@mikeargento/bitgraph-player 0.6.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikeargento/bitgraph-player",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Deterministic evaluation of causal rules over BitGraph proof bundles: a pure function from (rule, verified evidence) to a reproducible verdict.",
   "license": "MIT",
   "type": "module",
@@ -26,18 +26,18 @@
   ],
   "scripts": {
     "build": "tsc",
-    "prepack": "tsc",
+    "prepack": "tsc && npm run build:web",
     "typecheck": "tsc --noEmit",
     "test": "tsc && node --test \"dist/__tests__/*.test.js\"",
-    "build:web": "node scripts/build-verify-html.mjs --out ../folder/src/verify.html",
+    "build:web": "node scripts/build-verify-html.mjs --out ../../website/public/verify.html",
     "typecheck:web": "tsc -p web/tsconfig.json"
   },
   "engines": {
     "node": ">=20"
   },
   "dependencies": {
-    "@mikeargento/bitgraph-audit": "^0.2.2",
-    "@mikeargento/bitgraph-verify": "^1.3.0"
+    "@mikeargento/bitgraph-audit": "^0.4.0",
+    "@mikeargento/bitgraph-verify": "^1.4.0"
   },
   "devDependencies": {
     "@noble/curves": "^2.3.0",

package/src/__tests__/check.test.ts

@@ -116,10 +116,11 @@ describe("check: real export fixture (disk)", () => {
 
   it("brackets the recording between the two verified block headers", () => {
     const b = report.recordings[0]!.bounds;
-    assert.equal(b.status, "bracketed");
+    assert.equal(b.status, "lower-bounded-with-following-anchor");
     assert.equal(b.notBefore?.blockNumber, "25735831");
     assert.equal(b.notAfter?.blockNumber, "25735832");
-    assert.match(b.detail, /after Ethereum block 25735831 and before block 25735832/);
+    assert.match(b.detail, /after Ethereum block 25735831 \(header verified in this bundle\); precedes an anchor that consumed block 25735832/);
+    assert.match(b.detail, /rather than an upper bound/);
   });
 
   it("orders anchors by causal position, not file name", () => {

package/src/__tests__/fixtures.ts

@@ -94,6 +94,8 @@ export function makeBound(partial: Partial<SegmentBound>): SegmentBound {
     weaker: partial.weaker ?? false,
     basis: partial.basis ?? "block-hash-unpredictability",
     claim: partial.claim ?? "fixture bound",
+    // Required since bitgraph-audit 0.3.0: a not-after bound is an assumption, never evidence.
+    boundClass: partial.boundClass ?? ((partial.kind ?? "not-before") === "not-before" ? "evidence" : "assumption"),
     ...(partial.blockNumber !== undefined ? { blockNumber: partial.blockNumber } : {}),
   };
 }
@@ -126,7 +128,7 @@ export function makeAudit(spec: FixtureAuditSpec): AuditResult {
   const segments = (spec.segments ?? []).map((s) => ({
     partition: { publicKeyB64: "key-A", chainId: "bitgraph:main" },
     memberProofHashes: s.members.map(proofHashOf),
-    status: "bracketed",
+    status: "lower-bounded-with-following-anchor",
     lowerBounds: (s.lowerBounds ?? []).map((b) => makeBound({ ...b, kind: "not-before" })),
     upperBounds: (s.upperBounds ?? []).map((b) => makeBound({ ...b, kind: "not-after" })),
   }));

