Reshape M10 to provenance-only, reconciled with dual-canvas

Cut the null-test verify action and pre-FX-dry mechanism (Daniel's
call); keep provenance + re-capture-from-source. Sample.provenance
already exists/round-trips (M1), so M10 populates and consumes it. Add
docs/product/provenance.md with dual-canvas forks P1-P4 and the leaned
bank-only path; rewrite PLAN.md M10 as a proposal pending fork picks.

PLAN.md

@@ -23,21 +23,47 @@ state persists via the index.
 - [ ] Slot model + slot↔sample assignment.
 - [ ] "Capture to slot N" / "insert slot N" actions, MIDI-bindable.
 
-## Milestone 10 — provenance + null-test verify action
-**Goal:** Provenance (parent sample id + FX-chain snapshot) and "re-capture from
-source"; ship the null-test verification action. CONTEXT.md §Precision invariants,
-Build order 10.
-**Verify (in DAW):** **Null test** — a dry offline capture of a range, re-inserted
-at its source position, nulls to silence against the source. This action is the
-tool's trust anchor and must pass.
+## Milestone 10 — provenance (re-capture from source)
+**Goal:** Populate `Sample.provenance` (parent sample id + a capture-recipe
+fingerprint) on resample-from-sample, and ship a **"re-capture from source"**
+action that regenerates a sample from its recorded source. Reconciled with the
+dual-canvas (Phase D2) model. CONTEXT.md §Data model, §capture; product framing +
+the reconciliation forks in `docs/product/provenance.md`.
+**Verify (in DAW):** A sample resampled from a bank sample carries its parent id +
+recipe fingerprint; "re-capture from source" regenerates the file into the bank
+(never auto-inserting into the timeline — load-bearing principle); re-capture with
+an unchanged source + request is byte-identical to the original (bit-identical
+repeats); non-destructive to source items/tracks.
 
-- [ ] Provenance fields populated on resample-from-sample (parent id + FX-chain
-  snapshot string).
-- [ ] "Re-capture from source" action.
-- [ ] Null-test verification action (capture → re-insert at source pos → assert
-  silence sum).
+> **PROPOSAL — pending Daniel's fork picks (2026-07-23).** Reshaped from the old
+> "provenance + null-test verify" M10. **Cut (fixed by Daniel):** the null-test
+> verification *action* and the true-pre-FX-dry *mechanism* the old note required —
+> both dropped, see `docs/product/provenance.md` §What was cut. **Kept:** provenance
+> + re-capture. The `Sample.provenance` struct and its JSON round-trip **already
+> exist** (M1) — M10 populates and consumes the field, it does not add it. The points
+> below reflect the **leaned path** (bank-only re-capture, thin fingerprint); the
+> re-place variant is deferred behind forks P2–P4. Lock the points once Daniel picks.
 
-**Note (from M7):** The null test requires a TRUE pre-FX dry capture, which REAPER offline render cannot produce via RENDER_SETTINGS (there is no pre-FX bit). True dry must be obtained by bypassing the source FX around an offline render (snapshot→bypass→render→restore) OR via the M8 realtime post-fader track-tap path — so the dry-capture mechanism should be designed as part of the M10 null-test work.
+- [ ] Populate `Sample.provenance` on resample-from-sample: `parentSampleId` (the
+  bank sample the capture derived from) + `fxChainSnapshot` as a **capture-recipe
+  fingerprint** (scope + source FX-chain identity at capture time — a drift/repro
+  fingerprint, NOT a pre-FX-dry chain; see product note fork P1).
+- [ ] "Re-capture from source" action: regenerate a provenanced sample by re-running
+  its recorded capture request against the source's **current** state; update the
+  bank file + Sample in place. **Bank-only — never inserts/re-places into the
+  timeline** (load-bearing principle). Reports if the source drifted since capture.
+- [ ] Verify: re-capture of an unchanged source is byte-identical to the original
+  capture (bit-identical repeats); non-destructive (`FxBypassGuard` snapshot/restore
+  as M7); relative-paths-only preserved.
+
+**Dual-canvas reconciliation (forks for Daniel — `docs/product/provenance.md`):**
+Under the leaned path (bank-only re-capture) provenance is **pure per-sample bank
+metadata**, `bank_model` and `view_mode_model` **stay decoupled**, and M10 touches
+no canvas code — compliance is satisfied by staying on the right side of the
+capture-never-places line. Forks P3 (canvas/lane memory in provenance) and P4
+(re-capture auto-tag interaction) only wake up if Daniel wants **P2 =
+re-capture-and-replace-on-timeline**, which would make re-place a mode-aware
+placement. Awaiting picks on P1 (fingerprint shape) and P2 (re-capture scope).
 
 ## Milestone 11 — polish
 **Goal:** Batch capture (per selected item / per razor area),