@sanning/proof 0.19.0 → 0.20.0

package/dist/case.d.ts

@@ -1,1006 +1,543 @@
 /**
- * One verdict for a CASE, across packs and across organizations (anchor#198).
- *
- * The TypeScript half of `src/sanning_proof/case.py`. Both kernels are held to
- * the same corpus set, `test-vectors/case/`, so neither can pass by agreeing
- * with the other.
- *
- * WHY THIS LAYER EXISTS, AND WHAT IT IS THE CLOSURE FOR
- * =====================================================
- *
- * `envelope-spec.md` 4.1 reads records. `evidence-bundle.md` 5.4 reads one pack
- * against its own declaration. Neither can answer the question an audit team
- * actually asks, and 4.1 (v1.10, A15) and 5.4.2 rule 7 (v1.10) now say so in
- * these words:
- *
- *     **A pack a party assembles about itself is not self-proving about what
- *     that party LEFT OUT.**
- *
- * `handoffs[]` MAY be empty (5.4.1), so a holder declares a record in
- * `records[]` and claims it nowhere: rule 2 cannot reach it because it is
- * declared, rule 7 cannot reach it because it is unclaimed, and the pack reads
- * `verified` with no deviation, which is the same reading the honest pack gets.
- * The corpus pins that pack as EXPECTED
- * (`test-vectors/declaration/declaration-unclaimed-record-01`) rather than
- * leaving it to be rediscovered. Six repairs treated a property of one-sided
- * evidence as a defect in a rule (proof#137, ratified by Phil 2026-09-22), and
- * the omission happens BEFORE any reader runs, so no rule at either of those
- * layers reaches it.
- *
- * **This module is the closure, and the reason it can be is that it reads
- * several parties' packs at once.** A `handoff.sent` with no counterpart among
- * the records of the case is always NAMED, and when a pack signed by the key
- * that record names is in the case, the reading says that pack holds no
- * counterpart. No party can make a missing counterpart read clean.
- *
- * What it does NOT establish is that a party which presented no pack signed by
- * the named key recorded nothing. Nothing binds a pack's wrapper key to the
- * keys its records are signed with, so a counterparty that hands over its
- * account under any other key, or inside an export an issuer signed, or not at
- * all, gets the reading that says only that no pack in the case is signed by
- * the named key. Proving that a party did NOT record something needs that
- * party's account or a completeness mechanism over its records, and which of
- * those this reading waits for is proof#143.
- *
- * WHAT THAT MEANS FOR HOW THE JOIN IS BUILT
- * =========================================
- *
- * **The case reader does not consult `handoffs[]` to pair anything.** That is
- * not an oversight, it is the whole mechanism. The declaration is written by
- * the party being audited, so a join keyed on it inherits exactly the hole it
- * is meant to close: claim the clean pair, keep the tampered receipt
- * unclaimed, and a declaration-keyed reader never grades the receipt at all.
- * This reader pairs records with records, through `readHandoff`, over the
- * union of every record every pack in the case supplied. `handoffs[]` is read
- * for ONE thing and one only: to name a record its own holder DECLARED and
- * claimed nowhere (`RECORD_UNCLAIMED`), which is the pinned vector above
- * becoming visible. That claim check runs over every record a pack declares,
- * and not only over the ones 4.1 governs, because "is this a conformant
- * hand-off record" is an answer the audited party writes.
- *
- * **Matching is on hashes and identifiers alone and NEVER on tenancy**
- * (anchor#198, and DL-60: producer identity gates what the plane accepts and
- * never whether evidence verifies). The union pile is not partitioned by pack,
- * by issuer, by `tenant_id` or by organization anywhere in this module, so a
- * pair assembled by two organizations reads exactly as a pair assembled by
- * one. There is no code path here that reads a tenant.
- *
- * THE DEFECT CLASS THIS MODULE IS WRITTEN AGAINST
- * ===============================================
- *
- * Seventeen findings on this program share one generator: **a deviation
- * designed as a comparison between two present things, where the deviation
- * itself removes one of them, so the code takes the "nothing to compare"
- * branch written for the honest case.** A rule shaped that way reads the
- * absence of a signal as "fine" rather than as "I could not tell", and a real
- * deviation grades clean.
- *
- * Acceptance criterion 3 of anchor#198 is made of exactly that shape: *a
- * one-sided hand-off is an exception, not a failure*. So the four rules below
- * are structural and are the thing to preserve in any change here.
- *
- * 1. **Every exception is NAMED and appears in the output, and every exception
- *    contributes a verdict.** There is no path through this module that
- *    removes a record, a pack or a claim from the reading. An empty
- *    `exceptions` is the ONLY shape a reader may read as clean, and `readCase`
- *    is invariant: `verified` is reachable only when that array is empty.
- * 2. **Nothing a party writes decides whether grading happens.** No graded
- *    value is part of any key that selects a code path. The pile is everything
- *    every pack supplied; there is no filter.
- * 3. **Every field that selects a code path and is chosen by the party being
- *    audited has an accept-set, and an unknown value goes to a named exception
- *    rather than to silence.** `body_type` is `CASE_BODY_TYPES`;
- *    `declaration_version` is `checkDeclaration`'s; `event_type` and
- *    `event.counterparty_public_key` are 4.1's, through `readHandoffs`. A pack
- *    that supplies zero records is `PACK_HOLDS_NO_RECORDS` and a case with no
- *    hand-off record in it at all is `CASE_HOLDS_NO_HANDOFF_RECORDS`, because
- *    "nothing to grade" is never "nothing is wrong".
- * 4. **The 4.1 predicates are CALLED, never restated.** `readHandoffs`,
- *    `normalizedSigningKey` and `packRecords` are the one implementation of
- *    each rule. A validation copied beside the one that enforces it drifts,
- *    and a copy that is looser blesses a value the real one then rejects.
- *
- * EVERY EARLY EXIT IN THIS MODULE, AND WHAT IT SKIPS
- * ==================================================
- *
- * Three defects on this layer were one shape: an exit between a record
- * entering the pile and a check running over it, with the audited party
- * choosing whether the exit was taken. So the exits are enumerated here rather
- * than left to be rediscovered a fourth time. `src/sanning_proof/case.py` has
- * the same exits in the same order, and the pull request that added this list
- * carries the same table.
- *
- * 1. **No packs** (`return`). Skips everything. Reached by the reader, who
- *    chose what to hand in. Named: `CASE_HOLDS_NO_PACKS`.
- * 2. **A wrapper key this reader cannot read** (`continue`). Skips the bundle
- *    verification, the declaration check and every record in the pack. The
- *    holder writes the key, so it steers here freely, and the pack is NAMED
- *    (`PACK_KEY_UNREADABLE`). Both bundle verifiers now refuse every such
- *    spelling in the same words (proof#142), so this exit and exit 3 agree on
- *    which packs they take; it stays first because it names WHY. While any
- *    pack takes this exit, a one-sided record whose named key signed no pack
- *    reads `COUNTERPART_ABSENT_SIGNER_UNKNOWN` and never the innocent
- *    `COUNTERPART_ABSENT`.
- * 3. **The wrapper does not hold** (`continue`): `signatureOk` and
- *    `bodyHashOk` are not both true. Skips the declaration check and every
- *    record in the pack, and the key it claims is never counted as a pack
- *    signer. **This is the forger's case and the only exit that turns on
- *    provenance**: those two fields are the whole of what ties a pack to a
- *    key. Reached by whoever built the pack, and by anyone who alters its
- *    unsigned `signature` field, which is indistinguishable from a forgery.
- *    Named: `PACK_DOES_NOT_VERIFY`, and it moves one-sided records to
- *    `COUNTERPART_ABSENT_SIGNER_UNKNOWN` exactly as exit 2 does.
- *
- *    A pack whose wrapper HOLDS is never sent here, whatever is wrong inside
- *    it (gate 3 on proof#140): its key is counted, its own bundle verdict is
- *    `PACK_BUNDLE_NOT_VERIFIED` when that verdict is not `verified`, and each
- *    record is graded on its own envelope below.
- * 3b. **The bundle verdict is `malformed`** (`continue`, after exit 3 and after
- *    `PACK_BUNDLE_NOT_VERIFIED`). The body is one the verifier could not read,
- *    so it graded no record. The key is already counted.
- * 4. **`body_type` outside `CASE_BODY_TYPES`** (`continue`). Skips the
- *    declaration check and every record in the pack. The holder writes
- *    `body_type`, so the holder steers here freely, which is why it is named
- *    every time (`PACK_BODY_TYPE_UNKNOWN`) and why the pack's wrapper key is
- *    counted ABOVE it: a counterparty cannot leave the damning counterpart
- *    line by choosing a body (F3). `sanning.evidence.export/v2` lands here and
- *    is not unwrapped.
- * 5. **No records** (`continue`). Skips the declaration check, over nothing.
- *    The holder steers here by handing over an empty `events[]`. Named:
- *    `PACK_HOLDS_NO_RECORDS`; the wrapper key is already counted.
- * 5b. **A record under a quarantined profile** and 5c. **a record whose own
- *    envelope does not verify** (`continue`). Each skips 4.1 for that record,
- *    its candidacy for any other record, and the claim check, because 4.1
- *    compares only envelopes that verified (`HeldRecord`). Named:
- *    `RECORD_PROFILE_QUARANTINED` (`incomplete`, pending DL-63) and
- *    `RECORD_ENVELOPE_DOES_NOT_VERIFY` (`failed`). Neither removes a named
- *    failure from another record: the other records of the pack are still
- *    graded, and pairs still form over every record that verified.
- * 6. **`event_bytes` withheld** and 7. **`event_bytes` unreadable**
- *    (`continue`). Each skips 4.1 for that record, its candidacy for any other
- *    record, and the claim check. The holder steers into both by what it
- *    discloses. Each is named in the claim check's place
- *    (`RECORD_BYTES_WITHHELD` `incomplete`, `RECORD_BYTES_UNREADABLE`
- *    `malformed`), so neither buys a cleaner reading than an unclaimed record
- *    would get, and neither decides which counterpart kind another record
- *    gets, since that reads wrapper keys.