package/src/__tests__/fuse-check.test.ts

@@ -0,0 +1,168 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+
+/**
+ * `check` over fused recordings (profile bitgraph-fuse/1, working name).
+ * Fixtures are real proofs minted through the local enclave harness
+ * (real signatures, fake PCR0), read-only here; no ledger, no network.
+ */
+
+import { describe, it } from "node:test";
+import * as assert from "node:assert/strict";
+import { readFile, mkdtemp, writeFile, rm, mkdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ingestBundle, ingestEntries } from "@mikeargento/bitgraph-audit";
+import type { AnchorRecord, BundleEntrySource, SegmentBound, TemporalSegment } from "@mikeargento/bitgraph-audit";
+import { checkIngest, fusedFloor, renderCheckText, serializeCheckReport } from "../check.js";
+
+const FIX = fileURLToPath(new URL("../../../../src/__tests__/fuse-fixtures/", import.meta.url));
+const read = (name: string) => readFile(join(FIX, name)).then((b) => new Uint8Array(b));
+
+async function entries(spec: Record<string, string>): Promise<BundleEntrySource[]> {
+  const out: BundleEntrySource[] = [];
+  for (const [path, fixture] of Object.entries(spec)) {
+    const bytes = await read(fixture);
+    out.push({ path, open: () => bytes });
+  }
+  return out;
+}
+
+describe("fused recordings in check", () => {
+  it("fused bytes beside the proof: fused line TRUE, floor undetermined without anchors, statements carried", async () => {
+    const report = await checkIngest(await ingestEntries(await entries({ "proof.json": "trailer.proof.json", "photo.bin": "fused-trailer.bin" })));
+    assert.equal(report.recordings.length, 1);
+    const rec = report.recordings[0]!;
+    const fused = rec.lines.find((l) => l.name === "fused");
+    assert.ok(fused, "a fused line exists");
+    assert.equal(fused!.result, "TRUE", fused!.detail);
+    assert.equal(rec.lines.find((l) => l.name === "file")?.result, "TRUE");
+    assert.equal(rec.lines.find((l) => l.name === "signature")?.result, "TRUE");
+    assert.ok(rec.fused);
+    assert.equal(rec.fused!.category, "FUSED_DIRECT");
+    assert.equal(rec.fused!.evidence, "fused-bytes");
+    assert.equal(rec.fused!.placement, "trailer/1");
+    assert.equal(rec.fused!.floor, null);
+    assert.match(rec.fused!.floorDetail, /floor undetermined: no anchor precedes this slot in its epoch/);
+    assert.equal(rec.fused!.statements.length, 2);
+    assert.match(rec.fused!.statements[1]!, /at position \d+, and were committed no later than position \d+/);
+    assert.ok(rec.fused!.span && BigInt(rec.fused!.span.positions) >= 1n);
+    // The harness attests with a fake document, so the attestation line is FALSE
+    // here; that is the harness, not the fused check, and it is reported on its
+    // own line. The fused line above stands regardless.
+    assert.notEqual(rec.lines.find((l) => l.name === "attestation")?.result, "TRUE");
+    const text = renderCheckText(report);
+    assert.match(text, /fused floor floor undetermined/);
+    assert.match(text, /fused span  slot \d+ to commit \d+/);
+  });
+
+  it("the original beside the proof: rebuilt, fused line TRUE, the original is noted as such and not as unmatched", async () => {
+    const report = await checkIngest(await ingestEntries(await entries({ "proof.json": "trailer.proof.json", "original.txt": "original.txt" })));
+    const rec = report.recordings[0]!;
+    const fused = rec.lines.find((l) => l.name === "fused")!;
+    assert.equal(fused.result, "TRUE", fused.detail);
+    assert.equal(rec.fused!.category, "FUSED_FROM_ORIGIN");
+    assert.equal(rec.fused!.evidence, "original");
+    // The committed bytes are not in hand, so the file line stays UNDETERMINED: the
+    // original receives the ceiling, the fused bytes the interval.
+    assert.equal(rec.lines.find((l) => l.name === "file")?.result, "UNDETERMINED");
+    assert.ok(report.notes.some((n) => /original of a fused recording: original\.txt/.test(n)), report.notes.join(" | "));
+    assert.ok(!report.notes.some((n) => /matches no recording here: original\.txt/.test(n)), "the original is not called unmatched");
+  });
+
+  it("neither bytes present: fused line UNDETERMINED, never FALSE", async () => {
+    const report = await checkIngest(await ingestEntries(await entries({ "proof.json": "trailer.proof.json" })));
+    const rec = report.recordings[0]!;
+    const fused = rec.lines.find((l) => l.name === "fused")!;
+    assert.equal(fused.result, "UNDETERMINED");
+    assert.match(fused.detail, /neither the fused bytes nor the original/);
+    assert.equal(rec.fused!.category, "NO_EVIDENCE");
+    assert.equal(rec.fused!.evidence, null);
+  });
+
+  it("a file committed under a different slot than its commitment names: fused line FALSE", async () => {
+    const report = await checkIngest(await ingestEntries(await entries({ "proof.json": "wrong-slot.proof.json", "photo.bin": "fused-wrong-slot.bin" })));
