[M1/Correctness] Separate immutable materialization proof from disposable derived caches

[samovers]

Parent: #167
Depends on: #171, #174, #176, #180
Backlog overlap: materialization/cache portions of #139 should remain there until this issue is implemented and reconciled.

Problem

Mutable derived rows and dependency indexes can be treated as proof, freshness vectors are not fully verified, content identities are truncated/unverified, and correction invalidation can miss keys whose window membership changes.

Acceptance criteria

• Persist immutable canonical basis and context snapshots sufficient to reconstruct every materialized answer.
• Treat current-state rows, freshness rows, and reverse-dependency indexes as disposable accelerators, never sole proof.
• Identify canonical materialization keys, bases, and snapshots with full collision-resistant digests and verify canonical equality on reuse.
• Enforce at most one live cache row per canonical key while retaining immutable historical proof.
• High-consequence resolution verifies matching basis, context, dual temporal cuts, RuntimeBundle, freshness vector, policy/reference identities, and dependency closure; otherwise recompute or refuse.
• Invalidation is query-, interval-, category-, scope-, and bundle-aware; correction considers both old and new sources and safely broadens when exact impact is not provable.
• Unknown trigger vocabulary produces a governed refusal/diagnostic result, never a bare exception or silent omission.
• Window selection uses the interval convention from [M1/ADR] Specify valid-time and knowledge-time semantics #170 and returns an explicit no-basis/gap result instead of leaking adjacent-window data.
• Rebuild from immutable history yields canonically equivalent answers.
• Add corruption, deleted-cache, stale-index, stale-vector, digest-collision simulation, window-gap/boundary, correction-movement, and full cold-rebuild tests.

Non-goals

Fleet benchmarking, PWA/offline behavior, M3/M4 work, new materialization families, profile activation, manifest/active-set changes, or higher capability claims.

Integrated M1/M2 review addendum (2026-07-10)

Preserve complete Core semantics

“Basis sufficient to reconstruct” means a lossless canonical carrier or domain projection, not only the current summary fields.

• Immutable materialization proof preserves every accepted operation semantic that can affect selection, qualification, correction, or output: exact subject/farm/field/CropCycle, effective interval, event/knowledge cuts, target geometry or extent reference, extent basis/quality, AppliedResource and material quantities/units, equipment, bindings actually relied upon, evidence/review state, and RuntimeBundle.
• The canonical proof distinguishes records that differ in any output-relevant semantic even when their present summary view is identical.
• A derived cache may project or aggregate, but omitted source semantics remain reachable from immutable content-addressed proof.
• Frozen-output reconstruction from immutable proof alone yields the same canonical bytes, qualification, gaps, and provenance after all disposable materialization/cache tables are deleted.
• Add round-trip and mutation tests showing no accepted carrier field silently disappears, and that changing one semantically relevant field changes the appropriate basis/materialization identity.