Phases 3-4 — Provenance patch rehearsal, apply, consistency

Phase 3 — rehearsal (ROLLBACK transaction)

BEGIN; INSERT wf_scanner_run_log; UPDATE workflow_scanner_registry (6 rows); ... ROLLBACK; → in-tx both advanced to now(); after ROLLBACK both reverted to frozen. SQL valid, idempotent, fully reversible. INSERT 0 1, UPDATE 6.

Phase 4 — apply

1. Backed up script → wf_scan_orchestrator.sh.bak-20260605-prov.
2. Installed patched script (diff = only the additive provenance block; bash -n OK).
3. Ran one controlled manual scan → rc=0; provenance block: INSERT 0 1, UPDATE 6. Scan stable (universe=453, fs_orphan=143, health 16/16, drift gap=35).
4. Verified: wf_scanner_run_log.run_at=2026-06-05 09:02:03, workflow_scanner_registry.last_run_at/last_success_at=2026-06-05 09:02:04 (both unfrozen).
5. Birth-free (1,205,469==1,205,469 across the consistency DDL); OOM: no signal-9.

Consistency (new honesty gap closed)

After wiring, the literal-labeled views over-reported a fixed lie and RGT4 (asserted the lie exists) would have failed. Made 3 views DERIVED (teeth preserved — re-freeze ⇒ re-stale/re-fail):

• v_rp_scanner_automation_reality: the 2 provenance components → REAL_AUTOMATION_WIRED when wf_scanner_run_log.max(run_at) >= wf_adapter_run_log.max(started_at).
• v_rp_db_host_source_drift_detector: scanner_provenance row → RESOLVED_WIRED (non-actionable); actionable drift 4→3.
• v_rp_adapter_automation_regression_guard: RGT4 reframed → "provenance wired & fresh"; guard 8/8.

Artifacts: /opt/incomex/docs/mcp-writes/rp-automation-actuation-realrun-closeout-2026-06-05/{wf_scan_orchestrator.original.sh, wf_scan_orchestrator.patched.sh, 01_provenance_consistency_apply.sql, 99_provenance_rollback.sql}.