+    const rec = report.recordings[0]!;
+    assert.equal(rec.lines.find((l) => l.name === "fused")?.result, "FALSE");
+    assert.equal(rec.fused!.category, "INVALID_SLOT_COMMITMENT");
+    assert.equal(report.result, "FALSE");
+  });
+
+  it("an unregistered placement: UNDETERMINED with the placement named", async () => {
+    const report = await checkIngest(await ingestEntries(await entries({ "proof.json": "unregistered.proof.json", "photo.bin": "fused-unregistered.bin" })));
+    const rec = report.recordings[0]!;
+    const fused = rec.lines.find((l) => l.name === "fused")!;
+    assert.equal(fused.result, "UNDETERMINED");
+    assert.match(fused.detail, /xmp\/9/);
+  });
+
+  it("an ordinary recording has no fused line and no fused block", async () => {
+    const report = await checkIngest(await ingestEntries(await entries({ "proof.json": "recorded.proof.json", "original.txt": "original.txt" })));
+    const rec = report.recordings[0]!;
+    assert.equal(rec.lines.find((l) => l.name === "fused"), undefined);
+    assert.equal(rec.fused, undefined);
+    assert.equal(rec.lines.find((l) => l.name === "file")?.result, "TRUE");
+  });
+
+  it("container/1 from the PNG alone and produced/1 from its own bytes", async () => {
+    const a = await checkIngest(await ingestEntries(await entries({ "proof.json": "container.proof.json", "image.png": "image.png" })));
+    assert.equal(a.recordings[0]!.fused!.category, "FUSED_FROM_ORIGIN");
+    assert.equal(a.recordings[0]!.fused!.placement, "container/1");
+    const b = await checkIngest(await ingestEntries(await entries({ "proof.json": "produced-origin.proof.json", "record.json": "produced-origin.json" })));
+    assert.equal(b.recordings[0]!.fused!.category, "FUSED_DIRECT");
+    assert.equal(b.recordings[0]!.fused!.placement, "produced/1");
+  });
+
+  it("disk and memory ingests of the same fused bundle give byte-identical reports", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "bitgraph-fuse-check-"));
+    try {
+      await mkdir(dir, { recursive: true });
+      await writeFile(join(dir, "proof.json"), await read("trailer.proof.json"));
+      await writeFile(join(dir, "original.txt"), await read("original.txt"));
+      const fromDisk = await checkIngest(await ingestBundle(dir));
+      const fromMemory = await checkIngest(await ingestEntries(await entries({ "proof.json": "trailer.proof.json", "original.txt": "original.txt" })));
+      assert.equal(serializeCheckReport(fromDisk), serializeCheckReport(fromMemory));
+      assert.equal(fromDisk.recordings[0]!.fused!.category, "FUSED_FROM_ORIGIN");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("fusedFloor", () => {
+  const bound = (anchorProofHash: string, blockNumber: string, timestamp: number): SegmentBound => ({
+    kind: "not-before", anchorProofHash, blockNumber, blockHash: "0x" + "ab".repeat(32), timestamp,
+    evidence: "counter-order", weaker: true, basis: "block-hash-unpredictability", boundClass: "evidence", claim: "",
+  });
+  const anchor = (proofHash: string, counter: string): AnchorRecord => ({ proofHash, chainId: "bitgraph:main", counter, metadataCorroboration: "absent" } as unknown as AnchorRecord);
+  const segment = (lower: SegmentBound[]): TemporalSegment => ({ lowerBounds: lower } as unknown as TemporalSegment);
+
+  it("picks the last verified anchor whose counter precedes the SLOT, not the commit", () => {
+    const anchors = new Map([["a1", anchor("a1", "10")], ["a2", anchor("a2", "40")], ["a3", anchor("a3", "45")]]);
+    const seg = segment([bound("a1", "100", 1000), bound("a2", "200", 2000), bound("a3", "300", 3000)]);
+    // slot 42, commit 50: a3 (counter 45) precedes the commit but not the slot.
+    const floor = fusedFloor(seg, anchors, "42");
+    assert.equal(floor?.anchorProofHash, "a2");
+    assert.equal(floor?.blockNumber, "200");
+    assert.equal(floor?.evidence, "counter-order");
+  });
+
+  it("no anchor before the slot: null (UNDET), never a following anchor", () => {
+    const anchors = new Map([["a3", anchor("a3", "45")]]);
+    assert.equal(fusedFloor(segment([bound("a3", "300", 3000)]), anchors, "42"), null);
+    assert.equal(fusedFloor(undefined, anchors, "42"), null);
+    assert.equal(fusedFloor(segment([bound("a3", "300", 3000)]), anchors, undefined), null);
+  });
+
+  it("a slot off the anchored chain has no floor", () => {
+    const anchors = new Map([["a1", anchor("a1", "10")]]);
+    assert.equal(fusedFloor(segment([bound("a1", "100", 1000)]), anchors, "42", "global"), null);
+    assert.equal(fusedFloor(segment([bound("a1", "100", 1000)]), anchors, "42", "bitgraph:main")?.anchorProofHash, "a1");
+  });
+
+  it("only not-before bounds count; not-after bounds are never a ceiling", () => {
+    const anchors = new Map([["a9", anchor("a9", "5")]]);
+    const after: SegmentBound = { ...bound("a9", "900", 9000), kind: "not-after" };
+    assert.equal(fusedFloor(segment([after]), anchors, "42"), null);
+  });
+});

