@sanning/proof 0.19.1 → 0.20.0

package/src/evidence.ts

@@ -1,29 +1,18 @@
-// Evidence-bundle verification (sanning-io/proof specs/evidence-bundle.md).
+// Evidence-bundle verification (specs/evidence-bundle.md).
 //
-// A `sanning.evidence/v1` bundle is a SIGNED wrapper around a producer-specific
-// `body`. This module verifies the `sanning.anchor.trace/v3` body, the
-// @sanning/anchor SDK trace: a self-verifying serialization of InclusionReceipt[]
-// (per-event signed envelopes + their checkpoints + RFC 9162 inclusion proofs).
-//
-// The algorithm is the kernel discipline applied one level up (evidence-bundle
-// §1, §4): inherit-don't-invent (same JCS, SHA-256, Ed25519), wrap-don't-merge
-// (the body is opaque to the wrapper), recompute-don't-trust-the-verdict
-// (every claim is re-derived from `body`, never read off `verdict.status`),
-// reject-unknown-major. No Sanning service is in the trust path: the bundle is
-// self-verifying offline against the embedded `public_key`; the optional
-// gateway re-fetch only confirms the checkpoints are anchored on-chain.
-//
-// Scope: this verifies a SINGLE evidence bundle. Chain walking over
-// `previous_hash` across successive exports is consumer-layer logic above it.
-
+// A `sanning.evidence/v1` bundle is a signed wrapper around a producer-specific
+// `body`. Every claim is re-derived from `body` with the same JCS, SHA-256 and
+// Ed25519 as the envelope layer, never read off `verdict.status`, and an
+// unknown major is rejected. The bundle verifies offline against its embedded
+// `public_key`; the optional gateway re-fetch only confirms checkpoints are
+// witnessed on-chain.
+
+import { readAgentRecords, type AgentHeldRecord, type AgentRecordReading } from "./agent-record.js";
+import { isObject } from "./json-schema.js";
 import {
   deriveOperatorAddress,
   ed25519Verify,
   hexToBytes,
-  // The one hex-field test, which lives in `crypto.ts` beside the one hex
-  // reader (proof#146). It was a second copy here until then, with the same
-  // body: two copies of one rule is how two kernels drift apart one edit at a
-  // time, which is the whole defect class this fix is about.
   isHexField,
   sha256Hex,
   utf8,
@@ -33,13 +22,13 @@ import { safeInteger, signedLeafCount } from "./grading.js";
 import { isConformantHandoffRecord, isHandoffNamespace, type HeldRecord } from "./handoff.js";
 import { leafHash, verifyInclusion } from "./merkle.js";
 import {
-  DuplicateKeyError,
   MAX_CANONICAL_DEPTH,
   contentHashes,
   exceedsDepth,
   isRfc3339UtcInstant,
   jcs,
   jcsParse,
+  specVersionSupported,
   verifyEnvelope,
 } from "./verifier.js";
 import {
@@ -47,42 +36,28 @@ import {
   sideContentEntry,
   type SideEntry,
 } from "./side-content.js";
-import type { Envelope } from "./types.js";
+import type { Envelope, EnvelopeFault } from "./types.js";
+import { ENVELOPE_FAULTS } from "./types.js";
 
-// Only the evidence-bundle major(s) this kernel verifies. A new major is a
-// deliberate one-entry addition HERE — same fail-closed discipline as the
-// envelope verifier's ACCEPTED_SPEC_MAJORS.
-/** The accepted `sanning.evidence/v1` wrapper majors; exported in both kernels (P-01, 0.13.0). */
+// Fail-closed, like ACCEPTED_SPEC_MAJORS: a new major is a one-entry addition here.
+/** The accepted evidence-bundle wrapper majors. */
 export const ACCEPTED_EVIDENCE_MAJORS: readonly string[] = Object.freeze(["sanning.evidence/v1"]);
 
-// The body_type this module knows how to verify structurally. An unknown
-// body_type is not a hard failure of the WRAPPER (the signature + body_hash
-// still verify), but its body cannot be re-derived, so the per-body verdict is
-// "undetermined" rather than "verified".
-//
-// The producer-to-agent cut (W-3, DL-73) renamed `record_bytes` to
-// `event_bytes` and moved every body that carries it to a new major. This
-// kernel reads ONLY those majors: `sanning.anchor.trace/v1` and `/v2`,
-// `sanning.stamp.evidence/v1` and `sanning.evidence.export/v1` are unknown body
-// types here and answer `partial`. DL-73 releases evidence made before the cut
-// from any obligation to keep verifying, so there is no second field name to
-// read and no dual-accept path.
+// The anchor-trace body this module verifies structurally. An unknown
+// body_type does not fail the wrapper, but its body cannot be re-derived, so
+// it reads `incomplete`. Bodies before the `event_bytes` majors are unknown here.
 export const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v3";
 
