DR-026 — The promotion boundary replaces the record-curation RETAIN store

Pipeline walks never mutate promoted/curated records: engine writes stop at the staging layer (q_a_extractions et al.); changes to already-promoted records arrive as proposals through the existing promotion/dedup/confidence path, with auto-apply earned per progressive trust. Evidence: S441 ratification board R3; per-record-class survival contract: id-138 TECH.

Supersedes DR-024 clause (ii) (the override/RETAIN store + re-apply-after-rebuild contract). DR-024 clause (i) STANDS and is absorbed here: record identity is minted at admission, stored, and never re-derived from path — content_hash-first resolution makes a rename a mutable-attribute update, not a new identity (live authority for source_documents.storage_path/logical_path, see …id138_admission_identity_fn.sql). (Bridge restored S499 — the sweep had dropped it.)