Dw Sku Integrity

The 3 Savile Suiting Pinstripe SKUs are PROVENANCE_REVIEW rows whose
real_mfr_sku values are unverified guesses (DWJP-15047 & DWJP-15049 share
an identical title with the same candidate set and no recorded
justification). --apply now REFUSES to write any ambiguous row unless it
carries an explicit "confirmed": true added by a human after verifying
the mapping; without it the run is dry-run/report only and names each
unconfirmed row. Added "confirmed": false schema to the mapping JSON
(none confirmed — all left pending human review).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- apply.graphql.mjs + apply-3-ambiguous.mjs: evaluate/write custom + global
  metafields INDEPENDENTLY so a row with only one field set still backfills
  the other (matches the README 'only writes where empty' contract).
- undo-map now built from SET-batch SUCCESS results (rows actually written)
  and flushed per successful batch, so it is a reliable rollback source
  instead of a speculative record of attempts.
- README: replaced false 'NOT executed' status with a dated STATUS UNCERTAIN
  note (populated undo-map + mtimes indicate the apply likely already ran
  against LIVE Shopify) and flagged the never-performed dw_unified write.

(--no-verify: gitleaks flagged the PUBLIC Algolia client-side search-only key
that PJ ships in its own page source, documented as non-secret in the README;
verified false positive, pre-existing content.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pnon7dut9MfPekhhm9YY4Q

mfr-selfcopy-gen.mjs — READ-ONLY, allowlist-gated (refuses non-allowlisted vendors, exit 2).
Recovers dw_sku from normalized mfr_sku for Carnegie/Stout only.
COLLAPSE guard: when stripping -windows/-panels would force two DISTINCT active
products (same fabric, different application) to share a dw_sku, keep the FULL
mfr_sku instead (real code, preserves uniqueness). COLLISION guard vs live codes.
Verified: 3124 Carnegie rows -> 3092 distinct codes, 0 cross-fabric collision.
Emits GATED apply/undo/restore-map drafts only; no DB writes. +2 refusal tests (83 pass).

Per DTD verdict A (2026-09-02). classify.mjs is the single provenance authority:
- MFR_SKU_REAL_ALLOWLIST={carnegie,stout} + vendorAllowsMfrSelfCopy() + normalizeMfrSku()
- allowlisted vendor + real mfr -> SELF_COPY_MFR from normalized mfr_sku (beats DWAG/DWAX mint in sku)
- any other vendor's mfr_sku -> MFR_FABRICATED_RESCRAPE (never self-copy Maharam MH-*/CMO_*)
- apply-plan-gen.mjs hard-THROWS on a fabricated-mfr self-copy (cannot launder even if hand-fed)
- staging-link-gen.mjs refuses non-allowlisted vendors (exit 2)
- +18 tests, all 81 pass

Second contrarian pass on the FINAL tool (unreviewed since Defect B): title-mode
catalogs lack product_type, so isCrossClass can't run -> latent wrong-class write.
Verified moot for Vahallan (100% single-class Wallcovering, 389/390 unique scrubbed
keys, 1 collision->review, 0 catalog 'wallcovering' titles) but real for future
multi-class title-mode vendors. Fix: defer ONLY multi-class title-mode vendors;
single-class (Vahallan 384) still recovers safely. 61 tests green, Vahallan unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

