d95ff0740d..e923a69198 100644
--- a/scripts/run_isolated_tests.py
+++ b/scripts/run_isolated_tests.py
@@ -10,6 +10,8 @@
 --workers controls the width). Every module keeps the exact sequential
 command and its captured stdout/stderr bytes are replayed in sorted module
 order, so the combined receipts match a sequential run module for module.
+For PR53 skip-clones, the unchanged module command runs in a temporary
+copy with its authenticated frozen source instead of the optimized successor.
 """
 import argparse
 from concurrent.futures import ThreadPoolExecutor
@@ -22,7 +24,7 @@
 
 
 def module_command(python, tests_dir, name):
-    """The one command every module runs, unchanged from the sequential runner."""
+    """Default unchanged command for a test module."""
     return [python, '-m', 'unittest', 'discover', '-s', str(tests_dir), '-p', name, '-v']
 
 
@@ -45,7 +47,17 @@ def run_modules(files, python=None, tests_dir=None, cwd=None, workers=None):
     env.pop('PYTHONOPTIMIZE', None)
 
     def run_one(path):
-        result = subprocess.run(module_command(python, tests_dir, path.name),
+        command = module_command(python, tests_dir, path.name)
+        # Run this frozen package's original tests in its authenticated overlay.
+        # Other test modules continue to exercise the live checkout unchanged.
+        if (path.name == 'test_skip_clones.py'
+                and Path(tests_dir).resolve() == (ROOT / 'tests').resolve()
+                and Path(cwd).resolve() == ROOT.resolve()
+                and (ROOT / 'research/skip-clones/SOURCE.json').is_file()
+                and (ROOT / 'scripts/replay_historical_check.py').is_file()):
+            command = [python, '-B', str(ROOT / 'scripts/replay_historical_check.py'),
+                       'skip-clones-tests']
+        result = subprocess.run(command,
                                 cwd=cwd, env=env,
                                 stdout=subprocess.PIPE, stderr=subprocess.PIPE)
         return path, result.returncode, result.stdout, result.stderr
diff --git a/tests/test_historical_check.py b/tests/test_historical_check.py
index cc4921d825..dccb7bb711 100644
--- a/tests/test_historical_check.py
+++ b/tests/test_historical_check.py
@@ -90,6 +90,35 @@ def test_makefile_append_is_allowed_but_original_prefix_mutation_rejects(self):
             with self.assertRaisesRegex(ValueError, 'prefix changed'):
                 checker.authenticated_input(root, config, inputs)
 
+    def test_skip_clone_frozen_source_replay_binding(self):
+        config = checker.CONFIG['skip-clones']
+        predecessor = (ROOT / config['input']).read_bytes()
+        pins = json.loads((ROOT / config['manifest']).read_bytes())
+        self.assertEqual(hashlib.sha256(predecessor).hexdigest(), config['sha256'])
+        self.assertEqual(pins['files'][config['path']], config['sha256'])
+        self.assertEqual(checker.authenticated_input(ROOT, config), predecessor)
+        suite = checker.CONFIG['skip-clones-tests']
+        self.assertEqual(suite['sha256'], config['sha256'])
+        self.assertEqual(suite['commands'], config['commands'][-1:])
+
+    def test_skip_clone_overlay_rejects_unknown_live_and_corrupt_baseline(self):
+        with tempfile.TemporaryDirectory() as td:
+            root, inputs, config, paths = self.fixture(td)
+            original = (inputs / 'old.txt').read_bytes()
+            (root / 'baseline.txt').write_bytes(original)
+            current = hashlib.sha256((root / 'input.txt').read_bytes()).hexdigest()
+            config.update(input='baseline.txt', input_from_root=True,
+                          accepted_live_sha256=[current])
+            self.assertEqual(checker.authenticated_input(root, config, inputs), original)
+            (root / 'input.txt').write_bytes(b'unreviewed source edit\\n')
+            with self.assertRaisesRegex(ValueError, 'Unrecognized live source update'):
+                checker.authenticated_input(root, config, inputs)
+            (root / 'input.txt').write_bytes(original)
+            self.assertEqual(checker.authenticated_input(root, config, inputs), original)
+            (root / 'baseline.txt').write_bytes(b'changed frozen evidence\\n')
+            with self.assertRaisesRegex(ValueError, 'Changed historical input'):
+                checker.authenticated_input(root, config, inputs)
+
     def test_real_snapshots_match_unchanged_predecessor_pins(self):
         for name, config in checker.CONFIG.items():
             with self.subTest(package=name):
diff --git a/tests/test_isolated_test_runner.py b/tests/test_isolated_test_runner.py
index 18ff944711..d1fae1fdee 100644
--- a/tests/test_isolated_test_runner.py
+++ b/tests/test_isolated_test_runner.py
@@ -131,6 +131,14 @@ def test_default_invocation_keeps_receipt_and_summary(self):
         self.assertFalse(any(line.startswith('PASS all') for line in lines))
         self.assertIn('Failed modules: test_b_fail.py', result.stderr.decode())
 
