@sanning/proof 0.16.0 → 0.17.0

package/src/case.ts

@@ -248,6 +248,7 @@ import {
   type DeclarationRole,
   DECLARATION_VERSION,
   DECLARATION_VERSION_V2,
+  type PackRecord,
   checkDeclaration,
   declarationClaims,
   packRecords,
@@ -260,7 +261,7 @@ import {
   readHandoffs,
   recordIsMalformed,
 } from "./handoff.js";
-import { coSignaturesPresent, verifyEvidenceBundle } from "./evidence.js";
+import { coSignaturesPresent, resolveTraceEvents, verifyEvidenceBundle } from "./evidence.js";
 import type { EvidenceBundleResult } from "./evidence.js";
 import {
   type PackGrade,
@@ -784,6 +785,42 @@ export const CASE_EXCEPTION_KINDS = [
 
 export type CaseExceptionKind = (typeof CASE_EXCEPTION_KINDS)[number];
 
+/**
+ * The status every record in every pack carries (evidence-bundle 5.5.4
+ * v1.35, A43, proof#204), as a closed set. A record is listed for each element
+ * of its pack's `body.events` as `packRecords` reads them, or, for a
+ * `sanning.evidence.export/v2` pack, of the events of the inline source
+ * bundle it wraps (`resolveTraceEvents`), and gets exactly one:
+ *
+ * - `read_clean`: the record went into the pile, no exception carries its
+ *   `packIndex` and `recordIndex`, and its pack's declaration check
+ *   names it by nothing (`declarationFindings` is empty). It says nothing
+ *   about its PACK: the pack's own grade and exceptions are on the pack, and a
+ *   surface MUST show that grade beside the status.
+ * - `read_flagged`: the record went into the pile, and at least one
+ *   exception carries its `packIndex` and `recordIndex`, or its pack's
+ *   declaration check names its `eventId` by a deviation or a content
+ *   finding (`declarationFindings` is not empty; under an `eventId` the
+ *   pack carries twice, every record with that id). An exception about the
+ *   pack alone flags no record.
+ * - `not_read`: the record never went into the pile. `reason` is the kind
+ *   of the exception that says why, on the record
+ *   (`record_profile_quarantined`, `record_envelope_does_not_verify`,
+ *   `record_bytes_withheld`, `record_bytes_unreadable`) or on its pack
+ *   (`pack_key_unreadable`, `pack_does_not_verify`,
+ *   `pack_body_type_unknown`, `pack_grade_not_verified` where the body
+ *   could not be read or the verifier graded a different number of records).
+ *   An export's wrapped records carry the reason of the exception their pack
+ *   actually got: `pack_body_type_unknown` where its wrapper holds, and
+ *   otherwise `pack_key_unreadable`, `pack_does_not_verify` or
+ *   `pack_grade_not_verified`.
+ *
+ * Before A43 the reading listed only the records it read, so a surface had to
+ * work out which records were missing, and why, by a rule of its own.
+ */
+export const CASE_RECORD_STATUSES = ["read_clean", "read_flagged", "not_read"] as const;
+export type CaseRecordStatus = (typeof CASE_RECORD_STATUSES)[number];
+
 /**
  * What each exception kind contributes to the case verdict. It is a TABLE and
  * not a chain of branches, so "which exceptions move the verdict" is one thing
@@ -868,10 +905,25 @@ export interface CasePack {
  * `renderException`. */
 export interface CaseException {
   kind: CaseExceptionKind;
-  /** Which pack this is about, by the reader's own name for it. */
+  /**
+   * Which pack this is about, by the reader's own name for it. Two packs can
+   * carry one `ref`, so it is a label and never the join: `packIndex` is.
+   */
   packRef?: string;
+  /**
+   * Which pack this is about, by its position in `CaseReading.packs` (0
+   * first), present wherever `packRef` is (A43). Unique in the reading.
+   */
+  packIndex?: number;
   /** Which record, by its envelope `event_id`. */
   eventId?: string;
+  /**
+   * Which record, by its position in its pack's `body.events` (0 first),
+   * present wherever `eventId` is (A43). One pack can carry one `event_id`
+   * twice, so `packIndex` and `recordIndex` together are the join to
+   * `CaseReading.records`.
+   */
+  recordIndex?: number;
   /**
    * The counterparty key the record named, for the two counterpart kinds.
    * Normalized (`normalizedSigningKey`), so a reader compares what this module
@@ -904,20 +956,54 @@ export interface CaseException {
 }
 
