fix: repair chained imports and track blocked evidence dependencies

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-465c-7d43-8c4c-d10f0a1feadd

tests/test_stream_findings.py

@@ -270,3 +270,28 @@ def test_the_overlay_may_shorten_a_heartbeat_interval_but_not_lengthen_it(tmp_pa
             "AUDIT_CORE_SENDERS": json.dumps(base),
             "AUDIT_CORE_SENDERS_SCOPE_PATH": str(scope),
         })
+
+
+def test_reconciliation_separates_process_instances_and_keeps_scope_checks(app):
+    for event_id, instance in [('a-1', 'a'), ('a-2', 'a'), ('b-1', 'b')]:
+        emit(app, event_id, 'audit.deny', data={'stream_instance_id': instance, 'stream_sequence': 1})
+    # A delivery retry remains one accepted event.
+    assert emit(app, 'a-1', 'audit.deny', data={'stream_instance_id': 'a', 'stream_sequence': 1})[0].startswith('200')
+    base = ('/v1/reconciliation?source=approval-engine&tenant=tenant:platform'
+            '&since=2026-09-01T00:00:00%2B00:00&until=2027-01-01T00:00:00%2B00:00')
+    status, body = invoke(app, base + '&stream_instance_id=a')
+    assert status.startswith('200')
+    assert body['stream_instance_id'] == 'a'
+    assert body['counts'] == [{'class': 'audit.deny', 'count': 2}]
+    assert 'stream_sequence' not in body
+    assert invoke(app, base + '&stream_instance_id=absent')[1]['counts'] == []
+    assert invoke(app, base.replace('tenant:platform', 'tenant:other') + '&stream_instance_id=a')[0].startswith('403')
+    assert invoke(app, base.replace('source=approval-engine', 'source=other') + '&stream_instance_id=a')[0].startswith('403')
+
+
+@pytest.mark.parametrize('suffix', ['&stream_instance_id=', '&stream_instance_id=a&stream_instance_id=b'])
+def test_reconciliation_refuses_ambiguous_instance_filters(app, suffix):
+    status, body = invoke(app, '/v1/reconciliation?source=approval-engine&tenant=tenant:platform'
+                          '&since=2026-09-01T00:00:00%2B00:00&until=2027-01-01T00:00:00%2B00:00' + suffix)
+    assert status.startswith('400')
+    assert body['error'] == 'invalid_stream_instance_id'