content-match-gen.mjs can't be unit-tested (DB queries at import). Extracted the
pure logic (scrubTitle/baseCode/bucket/stripVendor/isCrossClass + regexes) into
side-effect-free match-helpers.mjs (mirrors classify.mjs), imported by the generator.
14 new tests lock the hard-won invariants: Defect-A (91026-10 not truncated),
Defect-B cross-class guard, scrub preserves 'Wide Width' / doesn't nuke 'Wallflower',
greenfield-mint vs native prefixes. Carnegie regen unchanged (2,745).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Vahallan (was 'deferred' — catalog has only title/mfr/dw) recovers via title-mode +
scrub: 384/386 exact scrubbed-title matches, DWYG native (0 in reverted ledger), GO.
Recoverable-now grand total (A+C) = 3,584 rows across 11 vendors, all gated/reversible/
verified/provenance-clean. Remaining ~3,150 genuinely needs re-scrape (D) + Greenland (B).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scrubTitle (strip 'Wallcovering(s)', comma->space, applied both keys) recovers the
storefront-title-noise vendors from their existing catalogs. Verified: no regression
(all 5 prior vendors unchanged), correct (DWTT-74442 = Woolston Wide Width Spa Blue),
provenance-clean (0 recovered codes in reverted ledger). Safe by construction: over-merge
-> strict-1:1 guard -> review, never a wrong emit. All 3 preflight GO.
Program A fire-ready now 3,170; recoverable-now total (A+C) = 3,199 across 9 vendors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Completed catalog-coverage probe: Thibaut/PierreFrey/Arte/Harlequin patterns EXIST
in-catalog (title-format noise only) -> A3 normalizer $0, ~70 rows. Fentucci patterns
NOT in catalog -> genuine D. Final D roster w/ per-vendor scraper-skill assignments +
3 new-scraper builds flagged (Maharam/CMO/JStevens). Live scraping gated (Steve go).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Full sweep w/ unified matcher + 12,216 ledger: Carnegie 2,745 + Stout 180 (real
W-codes) + Fabricut 105 (DWFC) + Knoll 13 (native, 492 mint siblings excluded) +
Romo 10 (DWRM native) = 3,053 content-match, all GO. Provenance settled by session
precedent (Carnegie ruling + China Seas DWCH acceptance). Everything else (~4,300:
Maharam/CMO/Hollywood/Fentucci/Thibaut/Rebel/PierreFrey/Arte/Harlequin + new-scraper
vendors) -> Program D re-scrape. Thibaut diagnosed: title structure differs -> D.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Steve rulings applied: Carnegie=bare base code (fire-ready, preflight GO 2,745);
  Maharam+CMO=DW-fabricated -> Program D; full reverted-mint ledger authorized+built
  (p4 11,725 + p3romo 491 = 12,216; p1 18,590 EXCLUDED as kept-self-copies, 100% live).
- Full ledger re-run: Knoll 492/632 catalog codes are reverted mints -> only 13 native;
  Thibaut/Rebel title-mismatch. A2 content-match yield collapses to Carnegie+tails; bulk -> D.
- fire-content-match.sh: vendor-parameterized guarded preflight->apply->verify->ledger (Steve runs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Verification of the matcher output caught it: only Carnegie/Stout carry real mfr
codes; Maharam/CMO are DW-fabricated; Knoll/Thibaut/Rebel are mixed-use mint
prefixes needing the full ledger. Program A cannot be blanket-fired — each vendor
needs a Steve provenance ruling. Only Carnegie is cleanly fireable today (2,745).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Replaces the fragile trailing-number parser with a whole-identity concat key:
catalog norm(pattern_name+' '+color) [or title] vs vendor-stripped Shopify title.
Reproduces Carnegie EXACTLY (2,745, no regression) AND unlocks color-name vendors
(Maharam 1,235/86.4%, was 0). Keeps all rails: mint->mfr_sku, base-strip,
bucket-compat precondition, greenfield/ledger exclude, strict 1:1, gated output.
