Release checkpoints can silently restore pre-#539 ORG outputs: materializer version not bumped

[MaxGhenis]

Post-merge audit finding on #539 (6e462ca), cross-family (sol adversarial pass; mechanics independently verified against main). Severity: HIGH, operational.

Defect

#539's ORG full-year-equivalence stage runs inside the release builder — with_us_org_wages_inputs(base_frame, ...) mutates the staged frame post-base-load (tools/build_us_fiscal_refresh_release.py ~:8301) — but TARGET_FRAME_CHECKPOINT_MATERIALIZER_VERSION was not bumped (still 7, :322).

The checkpoint identity hashes the on-disk base dataset plus the version constant (materializer_version enters the identity at :1600); staged-frame contents are not hashed — a documented limitation, per the constant's own comment history ("the checkpoint identity hashes the on-disk base dataset, not the staged frame, and would otherwise silently reuse pre-stage frames"). Consequence: a release run resuming a warm target-frame checkpoint written before #539 presents an identical identity, _load_or_materialize_target_frame returns the old serialized entity tables, and the new ORG stage's output is silently discarded after it runs. Same class as PR #477 review finding 2 (the v6→7 bump for SSI assignment).

Current exposure (checked 2026-07-25)

• checkpoints/buildo-sparse2 (O attempts 2/3, 2026-07-24): stale. O-2 attempt 4 must not warm-resume from it until this lands — bump first or use a fresh root.
• Dense roots (buildo-dense, buildo-dense3000-era): checkpoints predate Concept-align the ORG QRF income feature: full-year equivalent for part-year workers #539; any warm dense rerun is exposed.
• The running buildo-sparsecd clean-register retest is not exposed: fresh checkpoint root + branch includes 6e462ca.

Fix (PR incoming)

1. Bump TARGET_FRAME_CHECKPOINT_MATERIALIZER_VERSION 7 → 8 with the conventional comment line documenting why (Concept-align the ORG QRF income feature: full-year equivalent for part-year workers #539 ORG stage mutates the staged frame pre-materialization).
2. Update the identity test pin.
3. Regression: a stored checkpoint whose identity differs only in materializer_version is rejected (rematerialization path taken), so the next missed bump has a named failure shape.

Durable follow-up (kept open after the bump lands)

Include a staged-frame/stage-code fingerprint in the checkpoint identity so this discipline stops being manual — the comment at :300–322 already concedes the gap; #539 is the second production instance of the class (after #477's SSI finding). Also fold in the audit's MEDIUM: the regeneration contract for in-release staged changes (checkpoint invalidation + explicit clean rebuild) should be a documented requirement in the PR template for release-builder stages.

[MaxGhenis]

Sol confirm on PR #545: MERGE + file-follow-up — the v8 bump and basis-sha key verified correct (single production constructor threads SSITakeUpPriorBasis.source_sha256; a supplied artifact cannot collapse to a None digest; the diagnostics-side reconstruction is reporting-only). The concrete worklist for the durable-fingerprint follow-up, from the confirm's sweep (all predate #545):

1. HIGH — frozen-support selection is identity-invisible. --selection-source-h5/--selection-source-manifest reduce the staged frame before materialization but neither the selected identities nor the join key enter the identity (application ~builder:7182; identity ~:1591). The right digest already exists: SelectionSource.identities_sha256 (warm_start_selection.py:111) — add it (plus selection mode) as an unconditional nullable key. In practice every O sparse attempt has used the same frozen manifest, so no historical run is contaminated by this one — but a future selection change would silently reuse the other selection's frame.
2. HIGH — SCF source variation is identity-invisible. A custom --scf-summary-extract is not hash-validated yet changes wealth/resource inputs pre-SSI-assignment (~builder:7973); --scf-full-extract changes auto-loan inputs and its default ZIP/member hashes are None (unverified cache; ~builder:8154, scf_auto_loans.py:70). Add resolved sha keys and pin the full extract.
3. LOW cleanup — two stale experiment readers (learned_selection_prior, build_j_recert) are implicit-None callsites already missing newer required args.

Verified NOT holes: zero-support exclusions ride TargetRegistry.version; QRF-tail exclusions are post-export gate-only; selection-mass protections explicitly keyed; ORG/SIPP/ASEC overrides sha-pinned.

The reform-vector lower-cache finding is materially different (own schema constant + a test asserting the unwanted reuse) — filed separately.