- *
- *    Not exits: a record whose envelope verifies and whose content does not
- *    match its commitment is `RECORD_CONTENT_MISMATCH` where that content is
- *    inside the signed body and `RECORD_CONTENT_DEPENDENT` where it was handed
- *    in beside the pack (proof#159), and one that fails
- *    another check inside its pack is `RECORD_DOES_NOT_VERIFY_IN_ITS_PACK`.
- *    Both are named and both STAY in the pile, so neither unsigned content
- *    handed in beside a pack nor a broken inclusion proof removes a record
- *    from pairing.
- * 8. **`not_a_handoff_record`** (`continue`). Skips the hand-off count and the
- *    counterpart, ambiguity and pair reporting, which 4.1 does not give a
- *    record outside its scope. The holder steers here by respelling a field.
- *    It no longer skips the claim check, which runs ABOVE it because it asks
- *    what the pack SAID and not what the record is (F1).
- * 9. **THIS record is malformed** (`continue`). Skips the counterpart,
- *    ambiguity and pair reporting, and 4.1 computed none of them for a
- *    malformed subject, so nothing is lost. A party steers here only by
- *    breaking a record it signed, and the record is named `RECORD_MALFORMED`.
- *    A well formed record whose CANDIDATE is malformed does not take this
- *    exit: it is `COUNTERPART_MALFORMED` and the reporting below still runs
- *    (F2).
- * 10. **`counterpart_absent`** (`continue`). Skips the ambiguity and pair
- *     reporting, and there is nothing to skip: 4.1 emits that finding only
- *     where no candidate is left to read, an EMPTY candidate list or one whose
- *     every candidate another record accounts for (4.1 v1.17, A20). Which of the three counterpart kinds it
- *     gets reads the keys of the packs that verified, counted before exit 4,
- *     and whether any pack took exit 2 or 3.
- *
- * Not an exit, and listed because it is one more place this shape could
- * hide: the claim check runs only where the pack's declaration is READABLE. An
- * absent or unreadable one is named once for the pack (`PACK_UNDECLARED`,
- * `PACK_DECLARATION_UNREADABLE`) rather than once per record.
- *
- * THE VERDICT VOCABULARY IS CLOSED
- * ================================
- *
- * `verified`, `failed`, `partial`, `mixed`, `incomplete` and `malformed`,
- * every one of them already in use (`evidence-bundle.md` 3 and
- * `PACK_VERDICTS`). **No new word is coined anywhere in this module**, and
- * `CASE_VERDICTS` is asserted against `PACK_VERDICTS` by the test suite so a
- * future addition here cannot invent one quietly. Everything this module has
- * to say that is not one of those six is an EXCEPTION KIND reported beside the
- * verdict, exactly as `counterpart_absent` and `not_a_handoff_record` are
- * findings beside a verdict in 4.1.
- *
- * A case with any `failed` contribution is `failed`: a proven failure keeps
- * the headline (5.5.4 v1.16, A17, proof#158). Otherwise a case with more than
- * one outcome is `mixed` (anchor#198, criterion 4).
- *
- * WHAT THIS READER DOES NOT CLAIM
- * ===============================
- *
- * * **Not that the case is complete.** Joining is voluntary. A counterparty
- *   that never handed over a pack leaves `COUNTERPART_ABSENT`, which is an
- *   exception and never a failure. It says that no pack in the case is signed
- *   by the named key, and nothing about what that party recorded.
- * * **Not that a party which presented no pack under the named key recorded
- *   nothing.** See the top of this comment, and proof#143.
- * * **Not that two organizations are independent.** One team holding both keys
- *   proves which agent said what, not that two parties agreed (4.1, 5.4.4).
- * * **Not that a `verified` case has no other problem.** It reads hand-offs.
- *   It runs `verifyEvidenceBundle` over every pack itself, offline and with no
- *   gateways, and a pack whose own bundle verdict is not `verified` is named
- *   with that verdict and its reasons, so the case never reads above its
- *   weakest pack. On-chain re-fetch and `gradePack` are a caller's to run.
- *
- * THE COST OF 4.1's "GRADE EVERY CANDIDATE", AND WHAT IS LEFT OF IT (4.1
- * v1.17, amendment A20, which reopens proof#134). Up to v1.16 a pile holding
- * two or more records of the complementary type signed by one counterparty key
- * could not reach `verified`. 4.1 now sets such a candidate aside where a
- * record the subject's own key signed pairs with it verified at another
- * sequence, so two messages in one direction, and the demo's A to B, B to A,
- * A to B, read clean. What is left surfaces as `COUNTERPART_AMBIGUOUS` beside
- * the failure: fan-in, fan-out, and the same pair in two cases at the same
- * sequence. Narrowing any of it here with `handoffs[]` is precisely the move
- * that would reopen proof#137's door.
+ * One verdict for a case: several packs, possibly from several organizations.
+ * Conformance: `test-vectors/case/`.
+ *
+ * A pack a party assembles about itself is not self-proving about what that
+ * party left out: a holder can declare a record and claim it nowhere, and the
+ * pack still reads `verified` (`declaration-unclaimed-record-01`). Reading
+ * several parties' packs at once closes that. An `agent.handoff.sent` with no
+ * counterpart among the case's records is always named, and when a pack signed
+ * by the key that record names is in the case, the reading says that pack
+ * holds no counterpart. It does not establish that a party which presented no
+ * such pack recorded nothing: nothing binds a pack's wrapper key to its
+ * records' keys.
+ *
+ * How the join works:
+ * - Records pair with records, through `readHandoffs`, over the union of every
+ *   record every pack supplied. `handoffs[]` is written by the audited party,
+ *   so it never selects a pair; it is read only to name a declared record that
+ *   is claimed nowhere (`RECORD_UNCLAIMED`).
+ * - Matching is on hashes and identifiers only, never tenancy. Nothing here
+ *   partitions the pile by pack, issuer, `tenant_id` or organization.
+ *
+ * Structural rules, to preserve in any change:
+ * 1. Every exception is named in the output and contributes a verdict.
+ *    Nothing removes a record, pack or claim from the reading. `verified` is
+ *    reachable only when `exceptions` is empty.
+ * 2. Nothing a party writes decides whether grading happens. The pile is
+ *    everything every pack supplied.
+ * 3. Every party-chosen field that selects a code path has an accept-set, and
+ *    an unknown value is a named exception. "Nothing to grade" is never
+ *    "nothing is wrong".
+ * 4. The §4.1 predicates (`readHandoffs`, `normalizedSigningKey`,
+ *    `packRecords`) are called, never restated.
+ *
+ * Every early exit in `readCase` names its exception, so no exit buys a
+ * cleaner reading than the record or pack would otherwise get. In particular:
+ * - A pack with an unreadable key or a wrapper that does not hold is skipped
+ *   and its key never counted; while any pack takes that exit, a one-sided
+ *   record reads `COUNTERPART_ABSENT_SIGNER_UNKNOWN`, never `COUNTERPART_ABSENT`.
+ * - A wrapper key is counted before the body-type and no-records exits, so
+ *   choosing a body cannot dodge the counterpart line.
+ * - The claim check runs before the not-a-hand-off and malformed exits, so
+ *   respelling or breaking a record cannot switch it off.
+ * - Content and in-pack failures are named and the record stays in the pile.
+ *
+ * The verdict vocabulary is closed: `verified`, `failed`, `incomplete`
+ * (evidence-bundle.md section 3). Every exception maps to one claim and one
+ * state (`claims.ts`), and the case reads its worst pack: any `failed`
+ * contribution makes the case `failed`, otherwise any `incomplete` makes it
+ * `incomplete`, and a reading with no contribution is `verified`.
+ *
+ * Not claimed: that the case is complete (joining is voluntary), that two
+ * organizations are independent (one team can hold both keys), or that a
+ * `verified` case has no other problem. Every pack is verified offline here
+ * and a pack whose bundle is not `verified` is named; on-chain re-fetch and
+ * `gradePack` are the caller's.
+ *
+ * Several records of the complementary type under one counterparty key can
+ * still be ambiguous (fan-in, fan-out, one pair in two cases at one sequence):
+ * that surfaces as `COUNTERPART_AMBIGUOUS`. Narrowing it with `handoffs[]`
+ * would reopen the hole above.
  */
 import { type DeclarationRole } from "./declaration.js";
+import { type AgentRecordReading } from "./agent-record.js";
 import { type PackGradeCauseKind, type PackVerdict } from "./grading.js";
+import type { EnvironmentMarker } from "./environment.js";
 import type { SideContentMap } from "./side-content.js";
-/**
- * The verdicts a case can reach. Every one is already in use in
- * `evidence-bundle.md` 3 or `PACK_VERDICTS`, and anchor#198 says in terms that
- * no new verdict word is introduced anywhere.
- */
-export declare const CASE_VERDICTS: readonly ["verified", "failed", "partial", "mixed", "incomplete", "malformed"];
+import { type Problem, type ReasonKind } from "./claims.js";
+/** The three verdicts (evidence-bundle.md section 3). A case reads its worst pack. */
+export declare const CASE_VERDICTS: readonly ["verified", "failed", "incomplete"];
 export type CaseVerdict = (typeof CASE_VERDICTS)[number];
 /**
- * The two pack bodies that carry `events[]` and may carry a `declaration`
- * (`evidence-bundle.md` 5.4.1). This is an ACCEPT-SET and not a hint.
+ * The pack bodies that carry `events[]` and may carry a `declaration`
+ * (evidence-bundle.md §5.4.1). An accept-set: `body_type` is party-written, so
+ * an unknown value is `PACK_BODY_TYPE_UNKNOWN`, never zero records read clean.
