[object Object]

← back to Dw Sku Integrity

TK-10896: make verified ledger authoritative for ALL DW-code rows (close prefix-guard gap)

704931f652185cbd81092435e926e150bdb328b3 · 2026-08-30 23:28:22 -0700 · codex-10896

Verified read-only against the mirror + the sha256-checked phase4 undo ledger
(prefix counts EXACTLY match the Phase-4 decision-aid buckets: DWAG 5921/DWKN 505/
DWPR 2899/... = authentic). Key finding: greenfield DWAG codes in sku are
DWAG-376xxx (scraper-native) while the reverted mints were DWAG-1000xx — a
different range absent from these rows, so the prefix guard over-blocked ~8k rows.
Join now checks EVERY DW-code candidate against the ledger (not just greenfield/
mixed-use), closing a 268-row gap (DWPR/DWHD residue the buckets missed). Result
reconciles to the independent SQL count: 772 residue / 33,762 self-copy / 65 bare.
32 tests green incl. 2 regression cases (Carnegie native + DWPR residue).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit 704931f652185cbd81092435e926e150bdb328b3
Author: codex-10896 <steve@designerwallcoverings.com>
Date:   Sun Aug 30 23:28:22 2026 -0700

    TK-10896: make verified ledger authoritative for ALL DW-code rows (close prefix-guard gap)
    
    Verified read-only against the mirror + the sha256-checked phase4 undo ledger
    (prefix counts EXACTLY match the Phase-4 decision-aid buckets: DWAG 5921/DWKN 505/
    DWPR 2899/... = authentic). Key finding: greenfield DWAG codes in sku are
    DWAG-376xxx (scraper-native) while the reverted mints were DWAG-1000xx — a
    different range absent from these rows, so the prefix guard over-blocked ~8k rows.
    Join now checks EVERY DW-code candidate against the ledger (not just greenfield/
    mixed-use), closing a 268-row gap (DWPR/DWHD residue the buckets missed). Result
    reconciles to the independent SQL count: 772 residue / 33,762 self-copy / 65 bare.
    32 tests green incl. 2 regression cases (Carnegie native + DWPR residue).
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 provenance-ledger-join.mjs          | 33 ++++++++++++++++++++++++++++-----
 test/fixtures/phase4-ledger.jsonl   |  1 +
 test/fixtures/provenance-plan.jsonl |  1 +
 test/provenance-ledger.test.mjs     | 30 +++++++++++++++++++++---------
 4 files changed, 51 insertions(+), 14 deletions(-)

diff --git a/provenance-ledger-join.mjs b/provenance-ledger-join.mjs
index 26615dc..ba6b101 100644
--- a/provenance-ledger-join.mjs
+++ b/provenance-ledger-join.mjs
@@ -6,7 +6,7 @@
 
 import { createHash } from 'node:crypto';
 import { readFileSync, writeFileSync } from 'node:fs';
-import { MIXED_USE_MINT_PREFIXES, stripUnitSuffix } from './classify.mjs';
+import { MIXED_USE_MINT_PREFIXES, GREENFIELD_MINT_PREFIXES, stripUnitSuffix } from './classify.mjs';
 
 export const REQUIRED_BACKUP_TABLE = 'sku_repair_p4_20260826';
 
@@ -48,23 +48,46 @@ export function loadVerifiedLedger(ledgerPath, manifestPath) {
   return { manifest, assignedCodes, digest };
 }
 
