feat(schema,scip): PR#10 slice 1 -- reference_evidence dual-write (evidence ledger v1 foundation)

Wave 3 evidence ledger v1 (docs/plans/2026-08-19-evidence-architecture-execution-plan.md
Part E PR#10), first slice: additive schema only, every existing
call_edges write path stays unchanged.

- New `reference_evidence` table (schema.rs): generalizes `external_proofs`
  with a `disposition` axis ('supports' written by this slice; 'excludes'
  is future work migrating insert_missing_exact_edges's evidence_conflicts
  INSERT) and an `authority_class` axis ('external_proof' for a live
  SCIP/LSP result today, leaving room for a future 'heuristic'/'static'
  class). Same CASCADE-on-reindex lifecycle as external_proofs, keyed by
  call_site_id.
- `record_external_proof_for_edge` (scip/ingest.rs) now dual-writes into
  reference_evidence under the identical guard as its existing
  external_proofs INSERT, so the two tables never disagree about which
  proofs qualified. Idempotent (ON CONFLICT upsert, verified by a repeat-
  call test).
- 2 new tests: reference_evidence's CASCADE-delete lifecycle, and the
  dual-write (incl. idempotent re-run doesn't duplicate rows in either
  table).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

crates/calm-core/src/db/schema.rs

@@ -287,6 +287,45 @@ CREATE TABLE IF NOT EXISTS external_proofs (
 );
 CREATE INDEX IF NOT EXISTS idx_external_proofs_status ON external_proofs(status, provider);
 
+-- Wave 3 evidence ledger v1 (docs/plans/2026-08-19-evidence-architecture-execution-plan.md
+-- Part E PR#10, slice 1 of N). Generalizes external_proofs above -- additive
+-- schema + dual-write only in this slice; every call_edges write path is
+-- UNCHANGED. disposition distinguishes a provider proof FOR a target
+-- ('supports', the only value written so far, from record_external_proof_for_edge
+-- which both the SCIP and LSP overlays call) from one recording disagreement
+-- ('excludes' -- not written yet; migrating insert_missing_exact_edges's
+-- evidence_conflicts INSERT to also land here is future work, not this slice).
+-- authority_class names the KIND of evidence: 'external_proof' for a live
+-- SCIP/LSP result today, leaving room for a 'heuristic'/'static' class if the
+-- static resolver's own confidence tiers are ever folded in here too (this
+-- slice deliberately does not attempt that -- see PR#10's real write-path
+-- inventory: indexer/pipeline/graph.rs's rebuild_graph/incremental_graph_update
+-- DELETE-then-reinsert call_edges wholesale from call_sites+symbols on every
+-- pass, making the static tier already a projection rather than a provider in
+-- this sense). Same CASCADE-on-reindex lifecycle as external_proofs.
+CREATE TABLE IF NOT EXISTS reference_evidence (
+    id                   INTEGER PRIMARY KEY AUTOINCREMENT,
+    call_site_id         INTEGER NOT NULL REFERENCES call_sites(id) ON DELETE CASCADE,
+    to_symbol            TEXT NOT NULL,
+    provider             TEXT NOT NULL,
+    disposition          TEXT NOT NULL CHECK (disposition IN ('supports', 'excludes')),
+    authority_class      TEXT NOT NULL DEFAULT 'external_proof',
+    source_file_hash     TEXT NOT NULL,
+    callee_start_byte    INTEGER NOT NULL,
+    callee_end_byte      INTEGER NOT NULL,
+    provider_fingerprint TEXT NOT NULL,
+    context_fingerprint  TEXT NOT NULL,
+    graph_generation     INTEGER NOT NULL DEFAULT 0,
+    call_site_identity_version INTEGER NOT NULL DEFAULT 1,
+    definition_snapshot  TEXT,
+    status               TEXT NOT NULL CHECK (status IN ('fresh', 'stale', 'legacy', 'unverified', 'rejected')),
+    observed_at          REAL NOT NULL,
+    failure_reason       TEXT,
+    UNIQUE(call_site_id, to_symbol, provider, disposition)
+);
+CREATE INDEX IF NOT EXISTS idx_reference_evidence_status ON reference_evidence(status, provider);
+CREATE INDEX IF NOT EXISTS idx_reference_evidence_call_site ON reference_evidence(call_site_id);
+
 -- WS3 (docs/plans/2026-08-18-context-intelligence-upgrade-plan.md, D3): a call
 -- site whose bare-name candidate set exceeded MAX_CALLEE_CANDIDATES used to be
 -- silently dropped to zero call_edges rows -- unknown read identically to
@@ -2556,4 +2595,41 @@ mod tests {
             "proof lifetime follows CallSite identity, never edge id"
         );
     }
+
+
+#[test]
+fn reference_evidence_is_keyed_by_call_site_and_deleted_with_it() {
+    let conn = Connection::open_in_memory().unwrap();
+    init_db(&conn).unwrap();
+    conn.execute(
+        "INSERT INTO call_sites
+            (from_path, enclosing_qn, callee_name, call_line, callee_start_byte,
+             callee_end_byte, identity_version, edge_kind)
+         VALUES ('main.rs', 'main.rs::main', 'target', 1, 0, 6, 2, 'call')",
+        [],
+    )
+    .unwrap();
+    let call_site_id = conn.last_insert_rowid();
+    conn.execute(
+        "INSERT INTO reference_evidence
+            (call_site_id, to_symbol, provider, disposition, source_file_hash, callee_start_byte,
+             callee_end_byte, provider_fingerprint, context_fingerprint, status, observed_at)
+         VALUES (?1, 'lib.rs::target', 'scip:rust', 'supports', 'source-hash', 0, 6,
+                 'binary-fingerprint', 'context-fingerprint', 'fresh', 1.0)",
+        [call_site_id],
+    )
+    .unwrap();
+
+    conn.execute("DELETE FROM call_sites WHERE id = ?1", [call_site_id])
+        .unwrap();
+    let evidence: i64 = conn
+        .query_row("SELECT COUNT(*) FROM reference_evidence", [], |row| {
+            row.get(0)
+        })
+        .unwrap();
+    assert_eq!(
+        evidence, 0,
+        "reference_evidence lifetime follows CallSite identity, same as external_proofs"
+    );
+}
 }

