The first real cohort found the leak: one artifact was calibrating every stat

Shadow converged at 18:09:07Z and the 19:00Z slot produced cohort 0353c551.
It immediately falsified something no test had asked: 513 PUBLISHED NON-HITS
rows came back CERTIFIED_CALIBRATED with a served probability drawn from the
mlb-hits curve — total_bases 246, runs 149, rbi 125, walks 109, outs 28,
strikeouts 24, hits_allowed 20, earned_runs 17.

Two bugs, one on top of the other. `mergeProbabilityContract` passed only
{model_version, p_win}, dropping the row's identity; and the service's resolve
then stamped the {sport, stat} it had been BUILT with onto every read. So all
3,000 rows in the batch resolved as mlb hits.

The governance tests could not see it. They asked "does build() refuse another
stat?" — it does, and always did — and then exercised the merge with
hits-only rows. Production sends one mixed batch. The regression test now drives
the REAL collector with hits, total_bases, rbi, runs, walks, strikeouts and
home_runs at the same p_win and requires hits certified and every other stat
neither certified nor numeric.

Fixed in three layers, because one would have been the same single point that
just failed:
  1. the service no longer substitutes its own identity — the row's decides,
     and a read naming no stat resolves to no contract, which is UNSUPPORTED;
  2. the merge carries the row's sport and stat;
  3. probabilityContract refuses an artifact whose own sport/stat disagree with
     the contract it is being used under, independent of plumbing.

NO USER IMPACT. Shadow only: every block carries servable:false, live serving is
OFF, CALIBRATION_DEPLOYED is [], and the anonymous payload showed zero
calibration fields before and after. But this is exactly the defect that would
have served a hits calibration curve for strikeouts on the day live was enabled,
and only a real cohort surfaced it.

Two teeth were themselves wrong. Both runners checked "retention identity
changes" by grepping the diff for `stat:`, which fired on `stat: r.stat` — a
line that READS identity to hand it to a reader, not one that changes what
identifies a row. A guard that cannot tell those apart blocks the fix for the
defect it exists to protect against. Both are now behavioural: build a row
through the real collector and compare the identity tuple.

Artifact unchanged: mlb-hits-isotonic@2026-09-03, knot 5ae940ea163b7da2.
Suite 405/405, 5,659 passed. Teeth 34/34 + 10/10 + 23/23.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQJeAG8vcDoL5zkiaJyVb8

scripts/teeth-artifact-governance.js

@@ -187,10 +187,31 @@ logic(22, 'live serving enabled', () => {
 
 // 23-26 — the frozen neighbours
 logic(23, 'retention identity changes', () => {
-  const d = execSync(`git -C ${ROOT} diff --unified=0 -- src/services/retentionService.js`).toString();
-  const fields = ['player_key:', 'snapshot_id:', 'canonical_event_id:', 'game_id:', 'stat:', 'line:', 'side:'];
-  const touched = fields.filter((f) => new RegExp(`^[-+].*${f.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`, 'm').test(d));
-  return { caught: touched.length === 0, detail: `identity fields in diff: ${touched.join(', ') || 'none'}` };
+  // BEHAVIOURAL, not a diff grep. The grep version fired on `stat: r.stat` —
+  // a line that READS identity to pass it to a reader, not one that changes
+  // what identifies a row. A guard that cannot tell those apart blocks the fix
+  // for the defect it was meant to protect against.
+  const retention = require(path.join(ROOT, 'src/services/retentionService'));
+  const c = retention.createCollector({
+    snapshotId: 'snap-teeth', sport: 'mlb', modelVersion: 'engine1@2026-08-07-fullwindow',
+    codeSha: 'teeth', gameDate: '2026-09-03', gameIdFor: () => 'mlb:2026-09-03:AAA@BBB',
+  });
+  c.onGraded({ player: 'Test Hitter', stat_type: 'hits', line: 0.5, sport: 'mlb',
+    over_odds: -110, under_odds: -110, canonical_event_id: 'mlb:gamepk:1' },
+  [{ direction: 'over', grade: 'C+', p_win: 0.65, confidence: 65 }]);
+  const row = c.rows[0];
+  const identity = {
+    snapshot_id: row.snapshot_id, game_id: row.game_id,
+    canonical_event_id: row.canonical_event_id, player_key: row.player_key,
+    stat: row.stat, line: row.line, side: row.side,
+  };
+  const expected = {
+    snapshot_id: 'snap-teeth', game_id: 'mlb:2026-09-03:AAA@BBB',
+    canonical_event_id: 'mlb:gamepk:1', player_key: 'test hitter',
+    stat: 'hits', line: 0.5, side: 'over',
+  };
+  const wrong = Object.keys(expected).filter((k) => identity[k] !== expected[k]);
+  return { caught: wrong.length === 0, detail: `identity tuple mismatches: ${wrong.join(', ') || 'none'}` };
 });
 logic(24, 'participant identity changes', () => {
   const f = execSync(`git -C ${ROOT} diff --name-only`).toString().trim().split('\n').filter(Boolean)
@@ -249,6 +270,28 @@ logic(31, 'live serving turns on before all gates pass', () => {
     detail: `CALIBRATION_DEPLOYED empty=${deployedEmpty}; stage=${registry.PROMOTED['mlb:hits'].stage}; approved_for_live=${A.approved_for_live}` };
 });
 
+// ── 32 — THE CROSS-STAT LEAK (found by the first real cohort) ────────────
+inject(32, 'the hits curve is applied to other stats in a mixed batch',
+  'src/services/model/probabilityContractService.js',
+  `    resolve(read) {
+      return pc.resolve(read,`,
+  `    resolve(read) {
+      return pc.resolve({ ...read, sport, stat },`,
+  GOV);
+inject(33, 'the merge drops the row identity the resolver needs',
+  'src/services/retentionService.js',
+  `      res = contract.resolve({
+        sport: r.sport, stat: r.stat,
+        model_version: r.model_version, p_win: numOrNull(r.p_win),
+      });`,
+  `      res = contract.resolve({ model_version: r.model_version, p_win: numOrNull(r.p_win) });`,
+  GOV);
+inject(34, 'an artifact for another stat is accepted',
+  'src/services/model/probabilityContract.js',
+  `       || (deps.artifact.stat && deps.artifact.stat !== contract.stat))) {`,
+  `       || false)) {`,
+  GOV);
+
 const landed = results.filter((r) => r.landed).length;
 console.log(JSON.stringify({ teeth_landed: `${landed}/${results.length}`, results }, null, 2));
 process.exit(landed === results.length ? 0 : 1);