`evidence/PROVENANCE-HOLD-2026-08-30.md`

37 lines
# TK-10896 — mixed-prefix provenance hold

This phase closes the unsafe default identified by the prior analysis: rows in
mixed-use Phase-4 prefixes were still routed to self-copy even though the exact
reverted-mint numbers are not available on the Mac2 mirror.

Canonical ticket evidence establishes that the retained undo source is
`sku_repair_p4_20260826`, but a read-only `information_schema` lookup found no
matching table in the local mirror. Canonical/Kamatera access was explicitly out
of scope, so no remote lookup was attempted.

The classifier now fails closed:

- Greenfield mint prefixes remain `MINT_RESIDUE_RESCRAPE` with no candidate.
- Mixed native/minted prefixes `DWKN/DWTT/DWRW/DWJS/DWRO/DWCC` become
  `PROVENANCE_REVIEW` with no candidate until the undo ledger resolves them.
- A candidate already used by another active product remains a definite collision;
  that stronger fact routes to TK-10649 rather than being hidden by provenance review.
- Other self-copy candidates must still be literal prefixes of the row's existing SKU.

Fresh SELECT-only Mac2 mirror scan (`34,614` active blank rows):

- `21,555` recoverable-now self-copy (down from the unsafe `25,623`)
- `4,082` provenance review / exact-ledger required
- `8,962` rescrape
- `9` definite collision/dedup
- `6` staging-link

The scanner generated a 34,614-row local plan, the E2E verifier checked every row,
then the plan was removed to avoid retaining a large identifier dump. The compact
summary remains at `evidence/mac2-mirror-provenance-hold-2026-08-30.json`.

No DB write, canonical/Kamatera access, mint, cleanup of user data, deploy, or
Shopify action occurred. The safest next action is a separately authorized
read-only export of the exact retained undo ledger, followed by a local join that
releases only proven-native rows from `PROVENANCE_REVIEW`.