feat(storage): index exact content references

docs/01_IMPLEMENTATION_PLAN.md

@@ -12,7 +12,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Source-scoped quality | PAUSE — E40 visible engineering evaluation is 84.2466% presence, 84.2466% geometry association and 94.5205% freshness, with 11 high-severity failures, complete accounting and zero false-free claims. This is not a blind accuracy gate. |
 | Structural regressions | GO (bounded) — E42 passes predictor identity/order/chunk invariance and PointSlab order/SE(3) checks. Raw-producer and cross-route invariance remain unproved. |
 | Native pipeline telemetry | GO (durable Worker 006) — lifecycle events and JSONL/MQTT sink boundaries exist; the persistent worker writes to its existing D:-backed publish mount, host Telegraf tails with saved offset and publishes through the existing authenticated QoS 1 path. Real request `durable-native-acceptance-20260729-115418` produced native run `started → failed` after reaching the unavailable live-source boundary, and both documents were observed through broker → normalizer → Timescale query API with the same run/request identity. No broker credential or additional container entered the inference runtime. |
-| Evidence storage | MEASURED — E44 finds 525,471,092 logical bytes, 312,753,179 unique-content bytes and 1.680146× amplification across 14 E30–E40 roots. Exact-content references/deduplication precede any format migration. |
+| Evidence storage | GO (reference index only) — E50 converts the accepted E44 audit into 2,962 verified logical references over 1,029 canonical content objects, including 1,933 exact duplicate references and 212,717,913 measured duplicate bytes. Existing artifacts remain materialized and unchanged; physical reclamation and storage migration remain unauthorized. |
 | Future transfer | PREREGISTERED — E43 freezes same-K1/mount/calibration/firmware, required streams, connected-component split and independent label reveal. Capture and labels do not yet exist. |
 | E31 binding sensitivity | MEASURED — E45 closes accounting for 87/87 accepted correspondences and finds no material monotonic residual association with represented image radius, rig speed or pose age. It does not supply calibration-target truth or outer-fisheye coverage. |
 | Detector Truth Island | PREPARED — E46 freezes 32 references with no prelabels, predictions, scores or candidate identity in the review package. Two independent reviews and adjudication are still required. |

docs/13_LIDAR_WORKER_PRODUCT_AND_ROADMAP.md

@@ -9,7 +9,8 @@ qualified; E28 complete worker replay accepted; E29 camera-first semantic and
 parallel geometry-only replay implemented; E30–E35 source-scoped qualification
 accepted; RAVNOVES00 reference-source product maturation active; E36 transfer
 preregistered and deferred by ADR 0030/0032; E41 methodology boundary, E42
-metamorphic checks and E44 amplification audit complete
+metamorphic checks, E44 amplification audit and E50 exact-content reference
+index complete
 Scope: passively received real-time K1 point/pose evidence, immutable replay and
 future live shadow processing
 Explicitly out of scope: K1 firmware modification, a new onboard exporter, new
@@ -751,8 +752,10 @@ prediction contain no reference/split/scoring material, reproduce E40
 predictions exactly and are evaluated only afterward by
 `e41-visible-evaluation-57aa6c8569e8339630406e3c88cd539df13917fb08c1af57f0baae5cdd1069d2`.
 E42 adds bounded structural invariants; E44 measures exact-content
-amplification; E43 freezes the later independent transfer protocol. ADR 0032
-contains the corrected decision boundary and current priority order.
+amplification; E50 indexes its 2,962 logical paths against 1,029 canonical
+SHA-256 content objects without rewriting or deleting historical evidence; E43
+freezes the later independent transfer protocol. ADR 0032 contains the
+corrected decision boundary and current priority order.
 
 E36 is the first generalization gate. A separate product decision follows:
 either keep the result as operator/shadow evidence, or start L5 occupied-space

docs/20_RAVNOVES00_REFERENCE_SOURCE_PRODUCT_PLAN.md

@@ -142,6 +142,13 @@ across 14 admitted E30–E40 roots: `1.680146×` amplification and
 content-addressed referencing and exact deduplication, not an unmeasured
 format/database migration.
 
+E50 immutable reference index
+`e50-content-reference-index-c10c5ed7345a4f23d46ed0f132d54c378433aa4351e14375805cfe3e28878c81`
+reproduces that E44 identity and maps `2,962` logical paths to `1,029`
+canonical SHA-256 content objects. The remaining `1,933` paths are verified
+exact references. No existing artifact was rewritten, linked, moved or
+deleted; physical reclamation and storage migration remain false.
+
 E45 immutable diagnostic
 `e45-binding-sensitivity-b10fa117f110d5ac7942f73c62f1300c7d9ce833a187542b992e58fb24d1be72`
 accounts for all 87 accepted E31 correspondences and stratifies the existing
@@ -210,8 +217,9 @@ The current non-UI priority order is:
    regression checks;
 3. wire native pipeline telemetry into durable worker stages without inferring
    absent measurements;
-4. design exact-content references/deduplication from E44 before any storage
-   migration;
+4. preserve the accepted E50 exact-content reference index and require future
+   producers to adopt verified resolution before any separately authorized
+   physical reclamation;
 5. preserve E43 unchanged until the owner supplies the new capture.
 6. complete two independent E46 reviews and adjudication without exposing
    model prelabels or E47 predictions;

docs/adr/0032-ravnoves00-methodology-correction-before-transfer.md

@@ -47,7 +47,9 @@ authority. It changes the claim that those artifacts are allowed to support.
    are admitted; no network transport starts implicitly.
 7. Current storage work starts with content-addressed references and exact-content
    deduplication. E44 measures `1.680146×` amplification across the admitted E30–E40
-   package/result roots. It does not authorize a storage-format or database migration.
+   package/result roots. E50 indexes every logical path against one verified canonical
+   SHA-256 locator without rewriting historical evidence. Neither result authorizes
+   physical reclamation, a storage-format change or a database migration.
 8. The later same-K1 transfer capture is preregistered before collection. E43 freezes
    minimum streams, route/control-bridge duration, connected scene/track/time
    partitioning, independent human review and truth reveal only after frozen
@@ -71,6 +73,8 @@ authority. It changes the claim that those artifacts are allowed to support.
   `e43-future-capture-protocol-28f091b9648daffce988d44c183e21f56d77988061630de934f8003fb13701d8`;
 - data-amplification audit:
   `e44-data-amplification-89791978894ec785009e5b76c9325de4d9e910237af57476c9331eb47a8ccca4`.
+- exact-content reference index:
+  `e50-content-reference-index-c10c5ed7345a4f23d46ed0f132d54c378433aa4351e14375805cfe3e28878c81`.
 
 ## Consequences
 
@@ -81,6 +85,9 @@ authority. It changes the claim that those artifacts are allowed to support.
   high-severity failures, complete accounting and zero false-free claims.
 - Further threshold or model tuning against the visible 146 items cannot close the
   blind gate. It may only create another explicitly visible engineering comparison.
+- Exact-content references remove duplicate namespace semantics for current evidence,
+  but the existing physical copies remain in place until a separate producer migration
+  is reviewed and authorized.
 - Work that does not require a new recording can proceed now: methodology enforcement,
   predictor/evaluator separation, invariants, telemetry, exact-content deduplication
   design and preregistration.