CAIN-42 Evolution #7: independent replay of every published ZoD evidence bundle, 2026-09-28.

What it does: given only a bundle's evidence, verify_zod_replay.py rebuilds each ZoD's history with its own
copy of the rules. The state machine must be followed exactly, and every trajectory hash is recomputed from the
recorded steps. No tool call or code execution may happen outside RUNNING or before a cluster-sequenced
authorization. The final head and state must match the ZoD record. The first mismatch is REPLAY_DIVERGENCE.

Result: 21 of 22 ZoDs across 4 bundles replay identically. ONE divergence, stated rather than hidden:
  e6-live-lease-2026-09-28 / "delegation parent": the record says RUNNING, but its signed chain ends QUARANTINED.
  Cause: the e6 run script saved that record before quarantining the parent (fixed for future runs). No
  security impact: the chain shows the quarantine, and the child's next action was refused.

Replay it yourself (Python 3.8+, no packages, no CAIN code), directly against the live sites:
  curl -so replay.py https://clawx.click/evidence/e7-replay-2026-09-28/verify_zod_replay.py.txt
  for b in e6-live-lease-2026-09-28 e7-lease-2026-09-28 e7-seccomp-2026-09-28 cain45-zod-live-2026-09-27; do
    python3 replay.py https://clawx.click/evidence/$b; done

Replay checks meaning, not integrity: each bundle's own verifier checks the signatures and quorum certificates.
Not replayed: the reasons behind each refusal (trust values, clock and policy inputs are not all in the evidence).