 /**
- * The name `event_bytes` replaced. Under the new majors a body entry that still
- * carries it is a hard reject, never an ignored unknown field: ignored, it
- * would read as a withheld record and the event would verify with nothing
- * checked, the fail-open the new majors exist to prevent (governance.md §8,
- * W-3).
+ * The field name `event_bytes` replaced. A body entry still carrying it is a
+ * hard reject: ignored, it would read as a withheld record and verify with
+ * nothing checked.
  */
 export const LEGACY_EVENT_BYTES_FIELD = "record_bytes";
 
 /**
- * Name an envelope the accept-set refused. Without this a bundle whose
- * envelopes carry a retired profile major (a half-migrated producer still
- * writing `sanning.events/v1`) fails with no reason at all. Spelled with
- * `JSON.stringify` so both kernels write the same sentence.
+ * Name an envelope the accept-set refused, so a retired profile major fails
+ * with a reason. The same sentence in both kernels.
  */
 function specVersionFinding(
   what: "checkpoint" | "event",
@@ -97,10 +72,7 @@ function specVersionFinding(
   return `${what} envelope spec_version ${JSON.stringify(sv)} is not accepted by this kernel`;
 }
 
-/**
- * The reject for an entry that still carries `record_bytes`. One sentence,
- * spelled the same in both kernels, so a negative vector can assert it.
- */
+/** The reject for an entry that still carries `record_bytes`. The same sentence in both kernels. */
 function legacyEventBytesError(
   entry: object,
   what: "checkpoint" | "event",
@@ -113,43 +85,25 @@ function legacyEventBytesError(
   );
 }
 
-// The issuer-composed attested-evidence-export body (specs/evidence-export.md
-// §2). The wrapper is unchanged (`sanning.evidence/v1`, Ed25519-signed); this body
-// carries a cached verdict + the inline source bundle + embedded RSA-PSS
-// operator attestations. verifyEvidenceBundle dispatches on it to
-// verifyExportBody (§5).
+// The attested-evidence-export body (specs/evidence-export.md §2): a cached
+// verdict, the inline source bundle and RSA-PSS operator attestations.
 export const EXPORT_BODY_TYPE = "sanning.evidence.export/v2";
 
 /**
- * The Sanning-signed interval stamp body (evidence-bundle.md §5.2, DL-58).
- *
- * Its own `body_type` rather than a widened anchor-trace body, and the reason
- * is the whole decision: an anchor-trace checkpoint carries a PRODUCER-signed
- * `sanning.events/v2` envelope, and a stamp has no producer signature at all:
- * Sanning places it, under DL-52, for a customer who holds no chain identity.
- * The two rejected options were making `envelope` optional and synthesising an
- * envelope that Sanning signs; the second would have made a Sanning
- * attestation indistinguishable ON THE WIRE from a producer's, which is
- * unrecoverable once witnessed.
+ * The Sanning-signed interval stamp body (evidence-bundle.md §5.2). Its own
+ * body type, because a stamp has no producer signature: a Sanning attestation
+ * must never be indistinguishable on the wire from a producer's.
  */
 export const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
 export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v2";
 
 /**
- * The version string INSIDE a witnessed stamp body — a different string from
- * the `body_type` above, and the two are easy to confuse.
- *
- * `sanning.stamp.trace/v1` discriminates the BUNDLE BODY: it is the reader's
- * dispatch key. `sanning.stamp/v1` is the control plane's own version of the
- * bytes it hands a witness (`control-plane/src/stamp-tree.ts`,
- * `STAMP_BODY_VERSION`). A `sanning.stamp.trace/v1` body pins the inner
- * version to exactly this value: two answers to one question inside one
- * signature is the §5.1.2 mixed-vocabulary reject, one layer down.
+ * The version string inside a witnessed stamp body, distinct from the
+ * `body_type` above (the dispatch key). A stamp trace body pins it to exactly
+ * this value (§5.1.2).
  */
 export const STAMP_BODY_VERSION = "sanning.stamp/v1";
 
-// ---- Wire types (evidence-bundle.md §2 + §5.1) ------------------------------
-
 export interface EvidenceIssuer {
   kind: string;
   tenant_id?: string;
@@ -157,24 +111,9 @@ export interface EvidenceIssuer {
   [k: string]: unknown;
 }
 
