Lock M10 provenance spec to Daniel's fork picks (P1=a, P2=a)

Settle the reshaped Milestone 10: thin capture-recipe fingerprint and
bank-only re-capture; P3/P4 closed as moot. Remove the pending-picks
banner in PLAN.md and stamp the provenance product note as settled.

PLAN.md

@@ -28,26 +28,26 @@ state persists via the index.
 fingerprint) on resample-from-sample, and ship a **"re-capture from source"**
 action that regenerates a sample from its recorded source. Reconciled with the
 dual-canvas (Phase D2) model. CONTEXT.md §Data model, §capture; product framing +
-the reconciliation forks in `docs/product/provenance.md`.
+the settled reconciliation in `docs/product/provenance.md`.
 **Verify (in DAW):** A sample resampled from a bank sample carries its parent id +
 recipe fingerprint; "re-capture from source" regenerates the file into the bank
 (never auto-inserting into the timeline — load-bearing principle); re-capture with
 an unchanged source + request is byte-identical to the original (bit-identical
 repeats); non-destructive to source items/tracks.
 
-> **PROPOSAL — pending Daniel's fork picks (2026-07-23).** Reshaped from the old
-> "provenance + null-test verify" M10. **Cut (fixed by Daniel):** the null-test
-> verification *action* and the true-pre-FX-dry *mechanism* the old note required —
-> both dropped, see `docs/product/provenance.md` §What was cut. **Kept:** provenance
-> + re-capture. The `Sample.provenance` struct and its JSON round-trip **already
-> exist** (M1) — M10 populates and consumes the field, it does not add it. The points
-> below reflect the **leaned path** (bank-only re-capture, thin fingerprint); the
-> re-place variant is deferred behind forks P2–P4. Lock the points once Daniel picks.
+> **Reshaped from the old "provenance + null-test verify" M10.** **Cut (fixed by
+> Daniel):** the null-test verification *action* and the true-pre-FX-dry *mechanism*
+> the old note required — both dropped, see `docs/product/provenance.md` §What was
+> cut. **Kept:** provenance + re-capture. The `Sample.provenance` struct and its JSON
+> round-trip **already exist** (M1) — M10 populates and consumes the field, it does
+> not add it. Fork picks settled by Daniel (2026-07-23): **P1=a thin fingerprint,
+> P2=a bank-only re-capture**; P3/P4 moot under P2=a. The points below are locked to
+> that path.
 
 - [ ] Populate `Sample.provenance` on resample-from-sample: `parentSampleId` (the
-  bank sample the capture derived from) + `fxChainSnapshot` as a **capture-recipe
-  fingerprint** (scope + source FX-chain identity at capture time — a drift/repro
-  fingerprint, NOT a pre-FX-dry chain; see product note fork P1).
+  bank sample the capture derived from) + `fxChainSnapshot` as a **thin capture-recipe
+  fingerprint** (scope + source FX-chain identity/hash at capture time — a drift/repro
+  fingerprint, NOT a serialized pre-FX-dry chain to restore; P1=a settled).
 - [ ] "Re-capture from source" action: regenerate a provenanced sample by re-running
   its recorded capture request against the source's **current** state; update the
   bank file + Sample in place. **Bank-only — never inserts/re-places into the
@@ -56,14 +56,14 @@ repeats); non-destructive to source items/tracks.
   capture (bit-identical repeats); non-destructive (`FxBypassGuard` snapshot/restore
   as M7); relative-paths-only preserved.
 
-**Dual-canvas reconciliation (forks for Daniel — `docs/product/provenance.md`):**
-Under the leaned path (bank-only re-capture) provenance is **pure per-sample bank
-metadata**, `bank_model` and `view_mode_model` **stay decoupled**, and M10 touches
-no canvas code — compliance is satisfied by staying on the right side of the
-capture-never-places line. Forks P3 (canvas/lane memory in provenance) and P4
-(re-capture auto-tag interaction) only wake up if Daniel wants **P2 =
-re-capture-and-replace-on-timeline**, which would make re-place a mode-aware
-placement. Awaiting picks on P1 (fingerprint shape) and P2 (re-capture scope).
+**Dual-canvas reconciliation (settled — `docs/product/provenance.md`):** With
+bank-only re-capture (P2=a), provenance is **pure per-sample bank metadata**,
+`bank_model` and `view_mode_model` **stay decoupled**, and M10 touches **no** canvas
+code. Dual-canvas compliance is satisfied by staying on the right side of the
+capture-never-places line — not by any new coupling. Forks P3 (canvas/lane memory in
+provenance) and P4 (re-capture auto-tag interaction) were only live under
+re-capture-and-replace (P2=b) and are **closed as moot**; if the user manually
+re-places a regenerated sample, the existing D2 mode-aware placement rule governs.
 
 ## Milestone 11 — polish
 **Goal:** Batch capture (per selected item / per razor area),