We have a believable explanation of what happened, although not what triggered it.
Support believes that a sync from a (long unused) sandbox…
- Overwrote good data in some records
- Created an extra record for others
This is believable. We did some comparisons and it looks like records that don’t exist in sandbox are unchanged in live, while changed live records were revised to match their sandbox counterparts.
So the issue now is what triggered this. The user who maintains the data does this on a regular basis and does not use the sandbox. It seems unlikely that she would have used the sandbox by accident.
This is an old site with one collection that uses the sandbox as part of the workflow. We’re going to redesign that workflow so we can completely disable sandbox for the site.