-export interface EvidenceVerdict {
-  status: string;
-  summary?: string;
-  counts?: Record<string, number>;
-  as_of?: string;
-  [k: string]: unknown;
-}
-
 /**
- * Where a commitment was witnessed (evidence-bundle.md §5.1.1).
- *
- * The same three-part shape the control plane indexes (`kind` / one promoted
- * `id` / a typed remainder), so the signed body, the index row and the SDK
- * artifact stop being three vocabularies for one fact.
- *
- * NOT ONE FIELD HERE NAMES A CHAIN. Arweave's chunk proof, data_path, offsets
- * and packing live in `ref`, opaque to every reader above this seam. A field
- * that would need renaming for a second witness belongs in `ref` by definition.
+ * Where a commitment was witnessed (evidence-bundle.md §5.1.1). No field here
+ * names a chain: chain-specific detail lives in the opaque `ref`.
  */
 export interface AnchorRef {
   kind: string;
@@ -182,18 +121,16 @@ export interface AnchorRef {
   ref?: Record<string, unknown>;
 }
 
-// `sanning.anchor.trace/v3` body (§5.1). Uint8Array fields ride as lowercase hex.
+// `sanning.anchor.trace/v3` body (§5.1). Byte fields ride as lowercase hex.
 export interface TraceCheckpoint {
   /**
-   * The checkpoint's identity and the join key, DERIVED: hex SHA-256 of the
-   * decoded `event_bytes`. Recomputed by the verifier, never taken from the
-   * label.
+   * Hex SHA-256 of the decoded `event_bytes`: the checkpoint's identity and join
+   * key. Recomputed by the verifier, never trusted.
    */
   checkpoint_ref: string;
   /**
-   * Where it was witnessed, IF IT HAS BEEN. Optional, and absent is honest:
-   * under DL-52 a checkpoint is routinely placed before it is witnessed, and a
-   * required field that must be filled dishonestly is a defect in the format.
+   * Where it was witnessed, if it has been. Absent is honest: checkpoints are
+   * placed before they are witnessed.
    */
   anchor_ref?: AnchorRef;
   envelope: Envelope;
@@ -213,9 +150,8 @@ export interface TraceInclusion {
 export interface TraceEvent {
   envelope: Envelope;
   event_bytes?: string; // hex of JCS(event record); omitted == record withheld
-  // Opt-in disclosed raw bytes (lowercase hex) whose SHA-256 MUST equal the
-  // committed event.content_hash inside event_bytes (evidence-bundle §5.1).
-  // Default-absent (minimal disclosure); absent ⇒ undetermined, not failed.
+  // Opt-in disclosed raw bytes (lowercase hex) whose SHA-256 must equal the
+  // committed `event.content_hash` (§5.1). Absent is undetermined, not failed.
   content?: string;
   inclusion: TraceInclusion;
 }
@@ -225,16 +161,10 @@ export interface AnchorTraceBody {
   events: TraceEvent[];
 }
 
-// ---- `sanning.stamp.trace/v1` wire types (evidence-bundle.md §5.2) ---------
-
 /**
- * One sub-tree of a stamp, as the WITNESSED bytes carry it.
- *
- * Keyed in the body by a blinded reference (an HMAC under a per-org secret we
- * never publish), so a reader learns that the org runs N agents and their
- * relative volumes and learns no name. The RANGE is deliberately in the clear:
- * it is what makes a later per-agent slice claim checkable by a third party
- * without Sanning, and hiding it would put us back in the trust path.
+ * One sub-tree of a stamp, as the witnessed bytes carry it. Keyed by a blinded
+ * reference, so a reader learns no agent name. The range is in the clear so a
+ * per-agent slice claim is checkable without Sanning.
  */
 export interface StampSubtree {
   first_leaf: number;
@@ -244,15 +174,12 @@ export interface StampSubtree {
 }
 
 /**
- * The stamp body as the control plane witnesses it
- * (`control-plane/src/stamp-tree.ts`, `StampBody`).
- *
- * Never read from the bundle directly — it is parsed out of `stamp_bytes`,
- * which is the only authority. Present as a type so the parse has a shape.
+ * The stamp body as the control plane witnesses it. Only ever parsed out of
+ * `stamp_bytes`, the sole authority.
  */
 export interface StampBody {
   stamp_version: string;
-  /** The org, BLINDED. Not an org id, and not reversible without the secret. */
+  /** The org, blinded. Not reversible without the secret. */
   org_ref: string;
   interval_start: string;
   interval_end: string;
@@ -263,18 +190,13 @@ export interface StampBody {
 
