docs: clarify pre-migration provenance silence

[Chris0Jeky]

Summary

Clarify the shipped #2494 status entry for the fail-closed provenance projection: pre-migration rows can retain a real-looking ModelId while Provider is unavailable, so the metadata endpoint withholds all display fields rather than guessing; capture-linked Paper fallback remains explicit. Also correct the stale 'two values' wording to cover the trusted producer/usage fields.

Verification

• node scripts/check-docs-governance.mjs
• node scripts/check-golden-principles.mjs
• git diff --check

No runtime behavior or data policy changed.

Refs #2499

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Chris0Jeky]

Closed by the coordinator (2026-09-06) under the STATUS lease, not on content. The fresh-context review confirmed the new wording is true against the code and the D-2 ruling (fail-closed MapMetadata, no backfill, five [JsonIgnore] trusted fields, the identity-checked capture-detail fallback), but the edit rewrites a preserved dated block (the seventh, 2026-09-04) in place and drops that block's only pointer to #2499; docs/STATUS.md keeps older blocks as written and corrects them from a new dated block. The clarification is carried, with credit, in the twentieth block's corrections list (PR #2759). Nothing else from this PR is lost.

[Chris0Jeky]

Fresh-context review record (coordinator, 2026-09-06; read-only Opus 5 reviewer over the diff against the merge base; route: the standing D-12 rule for Codex-session PRs — review, fix MEDIUM+ in-PR, merge, disposition comment).

VERDICT: FIX-FIRST → closed under the STATUS lease (see the closing comment). Content check passed: MapMetadata returns empty metadata whenever Provider is null (fail-closed, no sentinel allow-list, matching D-2 (ii) A), no backfill claimed (matching (iii) B), CreateProposalDto carries five [JsonIgnore] trusted fields, and the identity-checked capture-detail fallback exists. HIGH (contract): the edit rewrites the preserved seventh block (2026-09-04) in place and deletes its only #2499 pointer; STATUS corrects preserved blocks from a new dated block, which the coordinator does in PR #2759.