Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md); WO-44..49 added 2026-09-08 from the source-verified review v1.1 (docs/reports/MIZOKI_ACQUISITION_ECONOMICS_REVIEW_v1.1_2026-09-06.md, verified on main 635318712). Findings are hypotheses until reproduced on current main (WO-00).

Finding (OPEN_ITEMS V4-4 + memory ledger a1ec34ccc, 9454163f4, 2026-09-05): docs/misc/mycocoons_customers.csv (real PII, Option A decided 2026-09-02) — serving exposure closed and live-verified 2026-09-02T19:48Z, but the history purge is NOT executed; scope is seven repository-history paths across all refs (the original five on main plus two side-branch-only paths, corrected in docs/reports/WS0_PII_SCANNER_REPORT_2026-09-01.md §10.2). The 5 Sep audit adds: the purged CSV is still tracked in the MIZ clone, and the export exists in at least three places, one in a local folder that looks like Google Drive but is not. Files: repo history (seven paths across all refs in docs/reports/WS0_PII_SCANNER_REPORT_2026-09-01.md §10.2); the MIZ clone; the local pseudo-Drive folder; any Drive mirror. Fix: owner-run maintenance window after the audit lanes land (history rewrite invalidates every open audit/* branch — sequence it); force-push under ruling; every clone re-cloned; delete the non-repo copies; record closure evidence (git log --all -- <path> empty for each repo-history path; file hashes absent from the MIZ clone, local pseudo-Drive folder, and any Drive mirror) without copying any customer row into a report. Acceptance: closure evidence in OPEN_ITEMS.md V4-4 for all copies; scanner report re-run clean. Depends on: none (but sequence AFTER the audit/* merges). Owning prompt: owner (WO-40..43 class).