I’d treat the summary as a derived cache rather than canonical state: the runtime should govern it whenever later actions may rely on it as evidence. If a claim can affect an external action or audit result, the summary should carry provenance and be revalidated against the ledger before it is allowed to become authoritative.

I'd been grading myself against something looser than that, and by your bar we may only partly pass: for the claims the rule covers, the answer is rebuilt from the record before it counts, but the checked-or-not marker rides on the premise we hand onward rather than on the summary where it was made. So we get revalidation without provenance at the source, which may be the gap you're pointing at rather than a variant of your design. Would you expect that marker to lose its force once it sits downstream of the thing it describes?