+// Classes whose DW-code candidate should be checked against a verified ledger.
+// A VERIFIED, complete undo ledger is the authority on provenance for EVERY
+// DW-code self-copy row — the mixed-use PROVENANCE_REVIEW holds, the greenfield
+// MINT_RESIDUE_RESCRAPE pre-blocks, AND the plain SELF_COPY_DW rows (whose prefix
+// was neither greenfield nor mixed-use, e.g. DWPR/DWHD, but which may still hold a
+// reverted-mint code). The prefix buckets are only fallback heuristics for when no
+// ledger is available; once the exact reverted-mint list is attested, ledger
+// membership — not the prefix — decides. (Verified 2026-08-30: greenfield DWAG rows
+// carry scraper-native DWAG-376xxx in `sku`, while the reverted mints were
+// DWAG-1000xx — a different range absent from these rows, so the prefix guard
+// over-blocked; conversely a DWPR/DWHD row whose code IS in the ledger is residue
+// even though its prefix isn't in a guard set.) Collisions/source/cork/staging/bare
+// are intentionally left untouched — the ledger holds only DW mint codes.
+const LEDGER_CHECKED_CLASSES = new Set(['SELF_COPY_DW', 'PROVENANCE_REVIEW', 'MINT_RESIDUE_RESCRAPE']);
+
 export function joinPlanRows(planRows, verifiedLedger) {
   const stats = { rows: planRows.length, minted_residue: 0, proven_native: 0, unchanged: 0 };
   const rows = planRows.map((row) => {
-    if (row.class !== 'PROVENANCE_REVIEW') { stats.unchanged += 1; return { ...row }; }
+    if (!LEDGER_CHECKED_CLASSES.has(row.class)) { stats.unchanged += 1; return { ...row }; }
+
     const candidate = stripUnitSuffix(String(row.sku || '').trim());
     const prefix = candidatePrefix(candidate);
-    if (!prefix || !MIXED_USE_MINT_PREFIXES.has(prefix)) {
-      throw new Error(`PROVENANCE_REVIEW row has no recognized mixed-use candidate: ${row.sku || '<blank>'}`);
+    // No recoverable DW code (e.g. a bare MINT_RESIDUE_RESCRAPE) → can't ledger-check.
+    if (!prefix) { stats.unchanged += 1; return { ...row }; }
+    // Defensive: a PROVENANCE_REVIEW row must only ever come from a mixed-use prefix.
+    if (row.class === 'PROVENANCE_REVIEW' && !MIXED_USE_MINT_PREFIXES.has(prefix) && !GREENFIELD_MINT_PREFIXES.has(prefix)) {
+      throw new Error(`PROVENANCE_REVIEW row has no recognized mint-prefix candidate: ${row.sku || '<blank>'}`);
     }
+
     if (verifiedLedger.assignedCodes.has(candidate.toUpperCase())) {
-      stats.minted_residue += 1;
+      stats.minted_residue += 1; // an exact reverted-mint code → re-scrape, never self-copy
       return {
         ...row,
         class: 'MINT_RESIDUE_RESCRAPE', candidate: null, collides: false,
         group: 'rescrape_program_TK10900', provenance: 'exact_phase4_undo_ledger_match',
       };
     }
+    // Not in the ledger. A row that was HELD/blocked is now proven scraper-native;
+    // a row already headed to self-copy stays as-is (already correct).
+    if (row.class === 'SELF_COPY_DW') { stats.unchanged += 1; return { ...row }; }
     stats.proven_native += 1;
     return {
       ...row,
diff --git a/test/fixtures/phase4-ledger.jsonl b/test/fixtures/phase4-ledger.jsonl
index 022a413..e2a75e7 100644
--- a/test/fixtures/phase4-ledger.jsonl
+++ b/test/fixtures/phase4-ledger.jsonl
@@ -1,3 +1,4 @@
 {"assigned_dw_sku":"DWKN-900001","vendor":"Knoll"}
 {"assigned_dw_sku":"DWTT-900002","vendor":"Thibaut"}
 {"assigned_dw_sku":"DWAG-100001","vendor":"Carnegie"}
+{"assigned_dw_sku":"DWPR-500001","vendor":"Phillipe Romano"}
diff --git a/test/fixtures/provenance-plan.jsonl b/test/fixtures/provenance-plan.jsonl
index febefa1..f739d13 100644
--- a/test/fixtures/provenance-plan.jsonl
+++ b/test/fixtures/provenance-plan.jsonl
@@ -3,3 +3,4 @@
 {"vendor":"Carnegie","sku":"DWAG-100001-Sample","class":"MINT_RESIDUE_RESCRAPE","candidate":null,"collides":false,"group":"rescrape_program_TK10900"}
 {"vendor":"Carnegie","sku":"DWAG-376000-Sample","class":"MINT_RESIDUE_RESCRAPE","candidate":null,"collides":false,"group":"rescrape_program_TK10900"}
 {"vendor":"Phillip Jeffries","sku":"DWPP-200001-Sample","class":"SELF_COPY_DW","candidate":"DWPP-200001","collides":false,"group":"recoverable_now_self_copy"}
+{"vendor":"Phillipe Romano","sku":"DWPR-500001-Sample","class":"SELF_COPY_DW","candidate":"DWPR-500001","collides":false,"group":"recoverable_now_self_copy"}
diff --git a/test/provenance-ledger.test.mjs b/test/provenance-ledger.test.mjs
index 7875547..9b28939 100644
--- a/test/provenance-ledger.test.mjs
+++ b/test/provenance-ledger.test.mjs
@@ -9,7 +9,7 @@ import { loadVerifiedLedger, joinPlanRows, REQUIRED_BACKUP_TABLE } from '../prov
 const fixture = (name) => new URL(`./fixtures/${name}`, import.meta.url);
 const ledgerBuffer = readFileSync(fixture('phase4-ledger.jsonl'));
 const ledgerSha = createHash('sha256').update(ledgerBuffer).digest('hex');
-const validManifest = { backup_table: REQUIRED_BACKUP_TABLE, complete: true, row_count: 2, sha256: ledgerSha };
+const validManifest = { backup_table: REQUIRED_BACKUP_TABLE, complete: true, row_count: 4, sha256: ledgerSha };
 
 function tempManifest(overrides = {}) {
   const dir = mkdtempSync(join(tmpdir(), 'tk10896-ledger-'));
@@ -18,17 +18,29 @@ function tempManifest(overrides = {}) {
   return path;
 }
 