 /**
- * 4.1's reading of one record the case holds, with the pack it came from.
- *
- * EVERY record every pack supplied and this reader could read gets one of
- * these, in pack order and then in bundle order, including the ones that are
- * not hand-off records at all (`findings` carries `not_a_handoff_record`). 4.1
- * (v1.9, A14) requires that and names the reason: the one thing an attacker
- * wants is for a record to be absent from the output.
+ * One record of one pack, with its status and, where it was read, 4.1's
+ * reading of it.
+ *
+ * EVERY record of every pack gets one of these (A43), in pack order and then
+ * in bundle order: the ones this reader read, including the ones that are not
+ * hand-off records at all (`findings` carries `not_a_handoff_record`), and the
+ * ones it did not, with `status` `not_read` and the `reason`. 4.1 (v1.9, A14)
+ * names why: the one thing an attacker wants is for a record to be absent from
+ * the output. An export's wrapped records are listed, `not_read`. A pack whose
+ * body carries no `events` array, and wraps none, lists none, and its own
+ * exception says why.
  */
 export interface CaseRecordReading {
   packRef: string;
+  /** The pack, by its position in `CaseReading.packs` (A43). */
+  packIndex: number;
   eventId: string;
+  /**
+   * The record, by its position in the list of records its pack lists (A43):
+   * `body.events`, or for a `sanning.evidence.export/v2` pack the events of the
+   * source bundle it wraps.
+   */
+  recordIndex: number;
+  /** One of `CASE_RECORD_STATUSES` (A43). */
+  status: CaseRecordStatus;
+  /**
+   * For `not_read`, the kind of the exception that says why; `null` for a
+   * record that was read.
+   */
+  reason: CaseExceptionKind | null;
+  /**
+   * The kinds its pack's declaration check names this record by, deviations
+   * (`DECLARATION_DEVIATION_KINDS`) then content findings
+   * (`DECLARATION_CONTENT_KINDS`), each in the check's own order. Matched on
+   * `eventId`, so under an `event_id` the pack carries twice every record with
+   * that id carries it. A record that went into the pile with any is
+   * `read_flagged` (A43).
+   */
+  declarationFindings: string[];
+  /** 4.1's verdict, or `null` where 4.1 gave none or the record was not read. */
   verdict: string | null;
   findings: string[];
   failedChecks: string[];
+  /**
+   * 4.1's candidate counterparts, each as `<pack ref>/<event_id>`. A LABEL for
+   * a person to read and never the join: two packs can carry one ref, and one
+   * pack one `event_id` twice (A43).
+   */
   counterparts: string[];
   /**
    * The role the pack's v2 declaration signs for this record, `handoff` or
@@ -935,6 +1021,8 @@ export interface CaseNote {
   kind: CaseNoteKind;
   /** Which pack, by the reader's own name for it. */
   packRef: string;
+  /** Which pack, by its position in `CaseReading.packs` (A43). */
+  packIndex: number;
   /**
    * For `CONTENT_WITHHELD_BY_DECLARATION`, how many of the pack's records its
    * declaration withholds.
@@ -948,6 +1036,13 @@ export interface CaseNote {
  * its wrapper, and never by an organization (D10).
  */
 export interface CasePackReading {
+  /**
+   * The pack's position in the order the reader was given the packs, 0 first
+   * (A43): the one name for a pack that is unique in the reading. Every
+   * exception, note and record names its pack by it as `packIndex`.
