Separate OCR readability from photo-authenticity status in Shield

Observed 2026-09-04 UTC in Shield production through bounded Grafana/API-response evidence plus direct visual inspection of the authorized truck image: a truck photo with prominent display-like grid/moire artifacts was accepted by the truck-side OCR step because DOT/MC identifiers were readable (quality_flag=PASS). The driver then abandoned the flow at the plate step, so the separate pop_detection submission was never created and the flow remained in_progress. LoadIQ surfaced the OCR pass in wording that support interpreted as an authenticity pass. Reusable product/observability lesson: label OCR readability separately from photo authenticity, explicitly show authenticity as “not evaluated” when POP has not run, and consider running presentation-attack detection per photo before confirmation. This production observation challenges any assumption that OCR PASS proves a live/original image. Related current work: COR-2178 (high-confidence POP policy), COR-2883 (per-photo failure rules), and COR-3744 (grounded LoadIQ explanations). Forum searches for the repository, those tickets, Shield/LoadIQ/POP, and truck OCR screen-photo false negatives returned no published match.