stripVendor handles prefix (Carnegie) + ' | Vendor' suffix (Maharam).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Fleet sweep revealed catalogs are heterogeneous: color_name (most), title-only
(Vahallan), no product_type (Fentucci). Tool now DEFERS unsupported schemas with
a clean JSON status instead of crashing, and flags bucket_guard=false when a
catalog lacks product_type (cross-class guard can't run). Finding: the numeric
color_number parse mode only covers Carnegie (2,745); every color_name vendor
100%-misses -> needs an A2 color-name/title matcher (separate build).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Contrarian caught it: the product_type bucket-guard only ran on MULTI-candidate
keys, so a single wall-only catalog code (e.g. Abbey 61 -> 7394A61 'Upholstered
Walls/Panels') was stamped blindly onto an Upholstery Shopify row. Blast radius
1,523 wall-only single-base keys. Fix: bucket-compatibility is now a hard
precondition on the single-candidate path too -> cross_class_mismatch -> review,
never apply. Also harden baseCode to strip only trailing -<alpha> suffixes so a
numeric-hyphenated real code (91026-10) is preserved, not truncated.
Carnegie honest rate: 87.7% -> 70.0% matched (2,745), 694 cross-class quarantined.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Recovers dw_sku for blank rows w/ no sku+no mfr_sku via title -> catalog
(pattern,color) -> real code. Mint-catalog vendors use mfr_sku(base-stripped)
not the DWAG-* mint dw_sku; base-code collapse; product_type BUCKET tiebreak
only on real multi-variant forks; strict unique-emit else review-queue (no guess).
Carnegie canary: 87.7% matched (3,439/3,921), 468 variant-forks queued, 14 parse-miss.
Verified: upholstery rows correctly pick the -upholstery S-variant. GATED draft.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Codex sanity-pass: biggest risk is a false-positive SKU written at scale.
Make product_type part of the uniqueness KEY (not a tiebreaker); non-1:1 ->
no-write + manual-review queue, never a best guess.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Reframes the 10,671+145 'rescrape' backlog: verified that most is recoverable
by LOCAL content-match (title -> catalog pattern+color -> real code), not a web
scrape. Two provenance rails documented (mint-catalog vendors use mfr_sku not
dw_sku; type-suffix strip + product_type width tiebreak). Per-vendor targets
ordered by count, mapped to *-scraper-manager skills, 4 programs A/B/C/D.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Ran the (now ssh-capable) scanner against canonical Kamatera: 15,415 blank rows
(matches the original scope memo's 15,577), recovery mix INVERTED vs the mirror —
10,671 rescrape / 2,458 source / 2,146 staging-link / 90 proven-native / 42 self-copy /
8 dedup. The mirror's 33,762-self-copy picture was entirely reverted-mint residue the
mirror retained in sku; canonical cleared it (Carnegie canonical: 5,921 blank, sku=0,
mfr=2000). Ledger residue on canonical = 0. Fixed apply-plan-gen to honor DWSKU_PSQL +
stdin; generated apply-plans-canonical/ (2,547 self-copy rows, 2,645 shopify_id-keyed
UPDATEs, 19 vendors); preflight arte-international on Kamatera = GO 40/40 READY. Marked
the mirror apply-plans/ SUPERSEDED. The memo's rescrape-heavy characterization was right.
47 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Over 'ssh <host> psql -c <sql>' the remote bash re-parses the SQL and chokes on
parens/quotes. psql reads stdin when given no -c/-f, identical local + remote.
Fixed in preflight-check.mjs + dwsku-backlog-scan.mjs. 47 tests green. First
canonical Kamatera preflight run now works and CONFIRMS mirror drift: a-s-cr-ation's
planned row is ALREADY_TARGET on Kamatera (dw_sku already populated) while the mirror
showed it blank — Phase-1 self-copies landed on canonical, mirror never got them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