 /** One entry of a `sanning.stamp.trace/v1` body's `stamps[]` (§5.2). */
 export interface StampEntry {
-  /**
-   * The stamp's identity within this bundle, DERIVED: hex SHA-256 of the
-   * DECODED `stamp_bytes`, not of the hex text. A verifier MUST recompute it.
-   */
+  /** Hex SHA-256 of the decoded `stamp_bytes`, not the hex text. Recomputed by the verifier. */
   stamp_ref: string;
   /** Lowercase hex of the exact JCS bytes that were handed to the witness. */
   stamp_bytes: string;
   /**
-   * Where the stamp was witnessed, IF IT HAS BEEN (§5.1.1). Absent is honest:
-   * a sealed-but-unconfirmed stamp is witnessed by nobody, and an emitter that
-   * filled this in from a submission receipt would be claiming a chain
-   * position that does not exist yet.
+   * Where the stamp was witnessed, if it has been (§5.1.1). Absent is honest: a
+   * submission receipt is not a chain position.
    */
   anchor_ref?: AnchorRef;
 }
@@ -283,13 +205,9 @@ export interface StampTraceBody {
   stamps: StampEntry[];
 }
 
-// ---- `sanning.stamp.evidence/v2` wire types (evidence-bundle.md §5.3) -----
-//
-// Both halves of a DL-52 record, bound: the producer signs the envelope, and
-// Sanning signs and witnesses the stamp whose root commits to it. Neither
-// earlier body joins them, and a field added to §5.2 could not — a conformant
-// reader MUST ignore fields it does not know (envelope-spec.md §2), so the
-// join has to live in a body_type readers DISPATCH on. See §5.3.1.
+// `sanning.stamp.evidence/v2` (evidence-bundle.md §5.3): binds the producer's
+// envelope to the Sanning stamp whose root commits to it. Its own body type,
+// because readers ignore unknown fields and the join must be dispatched on.
 
 /** §5.3's inclusion: §5.1's shape with `stamp_ref` as the join key. */
 export interface StampEvidenceInclusion {
@@ -297,7 +215,7 @@ export interface StampEvidenceInclusion {
   leaf_index: number;
   leaf_count: number;
   audit_path: string[]; // hex[]
-  /** Resolves against `stamps[].stamp_ref` in the SAME body. */
+  /** Resolves against `stamps[].stamp_ref` in the same body. */
   stamp_ref: string;
 }
 
@@ -309,7 +227,7 @@ export interface StampEvidenceEvent {
 }
 
 export interface StampEvidenceBody {
-  /** Byte-identical to §5.2.2 — one definition, one place to change. */
+  /** Byte-identical to §5.2.2. */
   stamps: StampEntry[];
   events: StampEvidenceEvent[];
 }
@@ -320,7 +238,6 @@ export interface EvidenceBundle {
   issuer: EvidenceIssuer;
   generated_at: string;
   gateway?: string | null;
-  verdict: EvidenceVerdict;
   body?: unknown;
   body_ref?: string;
   body_hash: string;
@@ -331,20 +248,15 @@ export interface EvidenceBundle {
   [k: string]: unknown;
 }
 
-// ---- Verification result ----------------------------------------------------
-
 export type EvidenceStatus =
   | "verified" // every in-scope item passed (sig + integrity + inclusion)
-  | "partial" // integrity confirmed but full proof incomplete (e.g. records withheld)
   | "failed" // a check failed: bad wrapper sig / tamper / broken inclusion
-  | "malformed"; // structurally unparseable / unknown major / body_hash mismatch
-
-// Per-gateway on-chain outcome for one checkpoint tx (evidence-export.md §4.2).
-// The on-chain re-fetch resolves each checkpoint's anchor_ref.id against EACH configured
-// gateway and records that gateway's individual outcome:
-//   confirm     — the gateway returned the tx and its bytes match the record.
-//   mismatch    — the gateway returned the tx but its bytes disagree — a finding.
-//   unreachable — no response / timeout / no such tx — an availability gap.
+  | "incomplete"; // nothing failed and something could not be checked or read
+
+// Per-gateway on-chain outcome for one checkpoint (evidence-export.md §4.2):
+//   confirm      the gateway returned the tx and its bytes match.
+//   mismatch     the bytes disagree: a finding.
+//   unreachable  no response, timeout or no such tx: an availability gap.
 export type OnChainOutcome = "confirm" | "mismatch" | "unreachable";
 