+    def test_same_named_synthetic_clone_test_still_fails(self):
+        # A name alone must not trigger the production historical overlay.
+        box = self.sandbox({'test_skip_clones.py': FAIL_MODULE})
+        result = box.run('--workers', '1')
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn('deliberate negative control', result.stderr.decode())
+        self.assertIn('Failed modules: test_skip_clones.py', result.stderr.decode())
+
     def test_inherited_optimization_cannot_hide_verifier_assertions(self):
         # Research tests call verifiers that still use Python assert. The
         # outer runner itself may be optimized, but its checks must not be.

From 72f071327f8417ee41a5ec942299a5ab8799b27f Mon Sep 17 00:00:00 2001
From: Dennis <122734610+antunishdPursuit@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:51:09 -0400
Subject: [PATCH 6/7] fix: bind the historical clone runner extension to its
 exact sources

---
 scripts/verify_pr_reconciliation.py | 13 +++++++++----
 tests/test_pr_reconciliation.py     | 11 +++++++++++
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/scripts/verify_pr_reconciliation.py b/scripts/verify_pr_reconciliation.py
index 483117fffd..d0a73966d1 100644
--- a/scripts/verify_pr_reconciliation.py
+++ b/scripts/verify_pr_reconciliation.py
@@ -67,11 +67,13 @@ def check_frontier890_file(item):
 
 
 def check_batch932_file(item):
-    """Bind the exact assertion-safety update accepted in 2b7dc6cf.
+    """Bind exact assertion-safety and historical replay runner successors.
 
     Credit woklerx for keeping assertions enabled in child research processes.
     These two exact successor blobs are an explicit maintenance adaptation,
     not permission to change any other bytes or the frozen batch932 receipt.
+    Also authenticate the exact PR53 replay adapter and its test from c58c1778;
+    this extension retains the earlier assertion guard and every module.
     """
     name = item['integrated_path']
     digest = hashlib.sha256((ROOT / name).read_bytes()).hexdigest()
@@ -80,12 +82,15 @@ def check_batch932_file(item):
     successors = {
         'scripts/run_isolated_tests.py': (
             '96ea543e6c707424afe247e77bd86c82152f90fc76a0773c4232145da5cdf8d1',
-            'b1c645e815a6abfbfdc2d77c4121c543ed0ca958095e97e1181d64e84cac0ed8'),
+            ('b1c645e815a6abfbfdc2d77c4121c543ed0ca958095e97e1181d64e84cac0ed8',
+             '05839996482058359b2ab8087d7d96e76934bd03d79981df9b99447e8ed09331')),
         'tests/test_isolated_test_runner.py': (
             '628391b6abfbc8674ceec1751867a4392f2cc0b5b66886243e139af86cf355ac',
-            '8262f36202e426b849a925123ff789843115d5e564962710c31ab14f84c88067'),
+            ('8262f36202e426b849a925123ff789843115d5e564962710c31ab14f84c88067',
+             '6f5ad20a5f174be0aab874cf524cba01c5401dafa46dd176999bad43ab566522')),
     }
-    require(name in successors and successors[name] == (item['integrated_sha256'], digest),
+    require(name in successors and successors[name][0] == item['integrated_sha256']
+            and digest in successors[name][1],
             'Changed integrated file: ' + name)
 