  *
- * `body_type` selects a code path and is written by the party assembling the
- * pack. Without this set, a pack whose records live under a key this reader
- * does not know yields zero records, contributes nothing, and lets the rest of
- * the case read clean over it: the exact defect class this module is written
- * against. An unknown value is `PACK_BODY_TYPE_UNKNOWN`.
- *
- * **`sanning.evidence.export/v2` is NOT in this set and is NOT unwrapped.** It
- * verifies as a bundle and carries a whole `sanning.anchor.trace/v3` pack under
- * `body.source_bundle`, so its records do not reach the pile and the export is
- * named `PACK_BODY_TYPE_UNKNOWN`, `incomplete`. Reading inside it changes which
- * packs this reader grades, so it is a decision of its own. A reader who needs
- * the records hands in the source bundle as a pack. The export's wrapper key is
- * still read, so wrapping a pack in one does not change which counterpart kind
- * another record gets.
+ * `sanning.evidence.export/v2` is not unwrapped: it is named
+ * `PACK_BODY_TYPE_UNKNOWN`, and a reader who needs its records hands in the
+ * source bundle. Its wrapper key is still read.
  */
 export declare const CASE_BODY_TYPES: readonly ["sanning.anchor.trace/v3", "sanning.stamp.evidence/v2"];
 /**
- * The envelope profiles the case reader reads records under: the ratified
- * accept-set (`envelope-spec.md` 5) minus every profile under quarantine in
- * `cross-kernel/accept-set.json`. A test in each kernel derives both arrays
- * from that file, and a test here pins this one equal to this kernel's own
- * `ACCEPTED_SPEC_MAJORS`, which is what `verifyEvidenceBundle` reads under:
- * the Python kernel narrows its verifier to this set for the case reader, and
- * this kernel's verifier already reads exactly it. If this kernel ever admits
- * a quarantined profile, that test fails, and the case reader has to narrow
- * its verifier the way the Python one does before it can pass.
+ * The profiles records are read under: the accept-set (envelope-spec.md §5)
+ * minus quarantined profiles in `cross-kernel/accept-set.json`. A test pins
+ * this equal to `ACCEPTED_SPEC_MAJORS`, which `verifyEvidenceBundle` reads under.
  */
-export declare const CASE_RECORD_PROFILES: readonly ["sanning.agent/v1", "sanning.events/v2"];
-/** The ratified profiles under quarantine, pending DL-63. */
+export declare const CASE_RECORD_PROFILES: readonly ["sanning.events/v2"];
+/** Accepted profiles under quarantine. */
 export declare const CASE_QUARANTINED_PROFILES: readonly ["sanning.mlflow/v1"];
 /**
- * A conformant hand-off record with no counterpart among the records this
- * reader read, where every pack in the case verified under a key this reader
- * can read and NO pack in the case is signed by the key the record names,
- * or where every candidate it had was accounted for by another record under
- * A20 (the exception then carries `count`, and names no pack).
- * **An exception, never a failure** (anchor#198, criterion 3).
- *
- * That is ALL it says. It does not say the counterparty's account is absent,
- * and it does not say nothing was tampered with: a counterparty that signs its
- * own pack under a second key, or hands over an export an issuer signed,
- * reaches this reading too, and nothing offline binds a pack's key to the keys
- * of the records inside it (proof#143). The rendered text states the fact and
- * stops.
- *
- * It says nothing about RECORDS signed by that key either. A party may hold records
- * its counterparty signed, and those are still graded as candidates, but they
- * are not the counterparty's account of itself, so they do not move this
- * record to `COUNTERPART_ABSENT_FROM_COUNTERPARTY_RECORDS`.
+ * A conformant hand-off record with no counterpart, where every pack verified
+ * under a readable key and none is signed by the key the record names, or every
+ * candidate was accounted for by another record (then `count` is set and no
+ * pack is named). An exception, never a failure. It says only that no pack is
+ * signed by the named key; records that key signed and others hold are not that
+ * party's own account and do not change it.
  */
 export declare const COUNTERPART_ABSENT = "counterpart_absent";
 /**
- * THE CLOSURE anchor#198 exists for.
- *
- * A conformant hand-off record with no counterpart, where a pack that VERIFIES
- * and is SIGNED by the key this record names is in the case, and not one
- * record this reader could read is this record's counterpart. It states that a
- * pack signed by the named key is present and holds no counterpart this reader
- * could read, and nothing more. 4.1 (v1.10, A15) and 5.4.2 rule 7 (v1.10) both point here, and
- * `declaration/declaration-unclaimed-record-01` is the pack that reaches this
- * line.
- *
- * **"Its own account" is read from the key that signed the PACK, and never
- * from the keys that signed records.** A pack's wrapper key signs `body_hash`
- * and `body` carries the declaration (`evidence-bundle.md` 5.4, "Who signs
- * it"), so a wrapper signed by B is provenance the accusing party cannot forge
- * without B's private key. Records signed by B that A merely HOLDS are not B's
- * account of itself: keyed on record keys, one pack from A plus one unrelated
- * record B signed at some other time reached this line when B had handed over
- * nothing at all.
+ * A conformant hand-off record with no counterpart, where a verified pack
+ * signed by the key the record names is in the case and holds no counterpart.
+ * The closure this module exists for (`declaration-unclaimed-record-01`).
  *
- * What it does NOT prove, stated so no surface claims it: that B handed the
- * pack over for THIS case. A pack B signed for some other purpose and a third
- * party replayed reads the same, because the only values that could say
- * otherwise (the declaration's `case_id` and `period`) are written by B and
- * would let B leave this line by writing them differently. The cost the other
- * way: a pack B assembles under any key other than the one its records name, a
- * per-organization hand-over key (anchor#196) included, reads
- * `COUNTERPART_ABSENT`, because nothing in the case binds that key to B. That
- * reading is still true: no pack signed by the named key is here. So a
- * counterparty can AVOID this line by choosing the key it signs under; what it
- * cannot do is make the missing counterpart read clean.
+ * "Its own account" is read from the key that signed the pack, never from
+ * record keys: a wrapper signed by B is provenance an accuser cannot forge, but
+ * records signed by B that A holds are not B's account.
  *
- * It is deliberately NOT also conditioned on a record signed by B being in the
- * pile. B's pack can hold none this reader reads (a body it does not unwrap,
- * bytes B withheld, an empty `events[]`), and each of those is a choice B makes
- * and is named on its own. A second conjunct on them hands B the innocent line
- * for making one.
+ * Not proven: that B handed the pack over for this case. A pack B signs under
+ * any other key reads `COUNTERPART_ABSENT`, which is still true; B can avoid
+ * this line by choice of key, but cannot make the missing counterpart read
+ * clean. Not conditioned on B's records being readable, since each way B could
+ * make them unreadable is its own named choice.
  *
- * It is a DISTINCT kind from `COUNTERPART_ABSENT` and not a louder spelling of
- * it. Collapsing the two would be the defect class again: "the counterparty
- * never joined" and "the counterparty joined and its own account does not
- * contain this hand-off" are the honest reading and the damning one, and one
- * name for both lets the second read as the first.
- *
- * It is still an EXCEPTION and not a failure, which criterion 3 requires and
- * which is also the honest call: the counterparty's pack is a selection over
- * its own interval, and a hand-off outside that interval is legitimately not
- * in it. What this names is that the question can now be ASKED of the other
- * party's own evidence, which is what no single pack could ever support.
+ * A distinct kind from `COUNTERPART_ABSENT`: one name for both would let the
+ * damning reading pass as the honest one. Still `incomplete`, not a failure: a
+ * hand-off outside the interval B's pack covers is legitimately absent.
  */
 export declare const COUNTERPART_ABSENT_FROM_COUNTERPARTY_RECORDS = "counterpart_absent_from_counterparty_records";
 /**
- * A conformant hand-off record with no counterpart, no VERIFIED pack in the
- * case signed by the key it names, and at least one pack in the case that this
- * reader could not tie to a key: its wrapper key is unreadable
- * (`PACK_KEY_UNREADABLE`) or it does not verify (`PACK_DOES_NOT_VERIFY`).
- * Whether a pack signed by the named key is in the case is UNKNOWN, so neither
- * of the other two kinds is true.
- *
- * The gate on the previous version of this reader showed why it exists. A
- * counterparty that signed its own pack under `" " + key` got
- * `PACK_KEY_UNREADABLE` for the pack and the innocent `COUNTERPART_ABSENT` for
- * the record, and the output contradicted itself: whose pack it was is
- * UNKNOWN, and then no pack is signed by the named key. The second sentence
- * was not established.
- *
- * `incomplete`, like the other two one-sided kinds: "I could not tell".
+ * A conformant hand-off record with no counterpart, no verified pack signed by
+ * the key it names, and at least one pack whose signer is unknown
+ * (`PACK_KEY_UNREADABLE` or `PACK_DOES_NOT_VERIFY`). Whether the named key
+ * signed a pack is unknown, so neither other kind is true. `incomplete`.
  */
 export declare const COUNTERPART_ABSENT_SIGNER_UNKNOWN = "counterpart_absent_signer_unknown";
 /**
- * More than one candidate counterpart that nothing accounts for (4.1 v1.17,
- * A20). The reading is the worst of them and the ambiguity is named: a reader
- * permitted to take one match can be handed an honest decoy beside a tampered
- * record. `count` is how many of the candidates are live, which is the number
- * the ambiguity is about.
+ * More than one live candidate counterpart (§4.1). The reading is the worst of
+ * them and the ambiguity is named, so an honest decoy cannot hide a tampered
+ * record. `count` is the number of live candidates.
  */
 export declare const COUNTERPART_AMBIGUOUS = "counterpart_ambiguous";
+/** A formed pair that failed checks, listed in §4.1's fixed order. */
+export declare const PAIR_FAILED = "pair_failed";
+/** This record itself is malformed under §4.1 (`recordIsMalformed`). */
+export declare const RECORD_MALFORMED = "record_malformed";
 /**
- * A formed pair that failed a check. Carries which checks, from 4.1's own
- * fixed order, so a reader is told the record AND the check.
