validation(longitudinal): bind CWC artifacts to the exact cutoff-visible evidence payload #600

Finding

Draft longitudinal_cwc_v1 validated evidence identity for cutoff-visible rows but dropped that identity and the admitted numeric/provenance payload before constructing the digest-bound artifact. LongitudinalCwcArtifact committed only to run/snapshot/cutoff, visible row and cluster counts, the three slope quantities, and the non-causal claim boundary.

That left a reproducibility/provenance collision: two different cutoff-visible evidence populations could use the same accepted run/snapshot/cutoff and produce the same counts and slopes, therefore the same artifact JSON, SHA-256, artifact ID, and terminal result. The minimal public witness changes only one opaque evidence_id while keeping the scientific coordinates identical.

This is separate from #592. #592 prevents a cutoff-visible identity from being replayed as extra weight before estimation; this issue requires the completed artifact to commit to the exact admitted population after that gate. It is also separate from #596: input enumeration order is not part of the estimand, so the payload commitment is canonical/permutation-stable and is not a numerical sorting workaround.

Ordinary-forward RED → repair lineage

• RED da1a846901f54f8500a30ae4a4988289da170916 adds a public feat(analysis): bind CWC within/between slopes to an analysis-run profile #372 contract that executes the same accepted request with identical snapshot, cutoff, cluster assignments, predictor/outcome values, availability times, counts, and recovered slopes but substitutes one cutoff-visible opaque evidence identity. The digest-bound artifact and terminal result must differ. The predecessor implementation cannot satisfy that assertion because it drops evidence identity after admission.
• Causal repair 625a3a4562dbdb3527e3377eabb9231fc374f1b9 adds executor-owned admitted_evidence_sha256 to LongitudinalCwcArtifact. It is computed after availability/snapshot/duplicate admission and before scientific composition from a versioned domain-separated binary encoding of row count, opaque evidence/snapshot IDs, cluster key, exact predictor/outcome binary64 bits, and canonical availability time.
• Fixture migration 676173fac5568f6147d560233aca5c1b9203da8d updates the public artifact regression fixture and keeps malformed/non-lowercase digest import fail-closed.
• Ordering contract d2159307ec8e289fb5c5850c09c05bd668c6429e proves a numerically benign permutation of the same admitted evidence population leaves the full artifact and terminal result unchanged. Canonicalization is by immutable evidence identity only for provenance hashing; estimator inputs are not sorted.
• 988679869a8241ec5a7f932ee9fd1bf3df77dd42 narrows the private digest helper to a mutable slice so the helper does not require Vec ownership and remains compatible with strict Clippy policy.
• ADR currentization 58f021e547da659ab800974bedb83d5e0fb3e5a8 and doctoring 7a7e82f6af661ce07a356538f4507fe1f63ef0e8 record the provenance boundary while ADR 0033 remains Proposed.

Current #372 exact head is 7a7e82f6af661ce07a356538f4507fe1f63ef0e8, stacked on #416 exact 03f8de2ed0a0fb842d2022d411814e440df7cfb4, ahead 45 / behind 0. Hosted Rust Foundation and Documentation Quality runs for this exact head are queued, so this issue remains open and no source-level repair is promoted as exact-head GREEN.

Preserved contracts

• adding only future-unavailable evidence does not change the historical artifact or terminal result;
• visible duplicate evidence fails closed (scientific(analysis): preserve evidence identity in longitudinal CWC composition #592);
• future-only foreign-snapshot rows are excluded before provenance admission (scientific(analysis): exclude future-only cross-snapshot rows before provenance admission #595);
• the pathological numerical permutation contract remains RED under scientific(longitudinal): make CWC cluster means permutation-stable through released binary64 owner #596 until a released fast-mlsirm finite-binary64 mean owner is consumed;
• the raw MAX_EVIDENCE_UNITS admission ceiling and causal-refusal boundary remain unchanged;
• admitted_evidence_sha256 is content/provenance identity only. It does not prove an upstream mapping algorithm, construct validity, or scientific: establish longitudinal CWC recovery acceptance evidence #501 scientific recovery.

Remaining acceptance

Keep #600 open until the unchanged surviving head obtains Rust/rustdoc/package/security/owned line+branch+edge and qualifying independent-review evidence, and until #435 folds the issue/head/module/test trace into canonical TRACEABILITY/product-gap authority without overwriting unrelated history. #501 remains the realistic recovery owner and #596 remains the released-numerical-owner dependency.

No force push, destructive rebase, skip/xfail, tolerance weakening, source rewriting, coverage-denominator manipulation, mutable dependency, numerical sorting workaround, or predecessor-GREEN transfer is authorized.