 
diff --git a/tests/test_pr_reconciliation.py b/tests/test_pr_reconciliation.py
index 87f5027edb..91fe99956e 100644
--- a/tests/test_pr_reconciliation.py
+++ b/tests/test_pr_reconciliation.py
@@ -198,6 +198,17 @@ def test_exact_accepted_successors_pass(self):
         for item in self.items:
             checker.check_batch932_file(item)
 
+    def test_historical_adapter_cannot_be_disabled(self):
+        item = next(item for item in self.items if item['integrated_path'].startswith('scripts/'))
+        current = (ROOT / item['integrated_path']).read_bytes()
+        mutated = current.replace(b"path.name == 'test_skip_clones.py'", b'False')
+        self.assertNotEqual(current, mutated)
+        original_read = Path.read_bytes
+        def read(path):
+            return mutated if path == ROOT / item['integrated_path'] else original_read(path)
+        with patch.object(Path, 'read_bytes', read), self.assertRaises(ValueError):
+            checker.check_batch932_file(item)
+
     def test_assertion_guard_removal_and_other_byte_edits_fail(self):
         original_read = Path.read_bytes
         for item in self.items:

From 92276c22f6f419bbefd870bf2bb373bc41b0c643 Mon Sep 17 00:00:00 2001
From: Dennis <122734610+antunishdPursuit@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:53:25 -0400
Subject: [PATCH 7/7] fix: authenticate every frozen split-skip helper in
 isolated replays

---
 scripts/historical-ci-inputs/README.md | 12 ++++-
 scripts/replay_historical_check.py     | 42 +++++++++++++++---
 tests/test_historical_check.py         | 61 ++++++++++++++++++++++++++
 3 files changed, 107 insertions(+), 8 deletions(-)

diff --git a/scripts/historical-ci-inputs/README.md b/scripts/historical-ci-inputs/README.md
index c438694334..60fc82c1e2 100644
--- a/scripts/historical-ci-inputs/README.md
+++ b/scripts/historical-ci-inputs/README.md
@@ -3,7 +3,7 @@
 These are exact Git blobs, not new source pins or changes to the selected result.
 The maintenance launcher `scripts/replay_historical_check.py` verifies each blob
 against its unchanged predecessor manifest, copies tracked working files into a
-temporary tree, replaces just the declared historical input there, and executes
+temporary tree, replaces only the declared historical inputs there, and executes
 the original checkers. It works with shallow CI checkouts and changes no live
 source file. The live Makefile must still preserve its entire authenticated
 historical prefix; appended targets are allowed, prefix mutations reject. All other inputs remain the current tracked working
@@ -19,6 +19,16 @@ reproducibility gate as well as protecting the live checkout.
 | `Makefile` | `Makefile` | `b84ba67156a01f9c2cb34fe1e3cb1dcdeab00d9c` | `research/community-reconciliation92-audit/MANIFEST.json` |
 | `audit_fused_block.py` | `scripts/audit_fused_block.py` | `6e564879f51ae16f23d392e9e196c605f36d90df` | `research/split-skip/SOURCE.json` |
 