+ * A candidate counterpart is malformed and this record is not. §4.1 reports
+ * the worst candidate, so without this kind one junk record signed by the
+ * counterparty's key would blame the honest record and drop its other failures.
+ * `incomplete`: the defect is the candidate's, which carries its own
+ * `RECORD_MALFORMED`.
  */
-export declare const PAIR_FAILED = "pair_failed";
+export declare const COUNTERPART_MALFORMED = "counterpart_malformed";
 /**
- * THIS record is wrong: 4.1 governs it and `recordIsMalformed` says so of the
- * record itself. A statement about the record this exception names, and about
- * no other.
+ * This record is one of the two hand-off types, signed and intact, and does
+ * not follow its vocabulary (`recordIsNonconforming`). A producer's error,
+ * never a proven alteration.
  */
-export declare const RECORD_MALFORMED = "record_malformed";
+export declare const RECORD_NONCONFORMING = "record_nonconforming";
 /**
- * A CANDIDATE counterpart of this record is malformed, and this record is not.
- *
- * 4.1 grades every candidate and reports the worst of them, and `malformed`
- * outranks `failed`, so one junk record signed by the counterparty's key makes
- * the reading of a perfectly well formed record `malformed` too. Filed under
- * `RECORD_MALFORMED`, that read as "this record is not a well formed hand-off
- * record" about the HONEST record, and the branch it took skipped the
- * counterpart, ambiguity and `failedChecks` reporting entirely: one junk record
- * both blamed the wrong party and stripped a named `message_hash` failure out
- * of the case. That is proof#133 ruling 6, which 4.1 closed by keeping the
- * UNION of `failedChecks`, reappearing one layer out because this layer
- * discarded that union.
- *
- * A record's own conformance and its candidate's are different facts and do
- * not share a kind. This one is `incomplete` and not `malformed`: the proven
- * defect belongs to the candidate, which carries its own `RECORD_MALFORMED`
- * line, and what is true of THIS record is that its pairing could not be
- * determined. Contributing `malformed` here would attribute the candidate's
- * defect to the record a party being accused did not write.
+ * A candidate counterpart is nonconforming and this record is not.
+ * `incomplete` for the reason `COUNTERPART_MALFORMED` is: the defect is the
+ * candidate's, which carries its own `RECORD_NONCONFORMING`.
  */
-export declare const COUNTERPART_MALFORMED = "counterpart_malformed";
+export declare const COUNTERPART_NONCONFORMING = "counterpart_nonconforming";
 /**
- * A record that its own pack DECLARES and its own pack's READABLE declaration
- * claims in no `handoffs[]` entry. This is proof#137's door, named at the layer
- * that can see it: the holder declared the record and claimed it nowhere, so
- * neither 5.4.2 rule 2 nor rule 7 reaches it and the pack reads `verified`.
- *
- * **It turns on what the PACK said about the record, and never on whether 4.1
- * governs it.** Gating it on "is this a conformant hand-off record" put it
- * behind a value the audited party writes: the same second receipt, respelled
- * with an `ff` ligature in `event_type` and a Cyrillic `е` in
- * `counterparty_public_key`, left 4.1's scope, took the `not_a_handoff_record`
- * branch, and bought a case reading of `verified` with zero exceptions where
- * the conformant spelling read `mixed` with four. proof#136 ratified that a
- * respelling buys a DIFFERENT LINE rather than no line; at this layer it
- * bought no line at all, and a strictly better outcome than honesty.
+ * A record its pack declares and its pack's readable declaration claims in no
+ * `handoffs[]` entry (§5.4.2 rules 2 and 7 cannot reach it). Turns on what the
+ * pack said, never on whether §4.1 governs the record, so respelling
+ * `event_type` cannot move a record out of this check.
  *
- * It is not an accusation. `handoffs[]` MAY be empty and an unclaimed record
- * may be entirely innocent. What it is, is the end of the silence: the reader
- * cannot tell whether an unclaimed record is part of the hand-over the holder
- * meant to give or one it is keeping out of its own account, and that is "I
- * could not tell", which is why it carries `incomplete` and not `verified`.
- *
- * THE COST, stated rather than left to be found: a pack that declares records
- * which are not hand-off sides at all, an ordinary log line among them, is
- * named once per such record, so a case holding one cannot read `verified`.
- * That is the price of a rule with no branch the holder selects, and the only
- * narrower rule available keys on a value the holder writes. A surface that
- * wants the two apart reads `CaseRecordReading.findings`, where
- * `not_a_handoff_record` still says which is which.
+ * Not an accusation: `handoffs[]` may be empty and the record innocent, so it
+ * is `incomplete`. The cost is that a declared non-hand-off record (a log line)
+ * is named too; `CaseRecordReading.findings` tells the two apart.
  */
 export declare const RECORD_UNCLAIMED = "record_unclaimed_by_its_pack";
 /**
- * The pack supplied no `event_bytes` for a record, so this reader cannot see
- * what the record IS in either direction.
- *
- * `event_bytes` is OPTIONAL (5.1, 5.3) and withholding it is minimum
- * disclosure, which the corpus calls a customer's right and not a defect
- * (proof#137, defect 3), so this is not a deviation and does not fail. It is
- * still SAID, because a withheld record is exactly where a missing counterpart
- * would hide, and a reader that dropped it silently would read a trimmed pack
- * as an honest one.
+ * The pack withheld `event_bytes` for a record. Withholding is minimal
+ * disclosure (§5.1, §5.3), not a deviation, but it is said: a withheld record is
+ * where a missing counterpart would hide.
  */
 export declare const RECORD_BYTES_WITHHELD = "record_bytes_withheld";
 /**
- * The pack SUPPLIED `event_bytes` this reader cannot read as
- * `JCS(event record)` (5.4.2 rule 7's parser rule, one implementation in
- * `packRecords`). Bytes the holder handed over that do not decode are a defect
- * in what was handed over, not an absence, so this one is `malformed`.
+ * The pack supplied `event_bytes` that do not read as `JCS(event record)`.
+ * A defect in what was handed over, so `malformed`.
  */
 export declare const RECORD_BYTES_UNREADABLE = "record_bytes_unreadable";
-/**
- * The pack deviates from its own declaration (5.4.2). A proven mismatch, so it
- * fails: a case cannot be clean over a pack that is proven to be trimmed.
- */
+/** The pack deviates from its own declaration (§5.4.2). A proven mismatch: `failed`. */
 export declare const PACK_DECLARATION_DEVIATES = "pack_declaration_deviates";
 /**
- * The pack and the UNSIGNED content handed in beside it do not line up (5.4.2
- * rules 3 and 4, proof#147, ratified by Phil 2026-09-22). A record the pack
- * declares `disclosed` for which no bytes reached this reader, or one it
- * declares `content_withheld` for which bytes reached this reader from the
- * side-content map alone.
- *
- * `incomplete` and never `failed`, which is the whole point of the kind. 5.4
- * grades a pack's declaration partly against content the READER was handed,
- * and whoever assembles a case fills that map in. Under
- * `PACK_DECLARATION_DEVIATES` an accuser could put an intact pack into a
- * `failed` case WITH NO KEY AT ALL: supply bytes for a record its holder
- * declared withheld, or drop the bytes of one it declared disclosed. The pack
- * was intact, its wrapper verified, and its holder had done nothing. This is
- * the mirror of proof#143, where a counterparty makes ITSELF look better by
- * choosing what it hands over.
+ * The pack and the unsigned content beside it do not line up (§5.4.2 rules 3
+ * and 4): a record declared `disclosed` with no bytes, or declared
+ * `content_withheld` with bytes from the side-content map alone.
  *
- * It is emitted BESIDE `PACK_DECLARATION_DEVIATES` where a pack does both,
- * because the two say different things about different records.
+ * `incomplete`, never `failed`: whoever assembles a case fills in that map, so
+ * otherwise an accuser could fail an intact pack with no key. Emitted beside
+ * `PACK_DECLARATION_DEVIATES` when a pack does both.
  */
 export declare const PACK_DECLARATION_CONTENT_DEPENDENT = "pack_declaration_content_dependent";
 /**
- * The pack carries a `declaration` this reader cannot read (5.4.3): an unknown
- * `declaration_version`, an absent or `null` one, a non-object, or one that
- * does not satisfy 5.4.1. `declaration_version` is chosen by the same party
- * that assembles the pack and has no accept-set of its own, so this is UNKNOWN
- * and never clean.
+ * The pack's `declaration` cannot be read (§5.4.3). Its version is chosen by
+ * the pack's assembler with no accept-set, so this is unknown, never clean.
  */
 export declare const PACK_DECLARATION_UNREADABLE = "pack_declaration_unreadable";
 /**
- * The pack carries no `declaration` member at all, so it never said what it
- * holds. `partial` is 5.4.3's own word for a claim nobody made: never
- * `verified`, because there is nothing to check the pack against, and never
- * `failed`, because nothing is wrong.
+ * The pack carries no `declaration`. `partial` (§5.4.3): nothing to check
+ * against, and nothing wrong.
  */
 export declare const PACK_UNDECLARED = "pack_undeclared";
-/**
- * The pack's `body_type` is not one this reader knows to carry `events[]`
- * (`CASE_BODY_TYPES`).
- */
+/** The pack's `body_type` is not in `CASE_BODY_TYPES`. */
 export declare const PACK_BODY_TYPE_UNKNOWN = "pack_body_type_unknown";
-/**
- * The pack carries a body this reader knows and no records in it. A pack that
- * contributes nothing is named rather than passed over.
- */
+/** The pack carries a known body with no records. */
 export declare const PACK_HOLDS_NO_RECORDS = "pack_holds_no_records";
 /**
- * The key the pack's wrapper names is not one this reader can read as a key
- * (`normalizedSigningKey` returns nothing for it), so who signed the pack is
- * UNKNOWN. The pack is not verified and none of its records are read, and
- * every one-sided record whose named key signed no verified pack reads
- * `COUNTERPART_ABSENT_SIGNER_UNKNOWN`.