+   */
+  index: number;
+  /** The reader's own name for the pack. Two packs can carry the same one. */
   ref: string;
   /** The wrapper key, normalized, or `null` where this reader could not read it. */
   signingKey: string | null;
@@ -980,7 +1075,10 @@ export interface CaseReading {
    * reachable only together with `verdict === "verified"`.
    */
   exceptions: CaseException[];
-  /** One reading per record the case holds and this reader could read. */
+  /**
+   * One entry per record of every pack, read or not, in pack order and then
+   * bundle order, each with its status (A43).
+   */
   records: CaseRecordReading[];
   /**
    * Every `[contributor, verdict]` the case verdict was computed from, in
@@ -1237,8 +1335,40 @@ export async function readCase(
   // rather than parsed back out of a reference string. A reference is for a
   // human to read; a join rebuilt by splitting one is a join on a value a
   // holder can put a separator in.
-  const provenance: { position: number; packRef: string; eventId: string }[] =
-    [];
+  const provenance: {
+    position: number;
+    packRef: string;
+    eventId: string;
+    recordIndex: number;
+  }[] = [];
+  // Every record of every pack, in pack order and bundle order (A43): where it
+  // went into the pile, its place there (`heldAt`), and where it did not, the
+  // kind of the exception that says why. Nothing is listed only where the pack
+  // body carries no `events` array, and that pack's own exception says why.
+  const slots: {
+    position: number;
+    packRef: string;
+    recordIndex: number;
+    eventId: string;
+    heldAt: number | null;
+    reason: CaseExceptionKind | null;
+  }[] = [];
+  const unread = (
+    position: number,
+    packRef: string,
+    listed: readonly PackRecord[],
+    reason: CaseExceptionKind,
+  ) => {
+    listed.forEach((record, recordIndex) =>
+      slots.push({ position, packRef, recordIndex, eventId: record.eventId, heldAt: null, reason }),
+    );
+  };
+  // The kinds each pack's declaration check names each record by, keyed by the
+  // pack's POSITION and then by `eventId` (A43). The check names a record by
+  // `event_id` alone, so under an id the pack carries twice every record with
+  // that id is named: failing closed, rather than guessing which of the two the
+  // check meant.
+  const declarationFindings = new Map<number, Map<string, string[]>>();
   // Keyed by the pack's POSITION and never by its `ref`. `ref` is the reader's
   // own name for a pack, and nothing stops two packs in one archive carrying
   // the same one: keyed by ref, the second pack's claims silently replaced the
@@ -1296,9 +1426,11 @@ export async function readCase(
       // pack whose signer is UNKNOWN, and not a pack nobody signed. Checked
       // BEFORE verification, because the two bundle verifiers disagree on some
       // of these spellings (proof#135) and the reading must not.
-      note(PACK_KEY_UNREADABLE, { packRef: pack.ref });
+      note(PACK_KEY_UNREADABLE, { packRef: pack.ref, packIndex: position });
       unattributed += 1;
+      unread(position, pack.ref, listedRecords(pack.bundle, pack.content), PACK_KEY_UNREADABLE);
       packReadings.push({
+        index: position,
         ref: pack.ref,
         signingKey: null,
         grade: null,
@@ -1330,9 +1462,11 @@ export async function readCase(
 
