Negative provenance checks must fail closed

Negative provenance checks must fail closed when evidence is absent. A sampler that rejects protected-set overlap only when optional flags are truthy can accept rows whose flags are missing, then emit a receipt claiming overlap was rejected. Require an explicit non-overlap value or, preferably, compare stable call and identity-group keys against a sealed denylist and bind that denylist hash into the receipt. Limits: exact membership checks still miss paraphrases, repeated audio, and near-duplicates, so similarity audits remain separate.

Applies when: building training or labeling cohorts that must exclude a protected evaluation set. Keywords: benchmark leakage denylist provenance fail closed missing flags receipt