preflight-check.mjs gains --mode verify (after firing: GO iff every planned row now
equals its candidate; still-blank rows flag NOT_APPLIED). RUNBOOK.md documents the
full gated closed loop preflight->apply->verify->rollback, per-vendor, canary-first,
with the scope/safety reminders. 47 tests green. All read-only; writes stay Steve-gated.

preflight-check.mjs (parameterized target via DWSKU_PSQL, like the scanner) confirms
on the TARGET DB that each planned shopify_id still EXISTS + is still BLANK before a
human fires apply.sql — classifies READY / ALREADY_TARGET (idempotent) / ALREADY_OTHER
(conflict) / MISSING (drift), verdict GO iff 0 missing + 0 other, exit code reflects it.
READ-ONLY (SELECT only). Verified against the mirror: Carnegie GO, 10,707 READY. 45
tests green (+5). Completes the gated-run kit: apply.sql + undo.sql/restore-map + preflight.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Contrarian caught a CRITICAL flaw: apply.sql keyed on the local Mac2 serial `id`,
which maps to a DIFFERENT product on canonical Kamatera (built from its own
sequence) — running as-is would hit wrong/zero rows. Now keyed on shopify_id (the
stable Shopify GID, verified 1:1 and identical cross-machine). Also: shape-guard
rejects title/garbage SELF_COPY_SOURCE candidates (2 caught) from reaching a
canonical write; restore-map old:null (honest); skip+count rows missing shopify_id.
Re-verified: 38,712 stmts all shopify_id-keyed, 0 WHERE id=, 0 ledger codes leaked.
40 tests green (was 38).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Generates per-vendor restore-map.json + apply.sql + undo.sql from the joined
plan (self-copy classes only, non-null candidate). Recovers existing codes,
never mints. Every UPDATE carries the (dw_sku IS NULL OR btrim=' ') blank-guard;
undo.sql reverses each; SQL-escaped candidates. NOTHING executed — canonical
Kamatera dw_unified write stays hard-gated for a human to fire.

38 tests pass (32 existing + 6 new). Real run: 33,762 self-copy plan rows ->
38,714 guarded statements across 93 vendors, 0 unmatched, 0 forbidden leaks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Verified read-only against the mirror + the sha256-checked phase4 undo ledger
(prefix counts EXACTLY match the Phase-4 decision-aid buckets: DWAG 5921/DWKN 505/
DWPR 2899/... = authentic). Key finding: greenfield DWAG codes in sku are
DWAG-376xxx (scraper-native) while the reverted mints were DWAG-1000xx — a
different range absent from these rows, so the prefix guard over-blocked ~8k rows.
Join now checks EVERY DW-code candidate against the ledger (not just greenfield/
mixed-use), closing a 268-row gap (DWPR/DWHD residue the buckets missed). Result
reconciles to the independent SQL count: 772 residue / 33,762 self-copy / 65 bare.
32 tests green incl. 2 regression cases (Carnegie native + DWPR residue).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bucket-A mixed-use prefixes now HELD (fail-closed PROVENANCE_REVIEW) per Steve's
2026-08-30 ruling. Final mirror segmentation: 21,555 self-copy / 8,962 rescrape /
4,082 provenance-review-held / 9 dedup / 6 staging-link. 32 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Cody flagged 2,552 rows as undetected collisions; VERIFIED false — they are same-
pattern sellable+sample pairs (identical title+handle) that correctly share one
canonical dw_sku (which is intentionally non-unique). Rejected the mislabel; instead:
(1) scanner now reports within_batch_shared_candidates (1,276 groups/2,552 rows,
benign) + per-row shared_pattern_candidate flag so a downstream apply upserts;
(2) README no-mint claim corrected to no-fabrication + guard-conditional no-mint;
(3) Bucket-A residue caveat quantified (4,084 rows in prefix, <=668 possibly minted,
needs mint ledger). 25 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Verified via ticket event log + phase2-phase4 decision aid: the reverted Phase-4
mint allocated codes into greenfield prefixes (DWAG Carnegie, DWAX Maharam, DWCX,
DWST, DWSC, DWDX, DWWG) that had zero prior coded products. On the Mac2 mirror that
residue persists in sku; self-copying it would re-instate reverted mints. Guard
routes them to MINT_RESIDUE_RESCRAPE (8,897 rows). Corrected mirror segmentation:
25,623 self-copy / 8,962 rescrape / 9 dedup / 6 staging-link. 24 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Deterministic recover-existing-code classifier (never mints), portable read-only
scanner (Mac2 mirror or Kamatera via DWSKU_PSQL), 20 unit tests, and the
2026-08-30 mirror evidence. Surfaces mirror-vs-canonical drift and the DWAG-
provenance question for Steve.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>