crates/calm-core/src/scip/ingest.rs

@@ -574,6 +574,56 @@ pub(crate) fn record_external_proof_for_edge(
             context.graph_generation,
         ],
     )?;
+    // Wave 3 evidence ledger v1 (PR#10 slice 1): mirrors the external_proofs
+    // write above into reference_evidence under the identical guard, so the
+    // two never disagree about which proofs qualified. disposition is always
+    // 'supports' here -- record_external_proof_for_edge only ever runs after
+    // a proof was ACCEPTED (see this fn's own doc comment); 'excludes' is
+    // written by a future slice migrating insert_missing_exact_edges's
+    // evidence_conflicts INSERT.
+    conn.execute(
+        "INSERT INTO reference_evidence
+            (call_site_id, to_symbol, provider, disposition, authority_class, source_file_hash,
+             callee_start_byte, callee_end_byte, provider_fingerprint, context_fingerprint,
+             graph_generation, call_site_identity_version, definition_snapshot, status, observed_at)
+         SELECT ce.call_site_id, ce.to_symbol, ?1, 'supports', 'external_proof', fi.hash,
+                 cs.callee_start_byte, cs.callee_end_byte, ?2, ?3, graph.generation,
+                 cs.identity_version,
+                 printf('%s:%d:%d:%s', COALESCE(def_file.hash, ''), def.line_start, def.line_end, def.signature),
+                 'fresh', unixepoch('now')
+         FROM call_edges ce
+         JOIN call_sites cs ON cs.id = ce.call_site_id
+         JOIN file_index fi ON fi.path = cs.from_path
+         JOIN symbols def ON def.qualified_name = ce.to_symbol
+         LEFT JOIN file_index def_file ON def_file.path = def.path
+         JOIN graph_generation_state graph ON graph.id = 1
+         WHERE ce.id = ?4
+            AND ce.formal_source = ?5
+            AND cs.identity_version >= 2
+            AND cs.callee_start_byte IS NOT NULL
+            AND cs.callee_end_byte IS NOT NULL
+            AND (?6 IS NULL OR graph.generation = ?6)
+          ON CONFLICT(call_site_id, to_symbol, provider, disposition) DO UPDATE SET
+              source_file_hash = excluded.source_file_hash,
+              callee_start_byte = excluded.callee_start_byte,
+              callee_end_byte = excluded.callee_end_byte,
+              provider_fingerprint = excluded.provider_fingerprint,
+              context_fingerprint = excluded.context_fingerprint,
+              graph_generation = excluded.graph_generation,
+              call_site_identity_version = excluded.call_site_identity_version,
+              definition_snapshot = excluded.definition_snapshot,
+              status = 'fresh',
+              observed_at = excluded.observed_at,
+              failure_reason = NULL",
+        rusqlite::params![
+            context.provider,
+            context.provider_fingerprint,
+            context.context_fingerprint,
+            edge_id,
+            expected_formal_source,
+            context.graph_generation,
+        ],
+    )?;
     Ok(())
 }
 