- *
- * Found by constructing it, while enumerating this module's exits: the wrapper
- * key is the ONE input that separates the two counterpart kinds, and a key this
- * reader could not read used to drop out of that set in silence. The Python
- * `verify_evidence_bundle` accepts a wrapper `public_key` with ASCII
- * whitespace inside it or around it (`bytes.fromhex` skips it; this kernel's
- * verifier rejects it), so a counterparty that signed its own pack under
- * `" " + key` handed a Python reader a pack that verified, contributed no key,
- * and moved the subject from `COUNTERPART_ABSENT_FROM_COUNTERPARTY_RECORDS` to
- * the innocent `COUNTERPART_ABSENT`. The same repair 4.1 made for a RECORD
- * whose envelope key it cannot read (proof#133, fourth hunt): a key a reader
- * holds and cannot read is named, never treated as absent. It is `incomplete`
- * rather than `malformed` because whether the spelling verifies is the envelope
- * layer's call (proof#135), and this reader only knows it cannot read it.
+ * The pack's wrapper key cannot be read (`normalizedSigningKey` returns
+ * nothing), so its signer is unknown. None of its records are read, and a
+ * one-sided record whose named key signed no verified pack reads
+ * `COUNTERPART_ABSENT_SIGNER_UNKNOWN`. A key a reader holds and cannot read is
+ * named, never treated as absent. `incomplete`: whether the spelling verifies
+ * is the envelope layer's call.
  */
 export declare const PACK_KEY_UNREADABLE = "pack_key_unreadable";
 /**
- * The pack does not verify as a bundle: `verifyEvidenceBundle`, run here
- * offline over the pack and its side content, returned `failed` or
- * `malformed`. None of its records are read, because a record from it would
- * reach 4.1 without the verified envelope `HeldRecord` requires, and the key
- * its wrapper claims is never counted as a pack signer: an unverified wrapper
- * claiming the counterparty's key is exactly what an accusing party would
- * forge.
- *
- * `partial` is not this exception. `partial` means the wrapper signature and
- * `body_hash` held and part of the body could not be determined, which is what
- * an unknown body or withheld bytes produce, and those are named on their own.
- *
- * `failed`: a pack in the case is proven broken.
+ * The pack's `bundle.json` cannot be read as JSON: it does not parse, nests too deep, or
+ * names one member twice. The pack is not verified and none of its records are read, and
+ * every other pack in the case still is. `incomplete`: the signature could not be checked.
+ */
+export declare const PACK_UNREADABLE = "pack_unreadable";
+/**
+ * `verifyEvidenceBundle`, run offline here, returned `failed` or `malformed`.
+ * None of its records are read (§4.1 requires verified envelopes), and its
+ * wrapper key is never counted as a pack signer: an unverified wrapper claiming
+ * the counterparty's key is what an accuser would forge. `failed`.
  */
 export declare const PACK_DOES_NOT_VERIFY = "pack_does_not_verify";
 /**
- * The pack's wrapper HOLDS and its CASE GRADE is not `verified`
- * (evidence-bundle 5.5.1 step 1 v1.20, A23; it replaces
- * `pack_bundle_not_verified`, which carried the bundle status alone). The case
- * grade is the pack grade of 5.4.5, taken twice: the SIGNED grade over the run
- * with the side map empty, and the FULL grade over the run with it. The signed
- * grade decides where it is `failed` or `malformed`; a failure only the full
- * grade reaches is `incomplete`, because it rests on bytes nobody signed;
- * otherwise the full grade. A body the verifier could not read is `malformed`,
- * a body that is not one of the two event-carrying bodies takes the signed
- * run's status, and a verifier that graded a different number of records than
- * the pack holds takes the signed status, or `malformed` where that status is
+ * The pack's wrapper holds and its case grade is not `verified`
+ * (evidence-bundle §5.5.1). The case grade is the §5.4.5 pack grade taken
+ * twice: signed (side map empty) and full (with it). The signed grade decides
+ * where it is `failed` or `malformed`; a failure only the full grade reaches is
+ * `incomplete`, since it rests on unsigned bytes; otherwise the full grade.
+ * An unreadable body is `malformed`; a non-event body takes the signed status;
+ * a record-count mismatch takes the signed status, or `malformed` where that is
  * `verified`.
  *
- * The exception carries `status`, the case grade; `causes`, the 5.4.5 cause
- * kinds of the grade that decided it (none in the first three branches); and
- * `reasons`, the verifier's reasons from the run with the side map empty. It
- * CONTRIBUTES the grade, and `incomplete` for `pending`, `not_found` or
- * `mixed`, so the case verdict never reads above its weakest pack.
+ * Carries `status`, `causes` (the deciding grade's cause kinds) and `reasons`
+ * (from the signed run). Contributes the grade, or `incomplete` for `pending`,
+ * `not_found` or `mixed`, so the case never reads above its weakest pack.
  */
 export declare const PACK_GRADE_NOT_VERIFIED = "pack_grade_not_verified";
 /**
- * A record in a pack whose wrapper holds, whose OWN envelope does not verify
- * (`EventResult.envelopeOk` is false). Not read by 4.1, and NAMED with the
- * verifier's reasons. `failed`: a pack its holder signed carries a record that
- * is proven not to verify. As a reason to drop the whole pack it let the
- * counterparty add one junk event to its own pack, re-seal it, and strip a
- * proven `message_hash` failure out of the case (gate 3 on proof#140).
+ * A record whose own envelope does not verify, in a pack whose wrapper holds.
+ * Not read by §4.1. `failed`. Scoped to the record so one junk event cannot
+ * drop the whole pack and a proven failure with it.
  */
 export declare const RECORD_ENVELOPE_DOES_NOT_VERIFY = "record_envelope_does_not_verify";
 /**
- * A record whose envelope verifies and which fails another check the bundle
- * verifier grades it on inside its pack (its inclusion proof, its join to a
- * checkpoint or stamp, a retired field name). NAMED with the verifier's
- * reasons, `failed`, and the record STAYS in the pile: a holder that could
- * remove its own tampered receipt from pairing by breaking that receipt's
- * inclusion proof would be choosing its own reading.
+ * A record whose envelope verifies but which fails another check in its pack
+ * (inclusion proof, checkpoint or stamp join, a retired field). `failed`, and
+ * the record stays in the pile, so breaking its own proof cannot remove a
+ * tampered receipt from pairing.
  */
 export declare const RECORD_DOES_NOT_VERIFY_IN_ITS_PACK = "record_does_not_verify_in_its_pack";
 /**
- * A record whose envelope verifies and whose disclosed content does not hash to
- * the hash it commits to, its `content_hash` or a hand-off record's
- * `message_hash` (evidence-bundle v1.19, A20) (`EventResult.contentOk` is false), with the
- * side map EMPTY: the content is inside the signed body. The same mismatch from
- * content handed in beside the pack is `RECORD_CONTENT_DEPENDENT` (proof#159).
- * `failed`, and the record STAYS in the pile: content beside a pack is unsigned and often
- * supplied by whoever assembled the case, and gate 3 on proof#140 showed that
- * party erasing an honest verified pair by swapping it.
+ * A record whose disclosed content does not hash to its `content_hash` (or a
+ * hand-off record's `message_hash`) with the side map empty: the content is in
+ * the signed body. `failed`, and the record stays in the pile.
  */
 export declare const RECORD_CONTENT_MISMATCH = "record_content_mismatch";
 /**
- * The two readings proof#147 did not reach, given its shape (proof#159, ruled
- * by Phil 2026-09-22, evidence-bundle.md 5.5.4 v1.16, A17). A pack whose
- * bundle verdict is `failed` ONLY when read with the unsigned content handed
- * in beside it, and `failed` no longer when read with that map empty, is
- * `PACK_BUNDLE_CONTENT_DEPENDENT`; a record whose content mismatch comes from
- * that map alone is `RECORD_CONTENT_DEPENDENT`. Both are `incomplete`: the
- * reader established that the bytes it was handed are not the bytes the record
- * commits to, and nothing about the party that signed the record, because
- * whoever assembled the case chose those bytes with no key. Up to v1.15 both
- * readings carried `failed`, and one flipped nibble of accuser-supplied content
- * put a `failed` against an intact pack; under A17's headline rule that would
- * have become the case's headline.
- *
- * The test that separates the two is the one proof#159 states for the inverse:
- * every deviation a signature covers still reads `failed` with the side map
- * EMPTY. So the pack is verified twice, with the map and without it, and what
- * fails without it is `PACK_GRADE_NOT_VERIFIED`, `RECORD_CONTENT_MISMATCH`
- * (content inside the signed body) or `RECORD_DOES_NOT_VERIFY_IN_ITS_PACK`,
- * each still `failed`. Emptying the map is the most a party that signed
- * nothing can do to starve the check, and it cannot remove any of those.
+ * A pack whose bundle verdict is `failed` only with the unsigned side content,
+ * and a record whose content mismatch comes from that content alone
+ * (evidence-bundle §5.5.4). Both `incomplete`: whoever assembled the case chose
+ * those bytes with no key. Every deviation a signature covers still fails with
+ * the side map empty, so starving the check cannot hide one.
  */
 export declare const PACK_BUNDLE_CONTENT_DEPENDENT = "pack_bundle_content_dependent";
 export declare const RECORD_CONTENT_DEPENDENT = "record_content_dependent";
 /**
- * A record signed under a ratified profile that is under quarantine
- * (`CASE_QUARANTINED_PROFILES`, pending DL-63). Not read, in any kernel.
- * `incomplete`: whether it verifies is what the kernels disagree about.
+ * A record under a quarantined profile (`CASE_QUARANTINED_PROFILES`). Not read.
+ * `incomplete`.
