CB-WP-0006 T06: K10 replay bundles, --replay, and AM-7 re-earned

INTENT design decision 8 of 10, unimplemented for six passes. cb-sim had
no flag parsing at all, so --replay had nowhere to go.

The bundle is manifest + commands.log + initial.snapshot + expected.yaml,
dev-only behind the scenarios feature and charged to AM-4b. The command
stream goes through the K11 framing built in T05, so a truncated bundle is
detected rather than replayed short — the two tasks compose rather than
duplicating.

The reviewer's D2 correction was real: this was not "a directory of four
files". Pass carried only the end state, RunOutcome::Failed was a
formatted String, and scenario.rs created an EventLog, appended to it and
never read it. All three had to change.

The first round trip failed to reproduce, and the cause is worth keeping:
state_hash_hex over a serde_json::Value is a different canonical form than
over the typed aggregate — Value's map is key-sorted, a struct serializes
in declaration order. The bundle was written with one basis and verified
with the other. A round trip written to recompute its own comparison value
would have PASSED this bug; it failed because the recorded hash came from
the producing process, which is control 2's entire purpose.

make replay-test implements ADR-0005 §6's four controls, 14/14: a
committed deliberately-failing fixture outside the corpus with covers: []
so it neither fails `make sim` nor inflates AM-1; a tampered recorded hash
must fail; a log short by one byte and a corrupted length prefix must be
rejected; and a mutated manifest seed must fail — which bites only because
replay re-derives the initial state from seed+setup and checks it against
the recorded snapshot, since restoring from the snapshot alone would leave
the seed inert. Plus a control on the controls: the bundle must still
replay after every mutation is reverted.

AM-7's hash-identical clause is re-earned. The probe records a hash per
per-game segment and replays each from its own genesis; folding from the
wrong seed now fails. That is the clause ADR-0005 §4 withdrew as
mutation-proven inert. The scaling >= 0.9x clause is still unenforced, so
AM-7 stays PARTIAL — reported, not rounded up.

Kernel coverage 15/18 -> 16/18. facts-check immediately caught the spec's
copy of that number going stale, on a number that moved the same hour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

crates/cb-game-runtime/src/scenario.rs

@@ -83,8 +83,24 @@ impl ScenarioFile {
 /// Result of executing one scenario (twice, per the K8 double-run rule).
 #[derive(Debug)]
 pub enum RunOutcome {
-    Passed { covers: Vec<String> },
-    Failed { reason: String },
+    Passed {
+        covers: Vec<String>,
+    },
+    Failed {
+        reason: String,
+        /// The failing run's states, so a K10 bundle can be written.
+        /// `None` when execution failed before producing a pass.
+        evidence: Option<Box<FailureEvidence>>,
+    },
+}
+
+/// What a `.cbreplay` bundle needs from a failed run (K10).
+#[derive(Debug)]
+pub struct FailureEvidence {
+    pub initial: serde_json::Value,
+    pub initial_hash: String,
+    pub end_state: serde_json::Value,
+    pub end_state_hash: String,
 }
 
 /// A game aggregate the scenario runner can drive (GameKernel K17). The
@@ -118,9 +134,18 @@ pub fn parse_actor(actor: &str) -> Result<Actor, String> {
 
 /// One execution pass: returns the end state as JSON, its hash, the
 /// emitted events, and the indices of rejected commands.
-struct Pass {
-    state: serde_json::Value,
-    hash: String,
+pub(crate) struct Pass {
+    /// The state *before* any command ran — `Pass` previously carried only
+    /// the end state, so a K10 bundle had no `initial.snapshot` to write.
+    pub(crate) initial: serde_json::Value,
+    /// Hash of the initial state, taken over the **typed** aggregate.
+    /// Hashing `serde_json::Value` instead gives a different canonical
+    /// form — `Value`'s map is key-sorted, a struct serializes in
+    /// declaration order — so a bundle written one way and verified the
+    /// other never reproduces. That defect cost the first K10 round trip.
+    pub(crate) initial_hash: String,
+    pub(crate) state: serde_json::Value,
+    pub(crate) hash: String,
     events: Vec<serde_json::Value>,
     rejected: BTreeSet<usize>,
 }
@@ -136,6 +161,8 @@ where
     if !scenario.setup.patch.is_empty() {
         state = apply_patch(&state, &scenario.setup.patch)?;
     }
+    let initial = serde_json::to_value(&state).map_err(|e| format!("initial encode: {e}"))?;
+    let initial_hash = state_hash_hex(&state);
     let mut log: EventLog<G::Event> = EventLog::new();
     let mut events = Vec::new();
     let mut rejected = BTreeSet::new();
@@ -169,6 +196,8 @@ where
     }
 
     Ok(Pass {
+        initial,
+        initial_hash,
         state: serde_json::to_value(&state).map_err(|e| format!("state encode: {e}"))?,
         hash: state_hash_hex(&state),
         events,
@@ -185,24 +214,39 @@ where
 {
     let first = match execute::<G>(scenario) {
         Ok(pass) => pass,
-        Err(reason) => return RunOutcome::Failed { reason },
+        Err(reason) => {
+            return RunOutcome::Failed {
+                reason,
+                evidence: None,
+            }
+        }
     };
     let second = match execute::<G>(scenario) {
         Ok(pass) => pass,
-        Err(reason) => return RunOutcome::Failed { reason },
+        Err(reason) => {
+            return RunOutcome::Failed {
+                reason,
+                evidence: None,
+            }
+        }
     };
 
     if first.hash != second.hash {
+        let reason = format!(
+            "K8 divergence: run 1 hash {} != run 2 hash {}",
+            first.hash, second.hash
+        );
         return RunOutcome::Failed {
-            reason: format!(
-                "K8 divergence: run 1 hash {} != run 2 hash {}",
-                first.hash, second.hash
-            ),
+            evidence: Some(Box::new(evidence_of(&first))),
+            reason,
         };
     }
 
     if let Err(reason) = check(scenario, &first) {
-        return RunOutcome::Failed { reason };
+        return RunOutcome::Failed {
+            evidence: Some(Box::new(evidence_of(&first))),
+            reason,
+        };
     }
 
     RunOutcome::Passed {
@@ -210,6 +254,15 @@ where
     }
 }
 
+fn evidence_of(pass: &Pass) -> FailureEvidence {
+    FailureEvidence {
+        initial: pass.initial.clone(),
+        initial_hash: pass.initial_hash.clone(),
+        end_state: pass.state.clone(),
+        end_state_hash: pass.hash.clone(),
+    }
+}
+
 fn check(scenario: &ScenarioFile, pass: &Pass) -> Result<(), String> {
     let expected_rejects: BTreeSet<usize> = scenario.expect.rejects.iter().copied().collect();
     if pass.rejected != expected_rejects {