-test('verified complete ledger releases only codes excluded from exact mint set', () => {
+test('verified ledger is authoritative for BOTH mixed-use holds AND greenfield pre-blocks', () => {
   const ledger = loadVerifiedLedger(fixture('phase4-ledger.jsonl'), tempManifest());
   const plan = readFileSync(fixture('provenance-plan.jsonl'), 'utf8').trim().split('\n').map(JSON.parse);
   const joined = joinPlanRows(plan, ledger);
-  assert.deepEqual(joined.stats, { rows: 4, minted_residue: 1, proven_native: 1, unchanged: 2 });
-  assert.equal(joined.rows[0].class, 'MINT_RESIDUE_RESCRAPE');
+  // residue: DWKN-900001 (mixed-use), DWAG-100001 (greenfield), DWPR-500001 (plain
+  // SELF_COPY_DW whose code IS in the ledger — the gap the prefix buckets missed).
+  // proven-native: DWKN-250001 + DWAG-376000 (held, absent from ledger).
+  // unchanged: DWPP-200001 (already self-copy, absent from ledger).
+  assert.deepEqual(joined.stats, { rows: 6, minted_residue: 3, proven_native: 2, unchanged: 1 });
+  assert.equal(joined.rows[0].class, 'MINT_RESIDUE_RESCRAPE');       // DWKN-900001 in ledger
   assert.equal(joined.rows[0].candidate, null);
-  assert.equal(joined.rows[1].class, 'SELF_COPY_DW_PROVEN_NATIVE');
+  assert.equal(joined.rows[1].class, 'SELF_COPY_DW_PROVEN_NATIVE');  // DWKN-250001 not in ledger
   assert.equal(joined.rows[1].candidate, 'DWKN-250001');
-  assert.equal(joined.rows[2].class, 'MINT_RESIDUE_RESCRAPE');
-  assert.equal(joined.rows[3].class, 'SELF_COPY_DW');
+  assert.equal(joined.rows[2].class, 'MINT_RESIDUE_RESCRAPE');       // DWAG-100001 = a REAL reverted mint
+  // REGRESSION 1: the greenfield prefix guard MUST NOT keep a scraper-native code in
+  // rescrape when the ledger proves it was never minted (Carnegie DWAG-376xxx).
+  assert.equal(joined.rows[3].class, 'SELF_COPY_DW_PROVEN_NATIVE');
+  assert.equal(joined.rows[3].candidate, 'DWAG-376000');
+  assert.equal(joined.rows[4].class, 'SELF_COPY_DW');                // DWPP-200001 not in ledger, unchanged
+  // REGRESSION 2: a plain SELF_COPY_DW whose code IS in the ledger (prefix in no
+  // guard set, e.g. DWPR) MUST be caught as residue — ledger is authoritative.
+  assert.equal(joined.rows[5].class, 'MINT_RESIDUE_RESCRAPE');
+  assert.equal(joined.rows[5].candidate, null);
 });
 
 test('manifest must attest exact backup table and completeness', () => {
@@ -37,7 +49,7 @@ test('manifest must attest exact backup table and completeness', () => {
 });
 
 test('manifest row count and digest fail closed', () => {
-  assert.throws(() => loadVerifiedLedger(fixture('phase4-ledger.jsonl'), tempManifest({ row_count: 3 })), /row_count mismatch/);
+  assert.throws(() => loadVerifiedLedger(fixture('phase4-ledger.jsonl'), tempManifest({ row_count: 9 })), /row_count mismatch/);
   assert.throws(() => loadVerifiedLedger(fixture('phase4-ledger.jsonl'), tempManifest({ sha256: '0'.repeat(64) })), /SHA-256 mismatch/);
 });
 
@@ -52,5 +64,5 @@ test('duplicate assigned codes fail closed', () => {
 
 test('unrecognized provenance-review rows fail closed', () => {
   const ledger = loadVerifiedLedger(fixture('phase4-ledger.jsonl'), tempManifest());
-  assert.throws(() => joinPlanRows([{ sku: 'DWPP-1', class: 'PROVENANCE_REVIEW' }], ledger), /no recognized mixed-use candidate/);
+  assert.throws(() => joinPlanRows([{ sku: 'DWPP-1', class: 'PROVENANCE_REVIEW' }], ledger), /no recognized mint-prefix candidate/);
 });

← 7fdfb3a auto-data-snapshot: 2026-08-30T23:23:51 (2 data files) — tes  ·  back to Dw Sku Integrity  ·  TK-10896: record ledger-verified headline result in evidence a4e4aba →