  */
 export declare const RECORD_PROFILE_QUARANTINED = "record_profile_quarantined";
 /** The reader was handed no packs at all. */
 export declare const CASE_HOLDS_NO_PACKS = "case_holds_no_packs";
 /**
- * The three NOTEs (5.5.3 v1.20, extended proof#148): findings on the reading
- * with no contribution, printed in the scope sentence so a clean verdict
- * never hides any of them. `pack_undeclared` is a note only where the
- * reading holds no hand-off record; where it holds one, it is the exception
- * of that name.
+ * Notes (§5.5.3): findings with no verdict contribution, printed in the scope
+ * sentence so a clean verdict never hides them. `pack_undeclared` is a note
+ * only where the reading holds no hand-off record; otherwise it is the
+ * exception.
  */
 export declare const CONTENT_WITHHELD_BY_DECLARATION = "content_withheld_by_declaration";
 /**
- * A pack's wrapper carries a present `co_signatures` (evidence-bundle.md §2,
- * decided by Phil 2026-09-24 on proof#148). The field verifies nothing and
- * sits outside the wrapper's signed scope, so the case reading names it
- * rather than presenting it as evidence, and it contributes no verdict.
+ * A pack's wrapper carries `co_signatures` (evidence-bundle section 2). It verifies
+ * nothing and sits outside the signed scope, so it is named, not presented as
+ * evidence.
  */
 export declare const CO_SIGNATURES_PRESENT = "co_signatures_present";
 export declare const CASE_NOTE_KINDS: readonly ["pack_undeclared", "content_withheld_by_declaration", "co_signatures_present"];
 export type CaseNoteKind = (typeof CASE_NOTE_KINDS)[number];
-/**
- * Every exception this reader can report, as a closed set. A surface may render
- * them and a test may assert over them; nothing outside this array is emitted.
- */
-export declare const CASE_EXCEPTION_KINDS: readonly ["counterpart_absent", "counterpart_absent_from_counterparty_records", "counterpart_absent_signer_unknown", "counterpart_ambiguous", "counterpart_malformed", "pair_failed", "record_malformed", "record_unclaimed_by_its_pack", "record_bytes_withheld", "record_bytes_unreadable", "pack_declaration_deviates", "pack_declaration_content_dependent", "pack_declaration_unreadable", "pack_undeclared", "pack_body_type_unknown", "pack_holds_no_records", "pack_key_unreadable", "pack_does_not_verify", "pack_grade_not_verified", "pack_bundle_content_dependent", "record_envelope_does_not_verify", "record_does_not_verify_in_its_pack", "record_content_mismatch", "record_content_dependent", "record_profile_quarantined", "case_holds_no_packs"];
+/** Every exception this reader can report. Nothing outside this set is emitted. */
+export declare const CASE_EXCEPTION_KINDS: readonly ["counterpart_absent", "counterpart_absent_from_counterparty_records", "counterpart_absent_signer_unknown", "counterpart_ambiguous", "counterpart_malformed", "counterpart_nonconforming", "pair_failed", "record_malformed", "record_nonconforming", "record_unclaimed_by_its_pack", "record_bytes_withheld", "record_bytes_unreadable", "pack_declaration_deviates", "pack_declaration_content_dependent", "pack_declaration_unreadable", "pack_undeclared", "pack_body_type_unknown", "pack_holds_no_records", "pack_unreadable", "pack_key_unreadable", "pack_does_not_verify", "pack_grade_not_verified", "pack_bundle_content_dependent", "record_envelope_does_not_verify", "record_does_not_verify_in_its_pack", "record_content_mismatch", "record_content_dependent", "record_profile_quarantined", "case_holds_no_packs"];
 export type CaseExceptionKind = (typeof CASE_EXCEPTION_KINDS)[number];
 /**
- * The status every record in every pack carries (evidence-bundle 5.5.4
- * v1.35, A43, proof#204), as a closed set. A record is listed for each element
- * of its pack's `body.events` as `packRecords` reads them, or, for a
- * `sanning.evidence.export/v2` pack, of the events of the inline source
- * bundle it wraps (`resolveTraceEvents`), and gets exactly one:
- *
- * - `read_clean`: the record went into the pile, no exception carries its
- *   `packIndex` and `recordIndex`, and its pack's declaration check
- *   names it by nothing (`declarationFindings` is empty). It says nothing
- *   about its PACK: the pack's own grade and exceptions are on the pack, and a
- *   surface MUST show that grade beside the status.
- * - `read_flagged`: the record went into the pile, and at least one
- *   exception carries its `packIndex` and `recordIndex`, or its pack's
- *   declaration check names its `eventId` by a deviation or a content
- *   finding (`declarationFindings` is not empty; under an `eventId` the
- *   pack carries twice, every record with that id). An exception about the
- *   pack alone flags no record.
- * - `not_read`: the record never went into the pile. `reason` is the kind
- *   of the exception that says why, on the record
- *   (`record_profile_quarantined`, `record_envelope_does_not_verify`,
- *   `record_bytes_withheld`, `record_bytes_unreadable`) or on its pack
- *   (`pack_key_unreadable`, `pack_does_not_verify`,
- *   `pack_body_type_unknown`, `pack_grade_not_verified` where the body
- *   could not be read or the verifier graded a different number of records).
- *   An export's wrapped records carry the reason of the exception their pack
- *   actually got: `pack_body_type_unknown` where its wrapper holds, and
- *   otherwise `pack_key_unreadable`, `pack_does_not_verify` or
- *   `pack_grade_not_verified`.
+ * The status each record of each pack gets (evidence-bundle §5.5.4), one per
+ * element of `body.events` (or, for an export, its source bundle's events):
  *
- * Before A43 the reading listed only the records it read, so a surface had to
- * work out which records were missing, and why, by a rule of its own.
+ * - `read_clean`: in the pile, named by no exception and no declaration
+ *   finding. Says nothing about its pack; a surface must show the pack grade
+ *   beside it.
+ * - `read_flagged`: in the pile, and named by an exception or a declaration
+ *   finding (every record sharing a duplicated `eventId`). A pack-only
+ *   exception flags no record.
+ * - `not_read`: never in the pile. `reason` is the record or pack exception
+ *   that says why; an export's wrapped records take their pack's exception.
  */
 export declare const CASE_RECORD_STATUSES: readonly ["read_clean", "read_flagged", "not_read"];
 export type CaseRecordStatus = (typeof CASE_RECORD_STATUSES)[number];
 /**
- * One pack in a case, as a reader was handed it.
- *
- * `ref` is the reader's own name for the pack (a file name, an archive member)
- * and is never read from the pack itself: a value inside the pack is written by
- * the party that assembled it, and two packs are free to claim one name.
- *
- * A caller passes packs as it received them. `readCase` runs
- * `verifyEvidenceBundle` over each one itself, so `HeldRecord`'s precondition
- * (every envelope it compares has verified) is met by this module and cannot
- * be skipped by a caller. A pack that does not verify is
- * `PACK_DOES_NOT_VERIFY`.
+ * One pack in a case, as handed to the reader. `ref` is the reader's own name
+ * for it, never read from the pack, since two packs can claim one name.
+ * `readCase` verifies each pack itself, so the verified-envelope precondition
+ * of `HeldRecord` cannot be skipped by a caller.
  */
 export interface CasePack {
     ref: string;
     bundle: unknown;
     content?: SideContentMap | null;
+    /** Why the pack's `bundle.json` could not be read, where it could not; `bundle` is then ignored (`PACK_UNREADABLE`). */
+    unreadable?: string | null;
 }
-/** One named exception, as data. A surface renders its own prose or calls
- * `renderException`. */
+/** One named exception, as data. A surface renders it or calls `renderException`. */
 export interface CaseException {
     kind: CaseExceptionKind;
-    /**
-     * Which pack this is about, by the reader's own name for it. Two packs can
-     * carry one `ref`, so it is a label and never the join: `packIndex` is.
-     */
+    /** The reader's name for the pack: a label, never the join (`packIndex` is). */
     packRef?: string;
-    /**
-     * Which pack this is about, by its position in `CaseReading.packs` (0
-     * first), present wherever `packRef` is (A43). Unique in the reading.
-     */
+    /** The pack's position in `CaseReading.packs`, wherever `packRef` is set. */
     packIndex?: number;
     /** Which record, by its envelope `event_id`. */
     eventId?: string;
     /**
-     * Which record, by its position in its pack's `body.events` (0 first),
-     * present wherever `eventId` is (A43). One pack can carry one `event_id`
-     * twice, so `packIndex` and `recordIndex` together are the join to
-     * `CaseReading.records`.
+     * The record's position in its pack's events, wherever `eventId` is set.
+     * With `packIndex`, the join to `CaseReading.records`, since one pack can
+     * carry an `event_id` twice.
      */
     recordIndex?: number;
-    /**
-     * The counterparty key the record named, for the two counterpart kinds.
-     * Normalized (`normalizedSigningKey`), so a reader compares what this module
-     * compared.
-     */
+    /** The counterparty key the record named, normalized as this module compared it. */
     counterpartyKey?: string | null;
-    /** Which checks a formed pair failed, in 4.1's fixed order. */
+    /** Which checks a formed pair failed, in §4.1's fixed order. */
     failedChecks?: string[];
     /**
-     * How many of a thing the exception is about, where it is about a count. On
-     * `COUNTERPART_ABSENT` it is set only where 4.1 set every candidate aside
-     * (v1.17, A20), and it is how many were set aside.
+     * The count the exception is about. On `COUNTERPART_ABSENT`, set only where
+     * every candidate was set aside, and it is how many were.
      */
     count?: number;
     /** The pack's case grade, for `PACK_GRADE_NOT_VERIFIED`. */
     status?: CaseVerdict;
     /**
-     * The 5.4.5 cause kinds of the grade that decided the case grade, for
-     * `PACK_GRADE_NOT_VERIFIED`, in the grade's order. Empty where the grade was
-     * not computed (an unreadable body, a body that is not one of the two
-     * event-carrying ones, a verifier that graded too few records).