     // WHOSE PACK IS IT. The wrapper, and only the wrapper.
     if (!wrapperHolds(verified)) {
-      note(PACK_DOES_NOT_VERIFY, { packRef: pack.ref });
+      note(PACK_DOES_NOT_VERIFY, { packRef: pack.ref, packIndex: position });
       unattributed += 1;
+      unread(position, pack.ref, listedRecords(pack.bundle, pack.content), PACK_DOES_NOT_VERIFY);
       packReadings.push({
+        index: position,
         ref: pack.ref,
         signingKey: holder,
         grade: null,
@@ -1349,7 +1483,7 @@ export async function readCase(
       // the case reading names it rather than moving anything on its account.
       caseNotes.push({
         position,
-        note: { kind: CO_SIGNATURES_PRESENT, packRef: pack.ref },
+        note: { kind: CO_SIGNATURES_PRESENT, packRef: pack.ref, packIndex: position },
       });
     }
 
@@ -1418,6 +1552,7 @@ export async function readCase(
       }
       note(PACK_GRADE_NOT_VERIFIED, {
         packRef: pack.ref,
+        packIndex: position,
         status: grade as CaseVerdict,
         causes,
         reasons,
@@ -1426,11 +1561,13 @@ export async function readCase(
     if (verified.status === "failed" && signed.status !== "failed") {
       note(PACK_BUNDLE_CONTENT_DEPENDENT, {
         packRef: pack.ref,
+        packIndex: position,
         reasons: onlyIn(bundleReasons(verified), bundleReasons(signed)),
       });
     }
     const recordsWithheld = full !== null ? full.recordsWithheld : 0;
     packReadings.push({
+      index: position,
       ref: pack.ref,
       signingKey: holder,
       grade,
@@ -1443,12 +1580,20 @@ export async function readCase(
       // them, so a clean verdict never hides them.
       caseNotes.push({
         position,
-        note: { kind: CONTENT_WITHHELD_BY_DECLARATION, packRef: pack.ref, count: recordsWithheld },
+        note: {
+          kind: CONTENT_WITHHELD_BY_DECLARATION,
+          packRef: pack.ref,
+          packIndex: position,
+          count: recordsWithheld,
+        },
       });
     }
     // The body is one the verifier could not read, so it graded no record, and
     // nothing below has a grading to read. Named above.
-    if (signed.status === "malformed") continue;
+    if (signed.status === "malformed") {
+      unread(position, pack.ref, listedRecords(pack.bundle, pack.content), PACK_GRADE_NOT_VERIFIED);
+      continue;
+    }
 
     if (!knownBody) {
       // `sanning.evidence.export/v2` lands here, and it is NOT unwrapped: its
@@ -1457,20 +1602,35 @@ export async function readCase(
       // a repair (evidence-bundle.md 5.5.1 step 1 says so too). What this exit
       // costs is that pack's RECORDS, and it is named every time. It no longer
       // costs the pack's KEY: that was read above.
-      note(PACK_BODY_TYPE_UNKNOWN, { packRef: pack.ref });
+      note(PACK_BODY_TYPE_UNKNOWN, { packRef: pack.ref, packIndex: position });
+      // Listed, and not read: the records a `sanning.evidence.export/v2` wraps
+      // are listed from its inline source bundle, so a reading never says "0
+      // not read" of a pack that holds records (A43).
+      unread(position, pack.ref, listedRecords(pack.bundle, pack.content), PACK_BODY_TYPE_UNKNOWN);
       continue;
     }
     // Graded above (`malformed` where the verifier called it `verified`), and
     // none of its records are read.
-    if (ungraded) continue;
+    if (ungraded) {
+      unread(position, pack.ref, records, PACK_GRADE_NOT_VERIFIED);
+      continue;
+    }
     if (records.length === 0) {
-      note(PACK_HOLDS_NO_RECORDS, { packRef: pack.ref });
+      note(PACK_HOLDS_NO_RECORDS, { packRef: pack.ref, packIndex: position });
       continue;
     }
 
