PLN: "cant push the single tracks when samples hit, but full mix might well
pass!" — which matches the measurement (an isolated track flagged where the
87-minute mix passed). So the gate on a per-track release is per BANK, and this
tool answers "what is in here and where did it come from". The verdict stays
his, recorded once in rights_ledger.json so it is never re-litigated.

THE DISCRIMINATOR IS THE WHOLE COMMIT. "Lives in the Dirt-Samples folder" is not
"is a Dirt-Samples bank": 56 of OPAL-26's 60 banks resolve to that directory,
including the_revolution, like_sugar, desire, wap and crimewave — because local
banks were dropped in beside the quark's own. Classifying by location would have
returned a confident, comprehensively wrong LOW-RISK verdict on the most
obviously sampled material in the set. That is the same shape as reading a role
off a sample's name.

The quark is a git checkout, so `git ls-files` settles it exactly:
217 upstream banks, 509 added locally. Tracked = ships with the quark under its
license, auto-verdict `dirt_samples`. Untracked = provenance unknown to the
tool, so `unknown`, which blocks by design. A bank in the score but not on disk
reports UNRESOLVED rather than passing as safe.

RANKED BY LEVERAGE, not alphabetically. 41 open banks reads as 41 equal chores;
in fact five gate almost the whole record — jungle_breaks (14 tracks), h2ogmhh
(9), kick (9), risers (8), vec1_claps (6). Answering those five changes the
shape of the release; answering `take5` changes one track. Keystone first.

First run on OPAL-26: 60 distinct banks, 19 upstream and clear, 41 open, so all
15 tracks currently block. That is the honest starting position, not a failure —
and it is per-track only. The continuous mix remains the lower-risk artefact and
is a separate question.