+     * For `PACK_GRADE_NOT_VERIFIED`, the §5.4.5 cause kinds of the deciding grade.
+     * Empty where no grade was computed.
      */
     causes?: PackGradeCauseKind[];
     /**
-     * What the bundle verifier said, as it said it, for the kinds that carry a
-     * verifier's grading: `PACK_GRADE_NOT_VERIFIED` and the three record kinds
-     * graded on the record's own envelope and content.
+     * The bundle verifier's own reasons, for `PACK_GRADE_NOT_VERIFIED` and the
+     * record kinds graded on the record's envelope and content.
      */
     reasons?: string[];
+    /**
+     * For `PACK_GRADE_NOT_VERIFIED`, every problem behind the grade, each mapped to one
+     * claim and one state (`claims.ts`), at this pack's position. A grade that is not
+     * `failed` carries no disproof: one that only the unsigned side map reached reads
+     * `not_proven`.
+     */
+    problems?: Problem[];
 }
 /**
- * One record of one pack, with its status and, where it was read, 4.1's
- * reading of it.
- *
- * EVERY record of every pack gets one of these (A43), in pack order and then
- * in bundle order: the ones this reader read, including the ones that are not
- * hand-off records at all (`findings` carries `not_a_handoff_record`), and the
- * ones it did not, with `status` `not_read` and the `reason`. 4.1 (v1.9, A14)
- * names why: the one thing an attacker wants is for a record to be absent from
- * the output. An export's wrapped records are listed, `not_read`. A pack whose
- * body carries no `events` array, and wraps none, lists none, and its own
- * exception says why.
+ * One record of one pack, with its status and, where read, §4.1's reading.
+ * Every record of every pack is listed, in pack then bundle order, read or
+ * not, because the one thing an attacker wants is a record absent from the
+ * output. A pack with no `events` array lists none; its exception says why.
  */
 export interface CaseRecordReading {
     packRef: string;
-    /** The pack, by its position in `CaseReading.packs` (A43). */
+    /** The pack's position in `CaseReading.packs`. */
     packIndex: number;
     eventId: string;
     /**
-     * The record, by its position in the list of records its pack lists (A43):
-     * `body.events`, or for a `sanning.evidence.export/v2` pack the events of the
-     * source bundle it wraps.
+     * The record's position in its pack's events (for an export, its source
+     * bundle's events).
      */
     recordIndex: number;
-    /** One of `CASE_RECORD_STATUSES` (A43). */
     status: CaseRecordStatus;
-    /**
-     * For `not_read`, the kind of the exception that says why; `null` for a
-     * record that was read.
-     */
+    /** For `not_read`, the exception kind that says why; else `null`. */
     reason: CaseExceptionKind | null;
     /**
-     * The kinds its pack's declaration check names this record by, deviations
-     * (`DECLARATION_DEVIATION_KINDS`) then content findings
-     * (`DECLARATION_CONTENT_KINDS`), each in the check's own order. Matched on
-     * `eventId`, so under an `event_id` the pack carries twice every record with
-     * that id carries it. A record that went into the pile with any is
-     * `read_flagged` (A43).
+     * The declaration check's deviations then content findings for this record's
+     * `eventId` (every record sharing a duplicated id). Any makes a read record
+     * `read_flagged`.
      */
     declarationFindings: string[];
-    /** 4.1's verdict, or `null` where 4.1 gave none or the record was not read. */
+    /** §4.1's verdict, or `null` where it gave none or the record was not read. */
     verdict: string | null;
     findings: string[];
     failedChecks: string[];
     /**
-     * 4.1's candidate counterparts, each as `<pack ref>/<event_id>`. A LABEL for
-     * a person to read and never the join: two packs can carry one ref, and one
-     * pack one `event_id` twice (A43).
+     * §4.1's candidate counterparts as `<pack ref>/<event_id>`: labels for a
+     * person, never the join.
      */
     counterparts: string[];
     /**
-     * The role the pack's v2 declaration signs for this record, `handoff` or
-     * `step`, or `null` where the pack's declaration is absent, unreadable or
-     * v1, or does not declare the record (5.5.1 v1.20).
+     * The role the pack's v2 declaration signs for this record, or `null` where
+     * the declaration is absent, unreadable, v1 or silent on it (§5.5.1).
      */
     role: DeclarationRole | null;
+    /**
+     * The `sanning.agent` reading of this record (agent-events.md section 10), read with
+     * every record of every pack in the case, or `null` where step 1 gives it no
+     * verdict or it was not read. Its findings move no verdict; a `nonconforming`
+     * or `partial` reading moves its pack's grade (section 5.4.5).
+     */
+    agent: AgentRecordReading | null;
 }
-/**
- * One NOTE on the reading (5.5.3 v1.20): something true a reader needs and
- * nothing a reader could not tell, so it carries no contribution.
- */
+/** A note on the reading (§5.5.3): true and needed, with no contribution. */
 export interface CaseNote {
     kind: CaseNoteKind;
-    /** Which pack, by the reader's own name for it. */
     packRef: string;
-    /** Which pack, by its position in `CaseReading.packs` (A43). */
     packIndex: number;
-    /**
-     * For `CONTENT_WITHHELD_BY_DECLARATION`, how many of the pack's records its
-     * declaration withholds.
-     */
+    /** For `CONTENT_WITHHELD_BY_DECLARATION`, how many records are withheld. */
     count?: number;
 }
 /**
- * One pack as the reading read it, in the order the reader was given them
- * (5.5.4 v1.20). A surface names a pack by `signingKey`, the key that signed
- * its wrapper, and never by an organization (D10).
+ * One pack as read, in the order given (§5.5.4). A surface names a pack by
+ * `signingKey`, never by an organization.
  */
 export interface CasePackReading {
-    /**
-     * The pack's position in the order the reader was given the packs, 0 first
-     * (A43): the one name for a pack that is unique in the reading. Every
-     * exception, note and record names its pack by it as `packIndex`.
-     */
+    /** The pack's position in the order given: its one unique name in the reading. */
     index: number;
-    /** The reader's own name for the pack. Two packs can carry the same one. */
+    /** The reader's own name for the pack. Not unique. */
     ref: string;
     /** The wrapper key, normalized, or `null` where this reader could not read it. */
     signingKey: string | null;
-    /**
-     * The case grade (5.5.1 step 1), or `null` where the wrapper did not hold or
-     * the key could not be read.
-     */
+    /** The case grade (§5.5.1), or `null` where the wrapper did not hold or the key is unreadable. */
     grade: PackVerdict | null;
-    /**
-     * Records withheld by the pack's declaration (5.4.5): in scope for their
-     * signature and commitment only. Never counted as verified records.
-     */
+    /** Records withheld by the declaration (§5.4.5). Never counted as verified. */
     recordsWithheld: number;
-    /**
-     * `sanning.declaration/v1`, `sanning.declaration/v2`, or `null` where the
-     * pack carries no declaration, one this reader does not know, or a body this
-     * reader does not read.
-     */
+    /** The declaration version, or `null` where absent, unknown or in an unread body. */
     declarationVersion: string | null;
 }
 export interface CaseReading {
     verdict: CaseVerdict;
+    /** `changed` or `nonconforming` where `verdict` is `failed`. */
+    reasonKind?: ReasonKind;
     /**
-     * Every exception, in a fixed order: the pack-level ones for each pack in the
-     * order the reader was given the packs, then the record-level ones in pack
-     * order and bundle order.
-     *
-     * **An empty array is the only shape a reader may read as clean**, and it is
-     * reachable only together with `verdict === "verified"`.
+     * Every problem behind the verdict, each mapped to one claim and one state, in
+     * exception order. Empty exactly where `verdict` is `verified`.
      */
-    exceptions: CaseException[];
+    problems: Problem[];
     /**
-     * One entry per record of every pack, read or not, in pack order and then
-     * bundle order, each with its status (A43).
+     * Every exception: pack-level ones in pack order, then record-level ones in
+     * pack and bundle order. Empty is the only clean shape, and only with
+     * `verdict === "verified"`.
      */
+    exceptions: CaseException[];
+    /** One entry per record of every pack, read or not. */
     records: CaseRecordReading[];
     /**
-     * Every `[contributor, verdict]` the case verdict was computed from, in
-     * order. Carried so the verdict is auditable rather than asserted, and so two
-     * kernels compare the derivation and not only its answer.
+     * Every `[contributor, verdict]` the verdict was computed from, so the
+     * verdict is auditable rather than asserted.
      */
     contributions: [string, CaseVerdict][];
-    /** How many hand-off records the case held. Zero is its own exception. */
+    /** Hand-off records in the case. Zero is its own exception. */
     handoffRecords: number;
     /**
-     * Whether any witness behind any pack in this case was re-fetched on chain.
-     * It is **false** in every reading this function produces, and it is here to
-     * be READ rather than inferred.
-     *
-     * Gate 4 on proof#140, finding 3. A pack is `partial` only when `anchor_ref`
-     * is ABSENT, so the honest omission is named and the unverifiable assertion
-     * is not: a holder that writes any `anchor_ref` at all reads `verified`,
-     * because this reader makes no network call. That is the standing lens
-     * inverted, and the answer is not to refuse the assertion, which no offline
-     * reader can grade. It is to say what was not checked, so nobody reads a
-     * clean case as "a witness held". Re-fetching on chain stays the caller's
-     * job, exactly as `evidence-bundle.md` 5.5's does-not-claim list says.
-     *
-     * Derived from each pack's own `EvidenceBundleResult.onChainChecked` rather
-     * than written as a constant, so it stays true of what was actually run:
-     * this reader passes no gateways, and it is the ALL of an empty list of
-     * checked packs, which is false.
+     * Whether any witness was re-fetched on chain. Always false here: this reader
+     * makes no network call, so a pack with any `anchor_ref` reads `verified`
+     * without the witness being checked. Stated so nobody reads a clean case as
+     * "a witness held"; re-fetching is the caller's (evidence-bundle §5.5).
