[augustin-cheron]

Native capture retains Alpenglow footer bytes, but current execution frames do not expose their leader time or certificate data. Add a separate, versioned native-consensus-fact-v1 format with a strict shared Rust parser, an immutable offline exporter, CLI inspection, and an opt-in Rust/Wasm JavaScript reader.

Each fact binds the exact source, bank, execution frame digest and captured event sequence/hash. Raw native bytes occur once. Readers preserve exact nanoseconds, distinguish execution hashes from consensus IDs, and keep certificate targets separate from their carrying blocks. Certificates remain captured_not_verified; reward aggregates do not set finality. The exporter checks actual v2 frame admission, rejects conflicting evidence and changed output, and commits its immutable receipt last.

The new consensus records omit Tower timing fields. Existing execution entry evidence and archives remain intact: Agave 4.3.2 still requires a terminal Alpentick. The migration plan documents continuous late-evidence custody, a negotiated live profile, and the controlled new-source handoff as later deployment work. This patch does not deploy, recover capture, delete archives, or grant source-retirement authority.

Validation:

• Portable codec: 21 tests passed, including a real retained mainnet footer and independent Wincode fixture; malformed inputs and all legal optional-certificate combinations are covered.
• Existing portable execution decoder: 13 tests passed; one explicit fixture-export helper is ignored.
• WebAssembly release build passed; JavaScript v1/v2/consensus suites: 30 tests passed.
• Native exporter and existing native library/binary tests: 41 tests passed, 3 explicit helpers ignored.
• Independent protocol/code review, changed-file formatting and staged diff checks passed.
• The pre-merge review found and fixed Node Buffer aliasing during the digest wait. The new mutation regression failed before the fix and passed after it. All 105 targeted tests passed in the final check.
• Gitleaks 8.30.1 scanned the complete PR commit range through 6324f2e91f685aa4f6b1d98d8536199cef5ad982: zero findings. Existing history findings remain separate.

CI status: the new module-order formatting issue was corrected. Other failures also occur on unchanged main commit b01231ce: formatting in processed.rs and publisher.rs, a missing local link to the private validator-tunnel/access-application.json, and 135 reachable-history scanner findings. Main baseline run: https://github.com/FernoLabs/blockzilla/actions/runs/39429692313. These checks remain enabled. The committed acceptance receipt records the baseline and local test limits; this PR is not presented as green CI or ready for production cutover.

Read docs/architecture/alpenglow-consensus-facts.md for the wire contract, exact removal boundary, CLI commands and production plan.