     const checked = check as DeclarationCheck;
     claimsByPack.set(position, declarationClaims(pack.bundle));
     rolesByPack.set(position, new Map((checked.roles ?? []).map((r) => [r.eventId, r.role])));
+    const namedByCheck = new Map<string, string[]>();
+    for (const finding of [...checked.deviations, ...checked.contentFindings]) {
+      if (finding.eventId === undefined) continue;
+      const kinds = namedByCheck.get(finding.eventId) ?? [];
+      kinds.push(finding.kind);
+      namedByCheck.set(finding.eventId, kinds);
+    }
+    declarationFindings.set(position, namedByCheck);
     if (checked.contentFindings.length > 0) {
       // BESIDE the deviation exception and never instead of it: a pack can do
       // both, over different records, and the two say different things. This
@@ -1478,12 +1638,14 @@ export async function readCase(
       // it turns on (proof#147).
       note(PACK_DECLARATION_CONTENT_DEPENDENT, {
         packRef: pack.ref,
+        packIndex: position,
         count: checked.contentFindings.length,
       });
     }
     if (checked.verdict === "failed") {
       note(PACK_DECLARATION_DEVIATES, {
         packRef: pack.ref,
+        packIndex: position,
         count: checked.deviations.length,
       });
     } else if (checked.contentFindings.length > 0) {
@@ -1503,7 +1665,7 @@ export async function readCase(
       // cannot read", which `gradePack` already carries to `incomplete`. The
       // same posture here, for the same reason: the field has no accept-set and
       // the holder writes it.
-      note(PACK_DECLARATION_UNREADABLE, { packRef: pack.ref });
+      note(PACK_DECLARATION_UNREADABLE, { packRef: pack.ref, packIndex: position });
     } else {
       // WHAT IT CONTRIBUTES TURNS ON THE WHOLE READING (5.5.1 step 2 v1.20,
       // A23, I4): `partial` where the reading holds a hand-off record, and a
@@ -1526,30 +1688,34 @@ export async function readCase(
       const record = records[index];
       const graded = verified.events[index];
       const bare = signed.events[index];
+      // Which pack and which record, by position: the two names that are
+      // unique in the reading whatever the reader called the pack and whatever
+      // the holder wrote as `event_id` (A43).
+      const at = {
+        packRef: pack.ref,
+        packIndex: position,
+        eventId: record.eventId,
+        recordIndex: index,
+      };
+      // Not read: listed with the kind of the exception that says why.
+      const skip = (kind: CaseExceptionKind, fields: Omit<CaseException, "kind"> = {}) => {
+        note(kind, { ...at, ...fields });
+        slots.push({ position, packRef: pack.ref, recordIndex: index, eventId: record.eventId, heldAt: null, reason: kind });
+      };
       if (underQuarantine(recordSpecVersion(pack.bundle, index))) {
-        note(RECORD_PROFILE_QUARANTINED, { packRef: pack.ref, eventId: record.eventId });
+        skip(RECORD_PROFILE_QUARANTINED);
         continue;
       }
       if (!graded.envelopeOk) {
-        note(RECORD_ENVELOPE_DOES_NOT_VERIFY, {
-          packRef: pack.ref,
-          eventId: record.eventId,
-          reasons: [...graded.errors],
-        });
+        skip(RECORD_ENVELOPE_DOES_NOT_VERIFY, { reasons: [...graded.errors] });
         continue;
       }
       if (!record.bytesSupplied) {
-        note(RECORD_BYTES_WITHHELD, {
-          packRef: pack.ref,
-          eventId: record.eventId,
-        });
+        skip(RECORD_BYTES_WITHHELD);
         continue;
       }
       if (record.record === null) {
-        note(RECORD_BYTES_UNREADABLE, {
-          packRef: pack.ref,
-          eventId: record.eventId,
-        });
+        skip(RECORD_BYTES_UNREADABLE);
         continue;
       }
       // Named, and the record stays in the pile (see the kinds). A mismatch
@@ -1557,14 +1723,12 @@ export async function readCase(
       // with the side map is `incomplete` (proof#159).
       if (bare.contentOk === false) {
         note(RECORD_CONTENT_MISMATCH, {
-          packRef: pack.ref,
-          eventId: record.eventId,
+          ...at,
           reasons: [...bare.errors],
         });
       } else if (graded.contentOk === false) {
         note(RECORD_CONTENT_DEPENDENT, {
-          packRef: pack.ref,
-          eventId: record.eventId,
+          ...at,
           reasons: onlyIn(graded.errors, bare.errors),
         });
       }
@@ -1575,17 +1739,24 @@ export async function readCase(
         (!bare.ok && bare.contentOk !== false)
       ) {
         note(RECORD_DOES_NOT_VERIFY_IN_ITS_PACK, {
-          packRef: pack.ref,
-          eventId: record.eventId,
+          ...at,
           reasons: [...bare.errors],
         });
       }
+      slots.push({
+        position,
+        packRef: pack.ref,
+        recordIndex: index,
+        eventId: record.eventId,
+        heldAt: held.length,
+        reason: null,
+      });
       held.push({
         publicKey: record.publicKey,
         record: record.record,
         ref: `${pack.ref}/${record.eventId}`,
       });
-      provenance.push({ position, packRef: pack.ref, eventId: record.eventId });
+      provenance.push({ position, packRef: pack.ref, eventId: record.eventId, recordIndex: index });
     }
   }
 
