Task: Let a model declare an immutable entity

Give the trade and structure anchors a generated shape: one row per key, written once, never updated or deleted.

• A model with :immutable: true in its SQL flags generates a table whose trigger rejects update and delete.
• The generated C++ write path offers insert only.
• No existing model changes: the drift check reports no drift.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

A model declares :immutable: true in its * SQL ** Flags drawer. The generator refuses it unless the drawer also says :current_state: true and the * Flags drawer :read_only: true: only a current-state table has one row per key, and only a read-only entity has no derived write verb that would ask the store to change a row.

The table gets an _immutable_trg row trigger that refuses every update and delete, and an _immutable_truncate_trg statement trigger that refuses truncate, each with SQLSTATE 55000; the drop script removes both. The repository writes with sqlgen::insert instead of insert_or_replace, so a second write of the same key fails on the primary key instead of overwriting.

The generated C++ still has its remove methods. The store refuses them and :read_only: keeps every delete verb off the wire, so no client reaches them; removing them would touch the repository, the service and the generated tests for no behaviour gained.

Evidence: test_immutable_entity.py, seven cases, including the two refused flag combinations and the mutable control. The rendered DDL was run against the development Postgres in a rolled-back transaction: the first insert succeeded, a duplicate key, an UPDATE and a DELETE were each refused, and the row was unchanged; after review a TRUNCATE was refused the same way. The codegen suite is 1088 passed; the drift dry run changes no generated file apart from the known clang-format wrapping in trade_service.cpp.