package/src/check.ts

@@ -63,7 +63,9 @@ import type {
   SegmentBound,
   TemporalSegment,
 } from "@mikeargento/bitgraph-audit";
-import { auditIngest, AUDIT_VERSION, streamMatchedArtifacts } from "@mikeargento/bitgraph-audit";
+import { auditIngest, AUDIT_VERSION, streamMatchedArtifacts, streamArtifactsByHash } from "@mikeargento/bitgraph-audit";
+import { readFuseAttribution, verifyFuse, base64ToBytes, bytesToHex, resetEpochLinkState } from "@mikeargento/bitgraph-verify";
+import type { FuseVerifyResult } from "@mikeargento/bitgraph-verify";
 import type { ThreeValued } from "./types.js";
 import { SIG_EVIDENCE_MAX_BYTES } from "./types.js";
 import { kleeneAll } from "./logic.js";
@@ -108,7 +110,7 @@ export const KNOWN_ENCLAVE_MEASUREMENTS: ReadonlyArray<{ pcr0: string; label: st
 
 /** One checked property, three-valued, with a plain-language reason. */
 export interface CheckLine {
-  name: "file" | "signature" | "attestation" | "enclave" | "witness" | "contradiction" | "domain";
+  name: "file" | "signature" | "attestation" | "enclave" | "witness" | "contradiction" | "domain" | "fused";
   result: ThreeValued;
   detail: string;
 }
@@ -125,12 +127,42 @@ export interface CheckBound {
 }
 
 export interface CheckBounds {
-  status: "bracketed" | "lower-bounded" | "upper-bounded" | "unanchored";
+  status: "lower-bounded-with-following-anchor" | "lower-bounded" | "upper-bounded" | "unanchored";
   notBefore?: CheckBound;
   notAfter?: CheckBound;
   detail: string;
 }
 
+/**
+ * The wall-clock floor of a fused artifact: the last verified anchored
+ * block preceding its SLOT counter in the same epoch chain. Counter-order
+ * evidence by construction (no hash path reaches a slot record), reported
+ * with the same "genuine block" assumption as every other bound.
+ */
+export interface CheckFloor {
+  blockNumber?: string;
+  blockHash: string;
+  /** Unix seconds from the verified block header. */
+  timestamp: number;
+  anchorProofHash: string;
+  evidence: "counter-order";
+}
+
+/** What the bundle establishes about a recording marked fused (profile bitgraph-fuse/1, working name). */
+export interface CheckFused {
+  category: FuseVerifyResult["category"] | "NO_EVIDENCE";
+  placement: string | null;
+  originDigestB64: string | null;
+  /** Which bytes in the bundle the commitment check ran against. */
+  evidence: "fused-bytes" | "original" | null;
+  /** The bounded statements, carrying the floor clause when a floor exists. */
+  statements: string[];
+  floor: CheckFloor | null;
+  floorDetail: string;
+  /** The causal span [N, M]. */
+  span: { slotCounter: string; commitCounter: string; positions: string } | null;
+}
+
 /** A non-anchor recording in the bundle. */
 export interface CheckRecording {
   proofHash: string;
@@ -146,6 +178,8 @@ export interface CheckRecording {
   /** Kleene all over `lines`. */
   result: ThreeValued;
   bounds: CheckBounds;
+  /** Present exactly when the proof's signed attribution marks it fused. */
+  fused?: CheckFused;
 }
 
 /** An Ethereum anchor recording in the bundle. */
@@ -227,6 +261,14 @@ export interface CheckOptions {
    * embedders may supply additional candidates.
    */
   sigEvidence?: ReadonlyMap<string, Uint8Array>;
+  /**
+   * Fuse evidence by proofHash: the verifyFuse result over the fused bytes
+   * (preferred) or the original, whichever the bundle holds. checkIngest
+   * collects this from the bundle; embedders may supply it.
+   */
+  fuseEvidence?: ReadonlyMap<string, FuseVerifyResult>;
+  /** Content hashes (hex) of files that served as the original of a fused recording; not "unmatched". */
+  fuseOriginHexes?: ReadonlySet<string>;
 }
 
