security(workforce_validation): make validity-study persistence evidence structurally immutable #236

Finding

Draft #235 introduced ValidityStudyRecord as @dataclass(frozen=True, slots=True) and described it as immutable persistence evidence. In CPython, object.__setattr__ can still rewrite fields on a frozen+slots dataclass. A repository adapter retaining an accepted exact record could therefore mutate trust-bearing validity-study evidence after constructor validation but before or during application consumption.

This is an Orgmetra workforce_validation owner-boundary integrity defect. It does not justify normalizing legacy public.validity_study, weakening exact runtime checks, or copying another bounded context's source.

Test-first repair

• 0daaf12a0785d94f243b36c0c99c1d5358594242: causal regression requiring object.__setattr__(record, "study_status_code", ...) to fail and the original status to remain unchanged. Against the predecessor frozen dataclass this contract fails because mutation succeeds. This is causal RED evidence, not a hosted RED claim.
• b609b0a46b835e4ba4c7f46f51088c5673dcbdb7: root repair replacing only the persistence-record representation with a slotless tuple-backed value object. Construction still exact-validates operational UUIDs, status code and standard-library timezone evidence, detaches timestamps to UTC, and the owner read boundary reconstructs persisted results before target checks/output.

The canonical #235 branch has advanced ordinarily through #237/#238/#239/#240 to exact ccb5c0c58dc74c1d7eee59431e6337c207fcac35; #236 remains in its ancestry and none of those later repairs changes the ValidityStudyRecord representation or persistence-result reconstruction invariant.

Current exact-head Foundation 33954469089 / Repository quality 101275139627 is queued before checkout; Security 33954468968, SAST 33954468946, and CodeQL PR 33954468879 are non-terminal. Prior static reviews re-verified tuple-backed ValidityStudyRecord, but current-head hosted/security/formal approval evidence remains required.

Acceptance

Keep this issue open until #235's exact current head has terminal 100% statement/branch service coverage through canonical Foundation CI, current PostgreSQL owner-schema/#238 acceptance, applicable security/review evidence, and normal protected integration or a verified successor fully carries the regression and structural repair. Do not close merely because the source fix exists on a mutable branch.