+     * Derived from each pack's `onChainChecked`, not written as a constant.
      */
     onChainChecked: boolean;
-    /** The NOTEs, in pack order (5.5.3 v1.20). No contribution. */
+    /** Notes, in pack order (§5.5.3). No contribution. */
     notes: CaseNote[];
-    /** One reading per pack, in the order the reader was given them. */
+    /** One reading per pack, in the order given. */
     packs: CasePackReading[];
 }
 /**
- * Read a whole case: several packs in, one verdict and its exceptions out.
- *
- * The order of the work, and why it is this order:
+ * Every exception, mapped to its claim and state, in exception order. A pack grade
+ * carries its own problems; a pack grade with none (a defence) reads as its status.
+ */
+export declare function caseProblems(exceptions: readonly CaseException[]): Problem[];
+/**
+ * Reads a case: packs in, one verdict and its exceptions out.
  *
- * 1. **Each pack is read into records**, through `packRecords`, which is the
- *    one implementation of "what does this pack hold". A pack whose `body_type`
- *    this reader does not know, or which holds no records, is NAMED here and
- *    its records are not silently zero.
- * 2. **Each pack is graded against its own declaration**, through
- *    `checkDeclaration`, which is the one implementation of 5.4. A pack proven
- *    to deviate from its own claim fails the case.
- * 3. **Every record every pack supplied goes into ONE pile**, with no partition
- *    by pack, by issuer or by organization, and the pile is read by
- *    `readHandoffs`, which is the one implementation of 4.1. This is where
- *    matching happens, and it is on keys and hashes alone.
- * 4. **Each reading becomes an exception or a clean contribution**, and the two
- *    counterpart kinds are separated by asking whether a pack SIGNED by the
- *    counterparty's key is in the case, a key read from every pack's wrapper
- *    before any exit can skip it.
+ * 1. Each pack is read into records (`packRecords`); an unknown body or no
+ *    records is named.
+ * 2. Each pack is graded against its own declaration (`checkDeclaration`).
+ * 3. Every record goes into one pile, unpartitioned, read by `readHandoffs`.
+ * 4. Each reading becomes an exception or a clean contribution. The
+ *    counterpart kinds are told apart by whether a pack signed by the
+ *    counterparty's key is in the case, read from every wrapper before any exit.
  *
- * A record whose bytes the pack did not supply never reaches the pile, because
- * there is nothing to put in it. That is exactly the shape this module has to
- * refuse to pass over in silence, so it is named at step 1 and carries
- * `incomplete`: the reader genuinely cannot tell whether the record it cannot
- * see is the counterpart that is missing.
+ * Before step 1 the agent records of every pack are read as one pile
+ * (agent-events.md section 10), and each pack is graded with those readings
+ * (evidence-bundle.md section 5.4.5, section 5.5.1).
  */
 export declare function readCase(packs: readonly CasePack[]): Promise<CaseReading>;
+/**
+ * The house wording for one exception. Optional: the verdict and the set of
+ * exceptions are what must not vary between surfaces.
+ */
 export declare function renderException(exception: CaseException): string;
-/** The house wording for one NOTE. Offered, not imposed, as `renderException` is. */
+/** The house wording for one note. */
 export declare function renderCaseNote(note: CaseNote): string;
 /**
- * The scope sentence, printed directly under the headline (evidence-bundle
- * 5.5.6 v1.20, A26), byte for byte the text `render_case_summary` returns.
- *
- * The packs in the reading; the distinct keys, compared as keys, that signed
- * the wrapper of a pack whose wrapper held; the hand-off records; the
- * exceptions; and that the reading was made offline. Where any pack holds
- * records withheld by its declaration, their total; where any pack is noted
- * `pack_undeclared`, how many. Those two lines are part of what the headline
- * MEANS, and a surface MUST print them with it.
- *
- * What was not checked on the public record is no longer a clause here. It is
- * the witness line (`renderWitnessLine`), printed with every headline.
+ * The scope sentence printed under the headline (evidence-bundle §5.5.6): packs,
+ * distinct signing keys of packs whose wrapper held, hand-off records,
+ * exceptions, and that it was read offline, plus withheld and undeclared
+ * counts where non-zero. Those counts are part of what the headline means, and
+ * a surface must print them with it.
  */
 export declare function renderCaseSummary(reading: CaseReading): string;
 /**
- * The one display title of each of the eight 3 words. A surface prints the
- * title, never the word, and never a title of its own (#173, A18). The wording
- * is Will's to change through the glossary (DL-71); what each MEANS is pinned
- * in the spec.
+ * The one display title of each of the three section 3 verdicts. A surface prints the
+ * title, never the word, and never a title of its own.
  */
 export declare const VERDICT_DISPLAY_TITLES: Readonly<Record<string, string>>;
 /**
- * What a reader may rely on, for each of the six words a case reading reaches
- * (5.5.6 v1.20, A26; the `verified` text at v1.28, A35), the same for every
- * drop. `pending` and `not_found` never head a case reading: they are
- * witness states. `verified` is the base sentence, printed alone where the
- * drop holds no hand-off record; a caller reads `caseReliance` for
- * `verified`, never this mapping directly.
+ * What a reader may rely on, for each verdict a case reading reaches (section 5.5.6), the
+ * same for every drop, keyed by the verdict and, for `failed`, its reason kind. Call
+ * `caseReliance` rather than reading `verified` here directly.
  */
-export declare const CASE_RELIANCE: Readonly<Record<CaseVerdict, string>>;
+export declare const CASE_RELIANCE: Readonly<Record<CaseVerdict | "failed_nonconforming", string>>;
 /**
- * The clause a `verified` drop that holds a hand-off record gains, inserted
- * after `CASE_RELIANCE`'s first sentence (5.5.6, A35). Never printed alone,
- * and never where `handoffRecords` is zero: most drops hold one agent's
- * pack and no hand-off to say anything about.
+ * Added to a `verified` reliance line after its first sentence, only where the
+ * drop holds a hand-off record.
  */
 export declare const CASE_RELIANCE_HANDOFF_CLAUSE = "Every hand-off with both sides in this drop is intact.";
 /**
- * What a reader may rely on for one case reading (5.5.6 v1.28, A35), byte
- * for byte the text `case_reliance`'s Python sibling returns.
- *
- * For every word but `verified` this is `CASE_RELIANCE` unchanged. For
- * `verified`, the hand-off clause is inserted after the first sentence
- * where `handoffRecords` is not zero, and left out where it is zero: the
- * base sentence never claims a hand-off the drop does not hold.
+ * Added after the reliance line's first sentence, for every verdict, where the
+ * drop holds `environment: "dev"` envelopes: `dev` if all are, `mixed` if some.
+ */
+export declare const CASE_RELIANCE_SANDBOX: Readonly<Record<EnvironmentMarker, string>>;
+/**
+ * What a reader may rely on for one case reading (§5.5.6). The sandbox
+ * sentence, if any, follows the first sentence and precedes the hand-off
+ * clause, which a `verified` reading gains only with `handoffRecords > 0`, so
+ * the line never claims a hand-off the drop does not hold.
  */
-export declare function caseReliance(verdict: CaseVerdict, handoffRecords: number): string;
-/** The three witness states, and how each is printed (5.5.6, D7). No other. */
+export declare function caseReliance(verdict: CaseVerdict, handoffRecords: number, environmentMarker?: EnvironmentMarker | null, reasonKind?: ReasonKind | null): string;
+/** The three witness states and how each is printed (§5.5.6). No others. */
 export declare const WITNESS_STATES: {
     readonly confirmed: "Confirmed on the public record";
     readonly not_checked: "Not checked";
@@ -1008,34 +545,30 @@ export declare const WITNESS_STATES: {
 };
 export type WitnessState = keyof typeof WITNESS_STATES;
 /**
- * The witness line: a lookup of the public record, reported beside the
- * headline and never in it (D7). It never raises or lowers the headline and
- * never changes its title. `reasons` says why a `not_checked` line did not
- * settle, in a fixed order; `services` names each service that answered, as
- * the URL the lookup used: named, never trusted (6).
+ * The result of a public-record lookup, reported beside the headline, never
+ * in it, and never moving it. `reasons` says why `not_checked` did not settle;
+ * `services` names each gateway that answered: named, never trusted.
  */
 export interface WitnessLine {
     state: WitnessState;
     reasons: string[];
     services: string[];
     /**
-     * Witness times a pack caches that no lookup settled, as `[blockHeight,
-     * blockTime]`, distinct and in time order (5.6.6, v1.25, A30). Printed labelled
-     * not checked, and never as a time a reader may rely on. Absent reads as none.
+     * Cached witness times no lookup settled, as `[blockHeight, blockTime]`,
+     * distinct and in time order (§5.6.6). Printed as not checked, never as a
+     * time a reader may rely on.
      */
     cached?: [number, number][];
     /**
-     * Witness times the public record returned where they matched a pack's
-     * cache, distinct and in time order. The gateway's answer, named with the
-     * service, never the cache's value. Absent reads as none.
+     * Witness times the public record returned that matched the cache, distinct
+     * and in time order. Always the gateway's answer, never the cache's value.
      */
     recorded?: [number, number][];
 }
-/** The line printed where no lookup ran, which is every reading this kernel produces on its own. */
+/** The line where no lookup ran: every reading this module produces on its own. */
 export declare const WITNESS_NOT_LOOKED_UP: Readonly<WitnessLine>;
-/** The witness line as both kernels print it. */
-/** How a witness time a pack caches is printed where nothing checked it (5.5.6, 5.6.6, v1.25, A30). */
+/** A cached witness time no lookup checked (§5.6.6). */
 export declare const WITNESS_TIME_CACHED = "the pack dates the witness, not checked";
-/** How a witness time the public record returned is printed where it matched the cache. */
+/** A witness time the public record returned that matched the cache. */
 export declare const WITNESS_TIME_RECORDED = "the public record dates the witness";
 export declare function renderWitnessLine(line: WitnessLine): string;