 // ---------------------------------------------------------------------------
@@ -270,9 +312,57 @@ export async function checkIngest(ingest: IngestResult, options?: CheckOptions):
     opts = { ...opts, sigEvidence: collected };
   }
   const audit = await auditIngest(ingest, { startedAt: "" });
+  if (opts?.fuseEvidence === undefined) {
+    const collected = await collectFuseEvidence(ingest);
+    opts = { ...opts, fuseEvidence: collected.evidence, fuseOriginHexes: collected.originHexes };
+  }
   return buildCheckReport(audit, opts);
 }
 
+/**
+ * For every proof marked fused, find the bytes the check can run against:
+ * the committed (fused) bytes if the bundle holds them, else the original
+ * named by the signed origin digest. Runs after the audit pass and resets
+ * the verify library's epoch-link state around its own verifications.
+ */
+async function collectFuseEvidence(
+  ingest: IngestResult
+): Promise<{ evidence: Map<string, FuseVerifyResult>; originHexes: Set<string> }> {
+  const evidence = new Map<string, FuseVerifyResult>();
+  const originHexes = new Set<string>();
+  const wanted: Array<{ proof: ObservedProof; artifactHex: string | null; originHex: string | null }> = [];
+  const hexes = new Set<string>();
+  for (const proof of ingest.proofs) {
+    const marker = readFuseAttribution(proof.proof);
+    if (marker === null) continue;
+    const artifactBytes = base64ToBytes(proof.proof.artifact.digestB64);
+    const artifactHex = artifactBytes !== null ? bytesToHex(artifactBytes) : null;
+    const originHex = marker.originDigest !== undefined ? bytesToHex(marker.originDigest) : null;
+    wanted.push({ proof, artifactHex, originHex });
+    if (artifactHex !== null) hexes.add(artifactHex);
+    if (originHex !== null) hexes.add(originHex);
+  }
+  if (wanted.length === 0) return { evidence, originHexes };
+  const bytesByHex = new Map<string, Uint8Array>();
+  for await (const artifact of streamArtifactsByHash(ingest, hexes)) {
+    if (!bytesByHex.has(artifact.sha256Hex)) bytesByHex.set(artifact.sha256Hex, artifact.bytes);
+  }
+  resetEpochLinkState();
+  try {
+    for (const w of wanted) {
+      const direct = w.artifactHex !== null ? bytesByHex.get(w.artifactHex) : undefined;
+      const original = w.originHex !== null ? bytesByHex.get(w.originHex) : undefined;
+      if (original !== undefined && w.originHex !== null) originHexes.add(w.originHex);
+      const bytes = direct ?? original;
+      if (bytes === undefined) continue;
+      evidence.set(w.proof.proofHash, await verifyFuse({ proof: w.proof.proof, bytes }));
+    }
+  } finally {
+    resetEpochLinkState();
+  }
+  return { evidence, originHexes };
+}
+
 /** The pure report builder over an AuditResult. */
 export function buildCheckReport(audit: AuditResult, options?: CheckOptions): CheckReport {
   const webCrypto = options?.webCryptoAvailable ?? true;
@@ -316,7 +406,9 @@ export function buildCheckReport(audit: AuditResult, options?: CheckOptions): Ch
           artifactPathByProof.get(proof.proofHash),
           webCrypto,
           options?.from,
-          options?.sigEvidence
+          options?.sigEvidence,
+          options?.fuseEvidence,
+          anchorByHash
         )
       );
     }
@@ -325,7 +417,7 @@ export function buildCheckReport(audit: AuditResult, options?: CheckOptions): Ch
   sortByPosition(recordings);
   sortByPosition(anchors);
   const contradictions = collectContradictions(audit);
-  const notes = collectNotes(audit, recordings, anchors);
+  const notes = collectNotes(audit, recordings, anchors, options?.fuseOriginHexes);
   const notChecked = collectNotChecked(anchors.length > 0, options?.from?.domain);
 
   const allLines: ThreeValued[] = [
@@ -383,7 +475,9 @@ function buildRecording(
   filePath: string | undefined,
   webCrypto: boolean,
   from?: CheckDomain,
-  sigEvidence?: ReadonlyMap<string, Uint8Array>
+  sigEvidence?: ReadonlyMap<string, Uint8Array>,
+  fuseEvidence?: ReadonlyMap<string, FuseVerifyResult>,
+  anchorByHash?: ReadonlyMap<string, AnchorRecord>
 ): CheckRecording {
   const lines: CheckLine[] = [];
   const v = proof.verification;
@@ -448,6 +542,19 @@ function buildRecording(
     lines.push(domainLine(proof, verified, from, sigEvidence ?? EMPTY_EVIDENCE));
   }
 
