Make the conversation-tenant-unknown check's per-run DDB reads bounded by new/changed rows (or an index Query) instead of scanning every Conversation, proven by a prod run log and 48h clean in prod.
Status is DERIVED from each row’s own PR, decision and prod-evidence links by
bin/refresh-tracker convo-tenant-unknown-noscan — never typed. Last refreshed
2026-10-24 08:23Z.
Every row opens: when it was added, why it exists, and the links that prove it. Rows waiting on a human carry a Decide → link straight to the answerable question on the decisions page. Statuses are re-derived from live PR, decision and prod-evidence state by bin/refresh-trackers; nothing here is typed by hand. Merged and shipped both count as done (Gera, 2026-10-19); a prod_evidence permalink is what moves a row from Merged to Shipped.