@@ -1596,20 +1767,12 @@ export async function readCase(
   const readings: HandoffReading[] = readHandoffs(held);
 
   // Step 4.
-  const records: CaseRecordReading[] = [];
   let handoffRecords = 0;
   for (let index = 0; index < readings.length; index += 1) {
     const reading = readings[index];
-    const { position, packRef, eventId } = provenance[index];
-    records.push({
-      packRef,
-      eventId,
-      verdict: reading.verdict,
-      findings: [...reading.findings],
-      failedChecks: [...reading.failedChecks],
-      counterparts: [...reading.candidates],
-      role: rolesByPack.get(position)?.get(eventId) ?? null,
-    });
+    const { position, packRef, eventId, recordIndex } = provenance[index];
+    // The record this reading is about, by position (A43).
+    const at = { packRef, packIndex: position, eventId, recordIndex };
     // proof#137's door, named. Read from the ONE reader of the declaration
     // (`declarationClaims`), never from a second parse here. Only a READABLE
     // declaration can make a record unclaimed: where the claim itself is absent
@@ -1632,7 +1795,7 @@ export async function readCase(
       claims.version === DECLARATION_VERSION &&
       !claims.claimedSides.includes(eventId)
     ) {
-      note(RECORD_UNCLAIMED, { packRef, eventId });
+      note(RECORD_UNCLAIMED, at);
     }
 
     if (reading.findings.includes(NOT_A_HANDOFF_FINDING)) {
@@ -1651,10 +1814,10 @@ export async function readCase(
       // counterpart, ambiguity and `failedChecks` reporting below all keep
       // running over it.
       if (recordIsMalformed(held[index])) {
-        note(RECORD_MALFORMED, { packRef, eventId });
+        note(RECORD_MALFORMED, at);
         continue;
       }
-      note(COUNTERPART_MALFORMED, { packRef, eventId });
+      note(COUNTERPART_MALFORMED, at);
     }
 
     if (reading.findings.includes(COUNTERPART_ABSENT)) {
@@ -1700,16 +1863,15 @@ export async function readCase(
       note(
         kind,
         setAside > 0
-          ? { packRef, eventId, counterpartyKey: named, count: setAside }
-          : { packRef, eventId, counterpartyKey: named },
+          ? { ...at, counterpartyKey: named, count: setAside }
+          : { ...at, counterpartyKey: named },
       );
       continue;
     }
 