+  // fused: the proof's signed attribution marks a fused artifact (profile
+  // bitgraph-fuse/1). The commitment check runs over the fused bytes, or
+  // over the original by reconstruction; its floor is the last verified
+  // anchor preceding the SLOT, not the commit.
+  const marker = readFuseAttribution(proof.proof);
+  let fused: CheckFused | undefined;
+  if (marker !== null) {
+    const floor = fusedFloor(segment, anchorByHash, proof.slotCounter, proof.chainId);
+    const built = fusedLine(marker.placement, marker.originDigest !== undefined ? proof.proof.attribution?.message ?? null : null, fuseEvidence?.get(proof.proofHash), floor, proof);
+    lines.push(built.line);
+    fused = built.fused;
+  }
+
   const result = kleeneAll(lines.map((l) => l.result));
 
   return {
@@ -462,9 +569,116 @@ function buildRecording(
     lines,
     result,
     bounds: boundsFor(segment),
+    ...(fused !== undefined ? { fused } : {}),
+  };
+}
+
+/**
+ * The fused floor: among the segment's verified not-before anchors, those
+ * whose commit counter precedes the SLOT counter, tightest last (largest
+ * block number, else latest timestamp). Null when no verified anchor
+ * precedes the slot in its epoch chain.
+ */
+export const ANCHORED_CHAIN = "bitgraph:main";
+
+export function fusedFloor(
+  segment: TemporalSegment | undefined,
+  anchorByHash: ReadonlyMap<string, AnchorRecord> | undefined,
+  slotCounter: string | undefined,
+  chainId: string = ANCHORED_CHAIN
+): CheckFloor | null {
+  // Anchors exist only on the anchored chain and the anchor index carries no
+  // chain segment, so a slot on any other chain compares to nothing.
+  if (chainId !== ANCHORED_CHAIN) return null;
+  if (segment === undefined || anchorByHash === undefined || slotCounter === undefined || !/^[0-9]+$/.test(slotCounter)) return null;
+  const slot = BigInt(slotCounter);
+  let best: SegmentBound | undefined;
+  for (const b of segment.lowerBounds) {
+    if (b.kind !== "not-before") continue;
+    const anchor = anchorByHash.get(b.anchorProofHash);
+    if (anchor === undefined || anchor.counter === undefined || !/^[0-9]+$/.test(anchor.counter)) continue;
+    if (BigInt(anchor.counter) >= slot) continue;
+    if (best === undefined) { best = b; continue; }
+    const bn = b.blockNumber !== undefined ? BigInt(b.blockNumber) : BigInt(b.timestamp);
+    const bb = best.blockNumber !== undefined ? BigInt(best.blockNumber) : BigInt(best.timestamp);
+    if (bn > bb) best = b;
+  }
+  if (best === undefined) return null;
+  return {
+    ...(best.blockNumber !== undefined ? { blockNumber: best.blockNumber } : {}),
+    blockHash: best.blockHash,
+    timestamp: best.timestamp,
+    anchorProofHash: best.anchorProofHash,
+    evidence: "counter-order",
   };
 }
 
