Check every provenance record: evidence resolves, review dates, orphans.
Evidence prefixes: file: must exist in the repository, commit: must be a commit of the repository, KB: must be an entry in the spot-knowledge directory (REGEN_KB_DIR, checked only when that directory exists), url: is not fetched.
list[Finding]: PROV02 errors for unresolved evidence, PROV03 warnings for records past review_after, PROV05 warnings for records neither a unit nor the architecture cites, PROV01 errors for unknown decisions cited by the architecture.