Negative provenance checks must fail closed
Negative provenance checks must fail closed when evidence is absent. A sampler that rejects protected-set overlap only when optional flags are truthy can accept rows whose flags are missing, then emit a receipt claiming overlap was rejected. Require an explicit non-overlap value …