+const FLOOR_UNDETERMINED = "floor undetermined: no anchor precedes this slot in its epoch";
+
+function floorClause(floor: CheckFloor): string {
+  const block = floor.blockNumber !== undefined ? `#${floor.blockNumber}` : floor.blockHash;
+  return `anchored block ${block} (${new Date(floor.timestamp * 1000).toISOString()})`;
+}
+
+function fusedLine(
+  placement: string | null,
+  originMessage: string | null,
+  ev: FuseVerifyResult | undefined,
+  floor: CheckFloor | null,
+  proof: ObservedProof
+): { line: CheckLine; fused: CheckFused } {
+  const slot = proof.slotCounter ?? "?";
+  const where = placement !== null ? ` (placement ${placement})` : " (placement undeclared)";
+  const floorDetail = floor !== null
+    ? `assembled after ${floorClause(floor)}, the last verified anchor preceding slot ${slot} in this epoch`
+    : proof.chainId !== ANCHORED_CHAIN
+      ? `floor undetermined: the slot is on chain "${proof.chainId}", not the anchored chain`
+      : FLOOR_UNDETERMINED;
+  const span = ev?.span !== undefined && ev.span !== null
+    ? { slotCounter: ev.span.slotCounter, commitCounter: ev.span.commitCounter, positions: ev.span.positions }
+    : proof.slotCounter !== undefined && proof.counter !== undefined
+      ? { slotCounter: proof.slotCounter, commitCounter: proof.counter, positions: (BigInt(proof.counter) - BigInt(proof.slotCounter)).toString() }
+      : null;
+  const statements = (ev?.statements ?? []).map((s) =>
+    floor !== null ? s.replace(`at position ${slot},`, `at position ${slot}, which followed ${floorClause(floor)},`) : s
+  );
+  const base = (category: CheckFused["category"], evidence: CheckFused["evidence"]): CheckFused => ({
+    category,
+    placement: ev?.placement ?? placement,
+    originDigestB64: ev?.originDigestB64 ?? originMessage,
+    evidence,
+    statements,
+    floor,
+    floorDetail,
+    span,
+  });
+  if (ev === undefined) {
+    return {
+      line: { name: "fused", result: "UNDETERMINED", detail: `marked fused${where}, but neither the fused bytes nor ${originMessage !== null ? "the original" : "an original"} is in this bundle, so the commitment to slot ${slot} cannot be checked` },
+      fused: base("NO_EVIDENCE", null),
+    };
+  }
+  const evidence: CheckFused["evidence"] = ev.category === "FUSED_FROM_ORIGIN" || (ev.fileDigestB64 !== ev.artifactDigestB64 && ev.category !== "NO_MATCH") ? "original" : "fused-bytes";
+  switch (ev.category) {
+    case "FUSED_DIRECT":
+      return { line: { name: "fused", result: "TRUE", detail: `the fused bytes carry the commitment to slot ${slot}${where}` }, fused: base(ev.category, "fused-bytes") };
+    case "FUSED_FROM_ORIGIN":
+      return { line: { name: "fused", result: "TRUE", detail: `the original rebuilds the committed fused bytes${where}; they carry the commitment to slot ${slot}` }, fused: base(ev.category, "original") };
+    case "INVALID_SLOT_COMMITMENT":
+      return { line: { name: "fused", result: "FALSE", detail: `the fused bytes do not carry the commitment to this proof's slot ${slot}: ${ev.reason ?? ""}` }, fused: base(ev.category, evidence) };
+    case "INVALID_ORIGIN_ATTRIBUTION":
+      return { line: { name: "fused", result: "FALSE", detail: `the declared origin contradicts the origin inside the fused bytes: ${ev.reason ?? ""}` }, fused: base(ev.category, evidence) };
+    case "RECONSTRUCTION_MISMATCH":
+      return { line: { name: "fused", result: "FALSE", detail: `the file matching the declared origin does not rebuild the committed fused bytes: ${ev.reason ?? ""}` }, fused: base(ev.category, "original") };
+    case "UNDETERMINED_PLACEMENT":
+      return { line: { name: "fused", result: "UNDETERMINED", detail: `${ev.reason ?? "the placement is not registered"}; this verifier cannot check the commitment` }, fused: base(ev.category, evidence) };
+    case "INVALID_UNDERLYING_PROOF":
+      return { line: { name: "fused", result: "UNDETERMINED", detail: "not checked: the proof itself does not verify (see the signature line)" }, fused: base(ev.category, evidence) };
+    default:
+      return { line: { name: "fused", result: "UNDETERMINED", detail: `the commitment could not be checked: ${ev.reason ?? ev.category}` }, fused: base(ev.category, evidence) };
+  }
+}
+
 function attestationLine(
   record: ProofAttestationRecord | undefined,
   webCrypto: boolean
@@ -618,7 +832,7 @@ function boundsFor(segment: TemporalSegment | undefined): CheckBounds {
   const notAfter = upper === undefined ? undefined : toBound(upper);
   const status: CheckBounds["status"] =
     notBefore !== undefined && notAfter !== undefined
-      ? "bracketed"
+      ? "lower-bounded-with-following-anchor"
       : notBefore !== undefined
         ? "lower-bounded"
         : notAfter !== undefined
@@ -636,16 +850,22 @@ function boundsFor(segment: TemporalSegment | undefined): CheckBounds {
   };
 }
 