@@ -1246,6 +1296,72 @@ mod tests {
         );
     }
 
+
+#[test]
+fn record_external_proof_for_edge_dual_writes_reference_evidence() {
+    let conn = Connection::open_in_memory().unwrap();
+    crate::db::schema::init_db(&conn).unwrap();
+    conn.execute_batch(
+        "INSERT INTO symbols (qualified_name, name, kind, language, path, line_start, line_end)
+         VALUES ('core/src/engine.rs::Engine::start', 'start', 'method', 'rust',
+                 'core/src/engine.rs', 6, 8);
+         INSERT INTO file_index (path, hash, language, symbol_count, last_indexed)
+         VALUES ('app/src/main.rs', 'fresh-source', 'rust', 1, 0);
+         INSERT INTO call_sites
+            (from_path, enclosing_qn, callee_name, call_line, callee_start_byte,
+             callee_end_byte, identity_version, edge_kind)
+         VALUES ('app/src/main.rs', 'app/src/main.rs::main', 'start', 5, 4, 9, 2, 'call');",
+    )
+    .unwrap();
+    let call_site_id: i64 = conn
+        .query_row("SELECT id FROM call_sites", [], |row| row.get(0))
+        .unwrap();
+    conn.execute(
+        "INSERT INTO call_edges
+            (from_symbol, to_symbol, call_site_line, call_site_id, edge_confidence,
+             formal_source, from_path, to_path, edge_kind)
+         VALUES ('app/src/main.rs::main', 'core/src/engine.rs::Engine::start', 5, ?1,
+                 'formal', 'scip', 'app/src/main.rs', 'core/src/engine.rs', 'call')",
+        [call_site_id],
+    )
+    .unwrap();
+    let edge_id = conn.last_insert_rowid();
+
+    let context = super::ExternalProofContext::new("scip:test", "test-binary", "test-context");
+    super::record_external_proof_for_edge(&conn, &context, edge_id, "scip").unwrap();
+
+    let proof_count: i64 = conn
+        .query_row("SELECT COUNT(*) FROM external_proofs", [], |row| row.get(0))
+        .unwrap();
+    assert_eq!(proof_count, 1);
+
+    let (provider, disposition, authority_class, status): (String, String, String, String) = conn
+        .query_row(
+            "SELECT provider, disposition, authority_class, status FROM reference_evidence",
+            [],
+            |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
+        )
+        .unwrap();
+    assert_eq!(provider, "scip:test");
+    assert_eq!(disposition, "supports");
+    assert_eq!(authority_class, "external_proof");
+    assert_eq!(status, "fresh");
+
+    // Idempotent re-run (a repeat overlay pass) must not duplicate rows in
+    // either table -- same ON CONFLICT guarantee external_proofs already had.
+    super::record_external_proof_for_edge(&conn, &context, edge_id, "scip").unwrap();
+    let proof_count_again: i64 = conn
+        .query_row("SELECT COUNT(*) FROM external_proofs", [], |row| row.get(0))
+        .unwrap();
+    let evidence_count_again: i64 = conn
+        .query_row("SELECT COUNT(*) FROM reference_evidence", [], |row| {
+            row.get(0)
+        })
+        .unwrap();
+    assert_eq!(proof_count_again, 1);
+    assert_eq!(evidence_count_again, 1);
+}
+
     #[test]
     fn ambiguous_guessed_encoding_upgrades_neither_candidate() {
         // Two real call sites at the same line, same callee — mirrors the