[jadenfix]

What changed

The offline CLI could overwrite its own input CSV when --output named the same file, a symlink to it, or a hardlink alias. This PR checks the effective replay source before execution and writes completed JSON reports through an atomic same-directory replacement.

It also turns the existing replay workbench into a reviewable, truthful demo:

• 24 Python unit/integration regressions, including direct/symlink/hardlink preservation for both CSV and bundled-demo inputs plus failed-replace preservation
• actual Chromium E2E against a separate replay_web.py process and temporary SQLite database
• synthetic replay, parameter changes, CSV upload, history/reload, JSON download, charts, mobile layout, and browser-error checks
• reproducible 23-second GIF/MP4/poster captured from reachable source 53e97917d880dcc98095fbf56f768b5c82830ee6
• receipt pinning 18 source blobs and all artifact SHA-256/decoded metadata
• Python 3.9/3.12, browser, media-integrity, and clean-tree hosted gates

Local verification

24 passed
BROWSER_E2E_OK initial=empty synthetic=75-bars parameters=changed csv=9-bars history=3 export=json mobile=no-overflow errors=0
MEDIA_VERIFY_OK source_blobs=18 artifacts=3 full_decode=gif,mp4,png
npm audit: 0 vulnerabilities

Exact current head: 0c079603e7f832613f2b9d18933a3b5c7723c1ba.
Published tree: 7b051dffc9863b96bf09b1a44367af8e99b52653.
Captured source tree: 57f111788ed4a3777be95201b182138b8ae7da49.

A fresh-clone check proves the source commit is the direct parent of the artifact commit and the verifier can resolve all 18 pinned source blobs. The first hosted browser attempt exposed a current-Chromium-only favicon 404 console message after both Python lanes passed. The server now returns an empty 204 for that browser request, with an integration regression. No gate was weakened.

Truthful scope

The recording and tests prove the local offline paper engine, HTTP/UI/SQLite workflow, input preservation, and media provenance. Bundled prices are synthetic and uploaded CSV provenance is explicitly unverified. This does not establish live Solana RPC, wallet, Jito, executable orders, profitability, strategy quality, latency, liquidity, or deployment.

The repository's large tracked virtual environments/caches are pre-existing and intentionally left for a separate cleanup so this repair stays scoped.

[jadenfix]

Independent exact-head review: CLEAR / ready for the designated sole merger at 0c079603e7f832613f2b9d18933a3b5c7723c1ba (tree 7b051dffc9863b96bf09b1a44367af8e99b52653, base 9927efa416675fda27ca279643cb823869fb49fb).

A provenance problem found during review was fixed before clearance: captured source 53e97917d880dcc98095fbf56f768b5c82830ee6 is now the reachable direct parent, source tree 57f111788ed4a3777be95201b182138b8ae7da49. A fresh origin worktree resolves it and verifies all 18 pinned source blobs.

Evidence:

• 24/24 unit/integration tests; all 7 direct/symlink/hardlink/atomic-preservation regressions pass
• real-process Chromium E2E passes: empty state, 75-bar synthetic run, parameter changes, 9-row unverified CSV, three-run history/reload, JSON export, charts, mobile, zero errors
• full GIF/MP4/PNG decode and visual inspection pass; all 19 changed remote blobs equal reviewed worktree bytes
• hosted PR run 38385649585 and push run 38385643042 are green; GitGuardian and npm audit are clean
• scope is appropriate and not overengineered

Truth scope: this proves the local offline paper replay, UI/API/SQLite persistence/export, input preservation, and source/media integrity. Data is synthetic or explicitly unverified. It does not prove live RPC/wallet/Jito/orders, profitability, latency, liquidity, or deployment.