+The split-skip replay restores all three exact helpers named by its unchanged
+manifest: the fused-block snapshot above, the exclusion circuit preserved in
+`research/exclusion-embedding-masks/baseline.py`, and the shared-point circuit
+preserved in `research/shared-point-digest/baseline.py`. The latter two are
+Wentao Li's retained baselines for the accepted support-mask and digest
+optimizations. Both also match the PR53 parent `3ffd4021995c959ac02d12920e0279ae97dd03c7`.
+Each replacement and reviewed live successor is independently authenticated;
+missing pins, corrupted baselines, duplicate paths, untracked dependencies and
+unknown live source changes reject before copying. No original checker is edited.
+
 Use `python3 -B scripts/replay_historical_check.py r420` (add `--native` for
 C++17/Boost), `reconciliation92`, or `split-skip`. These check historical finite
 constructions/provenance; they do not recertify the current selected supplier or
diff --git a/scripts/replay_historical_check.py b/scripts/replay_historical_check.py
index 0a04783d8b..0f5f964395 100644
--- a/scripts/replay_historical_check.py
+++ b/scripts/replay_historical_check.py
@@ -76,6 +76,25 @@
 }
 
 
+# The split-skip manifest binds three historical helpers. Restore each exact
+# dependency, retaining Wentao Li's two optimized live successors unchanged.
+CONFIG['split-skip']['accepted_live_sha256'] = [
+    '6fe64f886309d9154e33a3d67a16e8714cebc424a7a248b3080f8cab7d94179b',
+]
+CONFIG['split-skip']['additional_inputs'] = [
+    {**CONFIG['skip-clones'], 'manifest': 'research/split-skip/SOURCE.json'},
+    {
+        'manifest': 'research/split-skip/SOURCE.json', 'field': 'files',
+        'path': 'scripts/shared_point_circuit.py', 'input_from_root': True,
+        'input': 'research/shared-point-digest/baseline.py',
+        'sha256': 'c9bb7a5df92d260a4e3ad532b53e26936730d7c93f7facfb0784957c1e81c8ba',
+        'accepted_live_sha256': [
+            'f5abbf6d61f3c10349416a3e1a1ed038bbd1279ed223367f2df549de46dd7ea5',
+        ],
+    },
+]
+
+
 def require(condition, message):
     if not condition:
         raise ValueError(message)
@@ -116,9 +135,16 @@ def tracked_paths(root):
 
 def materialize(root, destination, config, paths, inputs=INPUTS):
     """Copy tracked working bytes only; never share writable links with the checkout."""
-    data = authenticated_input(root, config, inputs)
-    require(config['path'] in paths and config['manifest'] in paths,
-            'Historical input or manifest is not tracked')
+    configurations = [config, *config.get('additional_inputs', [])]
+    replacements = {}
+    for entry in configurations:
+        require(entry['path'] not in replacements, 'Duplicate historical replacement')
+        data = authenticated_input(root, entry, inputs)
+        require(entry['path'] in paths and entry['manifest'] in paths,
+                'Historical input or manifest is not tracked')
+        if entry.get('input_from_root'):
+            require(entry['input'] in paths, 'Historical baseline is not tracked')
+        replacements[entry['path']] = data
     require(not destination.exists(), 'Replay destination already exists')
     destination.mkdir(parents=True)
     expected = {}
@@ -129,10 +155,12 @@ def materialize(root, destination, config, paths, inputs=INPUTS):
         target.parent.mkdir(parents=True, exist_ok=True)
         shutil.copyfile(source, target)
         expected[name] = hashlib.sha256(target.read_bytes()).hexdigest()
-    safe_path(destination, config['path']).write_bytes(data)
-    expected[config['path']] = config['sha256']
-    # Authenticate again in the copied tree before executing any checker.
-    authenticated_input(destination, config, inputs)
+    for entry in configurations:
+        safe_path(destination, entry['path']).write_bytes(replacements[entry['path']])
+        expected[entry['path']] = entry['sha256']
+    # Authenticate every replacement again before executing any checker.
+    for entry in configurations:
+        authenticated_input(destination, entry, inputs)
     return expected
 
 
diff --git a/tests/test_historical_check.py b/tests/test_historical_check.py
index dccb7bb711..0f9c8f732d 100644
--- a/tests/test_historical_check.py
+++ b/tests/test_historical_check.py
@@ -119,6 +119,67 @@ def test_skip_clone_overlay_rejects_unknown_live_and_corrupt_baseline(self):
             with self.assertRaisesRegex(ValueError, 'Changed historical input'):
                 checker.authenticated_input(root, config, inputs)
 
