docs(rights): samples-extra is yaxu's course pack — which un-clears kick rather than clearing snare

PLN said snare was 'also a default tidalcycles CC0/public domain pack'.
Upstream disagrees: tidalcycles/Dirt-Samples tracks 52 files under sn/ and
zero under snare/. The 90-file snare bank is local and was unidentified.

His second memory was the one that paid — 'the very early tidalcycles docs
pointed me to that sample pack'. The banks come from slab.org/tmp/samples-extra.zip,
the Tidal Club course pack from Week 1 lesson 2. Proven by reading the zip's
central directory over a range request, so 113 MB stayed on the server:
SNARE0, SNARE119, KICK142, CLAP163 are all in it, and the local folder is
named samples-extra.

Three candidates died on dates and names, which is worth recording so nobody
re-runs them: Blood Sport prefixes its banks bs- and holds no SNARE*.wav; the
90s-sample-cds torrent was downloaded 2024-12-20, after these files' 2019-11-07
mtime; MF_Drums_Samples names its files BD_MF_Valve11.wav. And there is no
content-based route at all — AcoustID needs song-length audio, not 0.4s hits.

The uncomfortable part: this makes the ledger worse, not better. The pack ships
no licence for these banks — the only licence file in it is Blood Sport's own.
And snare's files carry ISFT 'Sonic Foundry Sound Forge 6.0', IENG 'TJ', ICRD
2003-08-30, i.e. 24-bit one-shots rendered on a 2002 commercial DAW. An official
course pack establishes provenance, not licence.

So kick, cleared on 2026-08-16 on the note 'TidalCycles official / samples-extra
CC0 pack', rests on the same unverified premise. Same pack, same absent licence,
but cleared is releasable and unknown blocks. One question to yaxu settles six
banks at once.

TASKS_DUMP.md

@@ -808,3 +808,50 @@ real events, not unit tests on pure functions).
 3. OLED sketchpad — render 128x64 frames so the visual language is judged by eye.
 4. HUD `scene-off` latch (`scenes.js:236` / `:284`).
 5. Then: surface driver → play a track → judge the migration.
+
+### 🔎 A4 SOLVED (provenance) / REOPENED (verdict) — `samples-extra` is yaxu's course pack
+
+PLN's memory was right about the route: *"iirc its the very early tidalcycles docs that
+pointed me to that sample pack."* Chased to a definitive answer.
+
+**Provenance, proven.** `snare`, `kick`, `clap`, `break`, `rash`, `dsynth`, `cpu`, `cpu2`
+and the Blood Sport banks all come from **`https://slab.org/tmp/samples-extra.zip`** —
+the Tidal Club course pack, linked from Week 1 lesson 2 ("Loading sample packs"),
+Last-Modified 2022-03-17. Verified by reading the zip's central directory over a
+**range request** (113 MB never downloaded): `SNARE0.wav`, `SNARE119.wav`, `KICK142.wav`,
+`CLAP163.wav` all present, and the local dir is literally named `samples-extra`.
+Recorded per-bank in `rights_ledger.json` under a new `provenance` key; `status` left
+alone because the tool documents it as *"a human verdict"*.
+
+Ruled out along the way, each on evidence not vibes:
+- **Blood Sport** — its banks are `bs`-prefixed (`bssnare`, `bskick`); zero `SNARE*.wav`.
+- **`90s-sample-cds.torrent`** — downloaded 2024-12-20, *after* the files' 2019-11-07
+  mtime, and contains zero `SNARE###.wav`.
+- **`MF_Drums_Samples.zip`** — different naming (`BD_MF_Valve11.wav`), zero SNARE entries.
+- **`tidalcycles/samples-extras`** — does not exist (GitHub API: Not Found).
+- No content-based route exists: AcoustID/Chromaprint need song-length audio, not 0.4 s
+  one-shots. Metadata + filename + archive-listing is the only real path. Say so rather
+  than implying a reverse audio search was tried.
+
+**The verdict got WORSE, not better — and this is the part that matters.**
+The pack ships **no license file** for these banks (the only one in the whole zip is
+`bsreadme.txt`, Blood Sport's own, crediting Hybrid Vigour / Algomech 2016). Meanwhile
+`snare`'s files carry RIFF INFO `ISFT='Sonic Foundry Sound Forge 6.0'`, `IENG='TJ'`,
+`ICRD=2003-08-30/2003-09-02` — 44.1k/24-bit stereo one-shots rendered on a 2002-era
+commercial DAW. That reads as content off a commercial sample CD, redistributed for
+teaching. Being in an official *course* pack establishes **provenance, not licence.**
+
+- [ ] 🔴 **`kick` may need to be UN-CLEARED.** It was set `cleared` on 2026-08-16 with the
+      note *"TidalCycles official / samples-extra CC0 pack"* — the identical unverified
+      premise PLN applied to `snare` today. Same pack, same absent licence. Either both
+      clear or neither does; today they disagree, and `cleared` is releasable while
+      `unknown` blocks (`RELEASABLE = original|cleared|dirt_samples`).
+- [ ] ⭐ **ONE external question resolves six banks:** ask yaxu / the Tidal Club thread
+      what licence `samples-extra.zip` carries. Highest leverage item on A4 by far —
+      cheaper than fingerprinting and it settles snare, kick, clap, break, rash, dsynth
+      together. `cpu`/`cpu2` are separately defensible: PLN holds redeem codes from
+      shop.cpurecords.net, a direct purchase, which beats the course pack as a claim.
+- [ ] If the answer is "no licence / unknown", the release-safe move for the 4 gated
+      tracks is **substitution** — upstream's real snare bank is `sn` (52 files tracked
+      in `tidalcycles/Dirt-Samples`), not `snare`. That changes the sound, so it is
+      PLN's taste call, not a chore.