     if (reading.findings.includes(COUNTERPART_AMBIGUOUS)) {
       note(COUNTERPART_AMBIGUOUS, {
-        packRef,
-        eventId,
+        ...at,
         count: reading.candidateReadings.filter((c) => c.accountedFor === null).length,
       });
     }
@@ -1722,8 +1884,7 @@ export async function readCase(
     // check whatever the aggregate word is.
     if (reading.failedChecks.length > 0) {
       note(PAIR_FAILED, {
-        packRef,
-        eventId,
+        ...at,
         failedChecks: [...reading.failedChecks],
       });
     } else if (reading.verdict === "verified") {
@@ -1738,10 +1899,17 @@ export async function readCase(
   // none.
   for (const slot of undeclaredSlots) {
     if (handoffRecords > 0) {
-      exceptions[slot.exceptionAt] = { kind: PACK_UNDECLARED, packRef: slot.ref };
+      exceptions[slot.exceptionAt] = {
+        kind: PACK_UNDECLARED,
+        packRef: slot.ref,
+        packIndex: slot.position,
+      };
       contributions[slot.contributionAt] = [slot.ref, EXCEPTION_VERDICT[PACK_UNDECLARED] as CaseVerdict];
     } else {
-      caseNotes.push({ position: slot.position, note: { kind: PACK_UNDECLARED, packRef: slot.ref } });
+      caseNotes.push({
+        position: slot.position,
+        note: { kind: PACK_UNDECLARED, packRef: slot.ref, packIndex: slot.position },
+      });
     }
   }
   const named = exceptions.filter((e): e is CaseException => e !== null);
@@ -1753,6 +1921,54 @@ export async function readCase(
     .sort((a, b) => a.position - b.position || a.i - b.i)
     .map((n) => n.note);
 
+  // Every record of every pack, with its status (A43). A record that went
+  // into the pile is `read_flagged` where any exception names it by pack and
+  // record position, or its pack's declaration check names it (by deviation
+  // or by content finding), and `read_clean` where neither does; every other
+  // record is `not_read`, with the kind of the exception that says why.
+  const flagged = new Set(
+    named
+      .filter((e) => e.packIndex !== undefined && e.recordIndex !== undefined)
+      .map((e) => `${e.packIndex}:${e.recordIndex}`),
+  );
+  const records: CaseRecordReading[] = slots.map((slot) => {
+    const base = {
+      packRef: slot.packRef,
+      packIndex: slot.position,
+      eventId: slot.eventId,
+      recordIndex: slot.recordIndex,
+    };
+    const byCheck = [...(declarationFindings.get(slot.position)?.get(slot.eventId) ?? [])];
+    if (slot.heldAt === null) {
+      return {
+        ...base,
+        status: "not_read",
+        reason: slot.reason,
+        declarationFindings: byCheck,
+        verdict: null,
+        findings: [],
+        failedChecks: [],
+        counterparts: [],
+        role: null,
+      };
+    }
+    const reading = readings[slot.heldAt];
+    return {
+      ...base,
+      status:
+        flagged.has(`${slot.position}:${slot.recordIndex}`) || byCheck.length > 0
+          ? "read_flagged"
+          : "read_clean",
+      reason: null,
+      declarationFindings: byCheck,
+      verdict: reading.verdict,
+      findings: [...reading.findings],
+      failedChecks: [...reading.failedChecks],
+      counterparts: [...reading.candidates],
+      role: rolesByPack.get(slot.position)?.get(slot.eventId) ?? null,
+    };
+  });
+
   return {
     verdict: verdictOf(named, contributed),
     exceptions: named,
@@ -1765,6 +1981,19 @@ export async function readCase(
   };
 }
 
+/**
+ * The records a pack LISTS where this reader does not read them one by one
+ * (A43): the events `resolveTraceEvents` presents, which unwraps a
+ * `sanning.evidence.export/v2` to its inline source bundle, and otherwise
+ * `body.events` as `packRecords` reads it. Listing is not reading: every record
+ * listed here is `not_read`.
+ */
+function listedRecords(bundle: unknown, content: CasePack["content"]): PackRecord[] {
+  const events = resolveTraceEvents(bundle);
+  if (events === undefined) return packRecords(bundle, content);
+  return packRecords({ body: { events } }, content);
+}
+
 /**
  * `body.declaration.declaration_version` where it is one this reader knows,
  * and `null` otherwise.