+    def multi_fixture(self, temporary):
+        root, inputs, config, paths = self.fixture(temporary)
+        original = b'second historical dependency\n'
+        (inputs / 'second.txt').write_bytes(original)
+        (root / 'second.py').write_bytes(b'current optimized dependency\n')
+        digest = hashlib.sha256(original).hexdigest()
+        pins = json.loads((root / 'manifest.json').read_bytes())
+        pins['files']['second.py'] = digest
+        (root / 'manifest.json').write_text(json.dumps(pins))
+        config['additional_inputs'] = [dict(
+            manifest='manifest.json', field='files', path='second.py',
+            input='second.txt', sha256=digest)]
+        return root, inputs, config, paths + ['second.py']
+
+    def test_multiple_overlays_preserve_live_bytes_and_each_output_gate(self):
+        with tempfile.TemporaryDirectory() as td:
+            root, inputs, config, paths = self.multi_fixture(td)
+            before = {name: (root / name).read_bytes() for name in paths}
+            target = Path(td) / 'copy'
+            expected = checker.materialize(root, target, config, paths, inputs)
+            self.assertEqual((target / 'input.txt').read_bytes(), (inputs / 'old.txt').read_bytes())
+            self.assertEqual((target / 'second.py').read_bytes(), (inputs / 'second.txt').read_bytes())
+            checker.verify_unchanged(target, expected)
+            for name in ('input.txt', 'second.py', 'unrelated.py'):
+                original = (target / name).read_bytes()
+                (target / name).write_bytes(original + b'corruption')
+                with self.subTest(path=name), self.assertRaisesRegex(ValueError, 'Replay changed'):
+                    checker.verify_unchanged(target, expected)
+                (target / name).write_bytes(original)
+            self.assertEqual({name: (root / name).read_bytes() for name in paths}, before)
+
+    def test_corrupt_additional_input_rejects_before_copy(self):
+        with tempfile.TemporaryDirectory() as td:
+            root, inputs, config, paths = self.multi_fixture(td)
+            (inputs / 'second.txt').write_bytes(b'corrupt baseline')
+            target = Path(td) / 'copy'
+            with self.assertRaisesRegex(ValueError, 'Changed historical input'):
+                checker.materialize(root, target, config, paths, inputs)
+            self.assertFalse(target.exists())
+
+    def test_duplicate_and_untracked_dependencies_reject_before_copy(self):
+        with tempfile.TemporaryDirectory() as td:
+            root, inputs, config, paths = self.multi_fixture(td)
+            target = Path(td) / 'copy'
+            with self.assertRaisesRegex(ValueError, 'not tracked'):
+                checker.materialize(root, target, config, paths[:-1], inputs)
+            config['additional_inputs'].append(dict(config['additional_inputs'][0]))
+            with self.assertRaisesRegex(ValueError, 'Duplicate'):
+                checker.materialize(root, target, config, paths, inputs)
+            self.assertFalse(target.exists())
+
+    def test_all_split_skip_dependencies_match_frozen_manifest(self):
+        config = checker.CONFIG['split-skip']
+        entries = [config, *config['additional_inputs']]
+        self.assertEqual({entry['path'] for entry in entries}, {
+            'scripts/audit_fused_block.py', 'scripts/exclusion_circuit.py',
+            'scripts/shared_point_circuit.py'})
+        for entry in entries:
+            with self.subTest(path=entry['path']):
+                checker.authenticated_input(ROOT, entry)
+
     def test_real_snapshots_match_unchanged_predecessor_pins(self):
         for name, config in checker.CONFIG.items():
             with self.subTest(package=name):