MLB canonical event identity, impossible-binding refusal, event-aware dedupe, publication commit

Release-isolated slice built from 41ba38e. Ships ONLY the event-integrity +
publication + lineage-canary closure; the 90-path development tree stays
undeployed.

- canonical MLB event identity from statsapi gamePk (mlb:gamepk:<pk>), with
  event_identity_source/method/version recorded. The id is canonical; the
  binding is derived and says so.
- IMPOSSIBLE-BINDING REFUSAL. Verified in prod 2026-08-26: Joe Mack (Marlins)
  was bound to Dodgers@Braves and Yandy Diaz (Rays) to Rangers@WhiteSox, both
  from one book in the 01:00/03:01 UTC cycles after their own games began. Root
  cause is source market data, not the binder. A prop whose player's team is not
  an event participant now refuses; unknown team preserves uncertainty.
- event-aware dedupe: books still collapse, events no longer do. An unresolved
  MLB event fractures rather than falling back to the collision-prone
  date+teams key.
- publication commit moved AFTER the authoritative Redis slate write, with
  exact parity-gap identity when the product publishes and the record does not.
- lineage dual-write behind LINEAGE_CANARY_SPORTS, DISABLED for this deploy.

Excluded deliberately: WNBA feed/chain, market ontology, PerformanceDistribution,
calibration certification, truth diagnostics, applyRevision Phase-1, and the
analyzeViaEngine1 confidence-rounding change (a served field).

Suite 380/5,040/0 from this worktree; web tsc exit 0; champion output identical
to production.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQJeAG8vcDoL5zkiaJyVb8

tests/unit/chainShadowAccrual.test.js

@@ -423,7 +423,15 @@ describe('0 LEAKS — measured against the source, not asserted in prose', () =>
   });
 
   it('the ONLY writers are the shadow service, retention and the snapshot', () => {
-    const writers = walk('src').filter((f) => /chain_shadow|chainShadow/.test(read(f)));
+    // The EVALUATOR names the column and must: `gradeFreeze` exists to verify
+    // that the shadow reaches nothing served, and a verifier that cannot say
+    // the name of the thing it verifies is not a verifier. It is excluded from
+    // the writer list and held to the stricter rule below — it may NAME the
+    // column, never assign to it.
+    const EVALUATOR = 'src/services/evaluator/';
+    const writers = walk('src')
+      .filter((f) => /chain_shadow|chainShadow/.test(read(f)))
+      .filter((f) => !f.startsWith(EVALUATOR));
     expect(writers.sort()).toEqual([
       'src/services/model/chainShadow.js',
       'src/services/retentionService.js',
@@ -431,6 +439,18 @@ describe('0 LEAKS — measured against the source, not asserted in prose', () =>
     ]);
   });
 
+
+  it('the evaluator NAMES the shadow column but never assigns to it', () => {
+    // Excluding it above is only safe if this holds. Proven, not assumed.
+    const dir = 'src/services/evaluator/';
+    const files = walk('src').filter((f) => f.startsWith(dir));
+    expect(files.length).toBeGreaterThan(0);
+    for (const f of files) {
+      const src = read(f);
+      expect(src).not.toMatch(/chain_shadow\s*[:=][^=]/);
+      expect(src).not.toMatch(/\.chain_shadow\s*=/);
+    }
+  });
   it('the shadow runs with requireCalibrated FALSE and says so where it is stored', () => {
     expect(read('src/services/model/chainShadow.js')).toMatch(/requireCalibrated:\s*false/);
     expect(cs.SHADOW_VERSION).toBe('chain-shadow@1');