-/** "after Ethereum block A and before block B (both headers verified)…", shared by bounds.detail and the summary. */
+/**
+ * "after Ethereum block A; precedes an anchor that consumed block B", shared by bounds.detail and the summary.
+ * The following anchor is deliberately NOT rendered as "before block B": a proof precedes the anchor's
+ * commit, and block B's timestamp bounds that commit from below, not the proof from above. Reading it as
+ * a ceiling assumes the anchor consumed a recently published block. An inbound anchor cannot carry a
+ * proof of an upper bound, so the phrase says what the evidence supports and names the assumption.
+ */
 function boundsPhrase(
   status: CheckBounds["status"],
   notBefore: CheckBound | undefined,
   notAfter: CheckBound | undefined
 ): string {
   switch (status) {
-    case "bracketed":
+    case "lower-bounded-with-following-anchor":
       return (
-        `after Ethereum block ${blockRef(notBefore as CheckBound)} and before block ${blockRef(notAfter as CheckBound)} (both headers verified in this bundle)` +
+        `after Ethereum block ${blockRef(notBefore as CheckBound)} (header verified in this bundle); precedes an anchor that consumed block ${blockRef(notAfter as CheckBound)} (header verified), an anchor-latency assumption rather than an upper bound on this recording` +
         weakerSuffix((notBefore as CheckBound).weaker || (notAfter as CheckBound).weaker)
       );
     case "lower-bounded":
@@ -689,8 +909,8 @@ function toBound(b: SegmentBound): CheckBound {
 /** The headline form of the bounds: one clause, no qualifiers (those live in bounds.detail). */
 function shortBoundsPhrase(b: CheckBounds): string {
   switch (b.status) {
-    case "bracketed":
-      return `between Ethereum blocks ${blockRef(b.notBefore as CheckBound)} and ${blockRef(b.notAfter as CheckBound)}`;
+    case "lower-bounded-with-following-anchor":
+      return `after Ethereum block ${blockRef(b.notBefore as CheckBound)}, then an anchor at block ${blockRef(b.notAfter as CheckBound)}`;
     case "lower-bounded":
       return `after Ethereum block ${blockRef(b.notBefore as CheckBound)}`;
     case "upper-bounded":
@@ -815,7 +1035,7 @@ function collectContradictions(audit: AuditResult): CheckLine[] {
   return out;
 }
 
-function collectNotes(audit: AuditResult, recordings: CheckRecording[], anchors: CheckAnchor[]): string[] {
+function collectNotes(audit: AuditResult, recordings: CheckRecording[], anchors: CheckAnchor[], fuseOriginHexes?: ReadonlySet<string>): string[] {
   const notes: string[] = [];
 
   // Excerpt gaps, said once, plainly.
@@ -842,7 +1062,13 @@ function collectNotes(audit: AuditResult, recordings: CheckRecording[], anchors:
 
   // Files that match no recording: the human hint for an edited file or a
   // wrong drop, without claiming which.
-  const unmatched = audit.ingest.artifacts.filter((a) => a.matchedProofHashes.length === 0);
+  const originals = audit.ingest.artifacts.filter((a) => a.matchedProofHashes.length === 0 && fuseOriginHexes?.has(a.sha256Hex) === true);
+  if (originals.length > 0) {
+    notes.push(
+      `${originals.length} file${originals.length === 1 ? "" : "s"} in this bundle ${originals.length === 1 ? "is" : "are"} the original of a fused recording: ${originals.slice(0, 5).map((a) => a.paths[0] ?? "(unnamed)").join(", ")}${originals.length > 5 ? ", …" : ""}. The original itself receives only the ceiling (it existed no later than the commit); the fused bytes receive the interval`
+    );
+  }
+  const unmatched = audit.ingest.artifacts.filter((a) => a.matchedProofHashes.length === 0 && fuseOriginHexes?.has(a.sha256Hex) !== true);
   if (unmatched.length > 0 && recordings.length > 0) {
     const listed = unmatched
       .slice(0, 5)
@@ -963,6 +1189,11 @@ export function renderCheckText(report: CheckReport): string {
     }
     for (const line of rec.lines) out.push(`  ${mark(line.result)}  ${pad(line.name, 12)} ${line.detail}`);
     out.push(`  bounds      ${rec.bounds.detail}`);
+    if (rec.fused !== undefined) {
+      out.push(`  fused floor ${rec.fused.floorDetail}`);
+      if (rec.fused.span !== null) out.push(`  fused span  slot ${rec.fused.span.slotCounter} to commit ${rec.fused.span.commitCounter} (${rec.fused.span.positions} positions)`);
+      for (const s of rec.fused.statements) out.push(`  statement   ${s}`);
+    }
     out.push("");
   });
   report.anchors.forEach((a, i) => {

package/src/verdict.ts

@@ -31,7 +31,7 @@ import type { DeclaredEntry, Resolution, Rule, Verdict } from "./types.js";
  * A unit test asserts this equals package.json's version, so the
  * constant cannot drift silently across releases.
  */
-export const PLAYER_VERSION = "0.6.0";
+export const PLAYER_VERSION = "0.8.0";
 
 /** The player package's own version. */
 export function playerVersion(): string {