 export interface PerGatewayOutcome {
@@ -353,12 +265,10 @@ export interface PerGatewayOutcome {
 }
 
 export interface OnChainResult {
-  // Rollup (worst-finding-wins, then best-evidence): mismatch if ANY gateway is
-  // mismatch; else confirm if ANY is confirm; else unreachable.
+  // Worst finding wins: mismatch if any gateway mismatched, else confirm if
+  // any confirmed, else unreachable.
   rollup: OnChainOutcome;
-  // Derived collapsed field (retained for backward-compat with the pre-§4.2
-  // single `onChainOk`): false on rollup mismatch, true on confirm, null on
-  // all-unreachable.
+  // Collapsed view: false on mismatch, true on confirm, null on all-unreachable.
   onChainOk: boolean | null;
   perGateway: PerGatewayOutcome[];
 }
@@ -366,55 +276,81 @@ export interface OnChainResult {
 export interface CheckpointResult {
   /** The derived `checkpoint_ref`, empty when it could not be derived. */
   checkpointRef: string;
-  /**
-   * Where this checkpoint was witnessed. `null` when the checkpoint carries no
-   * `anchor_ref`: placed but not yet witnessed, which is a normal state and NOT
-   * a deficiency.
-   */
+  /** Where it was witnessed; `null` when placed but not yet witnessed, which is normal. */
   anchorRef: AnchorRef | null;
-  // The checkpoint envelope verified (signature + payload binding to its record).
+  // The checkpoint envelope verified (signature and payload binding).
   envelopeOk: boolean;
   // The committed record's merkle_root equals the checkpoint's claimed merkle_root.
   merkleRootOk: boolean;
-  // If gateways were supplied: the on-chain bytes at tx_id matched the envelope.
-  // null when no gateway re-fetch was requested, or when `anchor_ref.kind` has
-  // no witness adapter, or its id is not one the adapter accepts; the witness
-  // was not checked. Derived collapse of `onChain` (§4.2), retained so existing
-  // consumers keep the single-boolean field.
+  // Collapsed `onChain`. null when the witness was not checked: no gateways, no
+  // witness adapter for `anchor_ref.kind`, or an id the adapter rejects.
   onChainOk: boolean | null;
-  // Per-gateway on-chain outcomes (§4.2), ADDITIVE to `onChainOk`. null when no
-  // gateway re-fetch was requested (offline-only verification), or when
-  // `anchor_ref.kind` has no witness adapter, or its id is not one the adapter
-  // accepts; the witness was not checked.
+  // Per-gateway outcomes (§4.2); null when the witness was not checked.
   onChain: OnChainResult | null;
   ok: boolean;
   errors: string[];
+  // True where the only thing wrong is a malformed `anchor_ref`: the bytes the pack
+  // signed hold and break their own format (`follows_rules` disproven).
+  anchorRefMalformed?: boolean;
 }
 
 export interface EventResult {
   eventId: string;
-  // The event envelope verified (signature ok; payload binding ok OR undetermined).
+  // Signature ok, and payload binding ok or undetermined.
   envelopeOk: boolean;
-  // payload binding: true matched the committed record, false mismatch,
-  // null record withheld (semantics-undetermined — NOT a failure, §3.1/§6.2).
+  // true matched, false mismatch, null record withheld: undetermined, not a
+  // failure (envelope-spec §3.1, §6 item 2).
   payloadBindingOk: boolean | null;
   // RFC 9162 inclusion of this event's leaf in its checkpoint's root.
   inclusionOk: boolean;
   // The inclusion's checkpoint_ref resolved to a checkpoint in the bundle.
   checkpointBound: boolean;
-  // Raw-log (content) binding: SHA-256 of the disclosed bytes equals the
-  // committed event.content_hash (in event_bytes), or, for a promoted
-  // envelope, a hash it commits to. true matched, false mismatch (→ event
-  // fails), null undetermined (nothing disclosed OR nothing committed OR record
-  // withheld — NOT a failure, mirroring payloadBindingOk).
+  // SHA-256 of the disclosed bytes equals the committed `content_hash` (or, for
+  // a promoted envelope, a hash it commits to). false fails the event; null is
+  // undetermined (nothing disclosed or committed, or record withheld).
   contentOk: boolean | null;
   ok: boolean;
   errors: string[];
+  /**
+   * The `sanning.agent` reading of this record (agent-events.md section 10), read with
+   * every other record of the pile it was verified in: the bundle, or every pack
+   * of a case. `null` where the record is not an agent record, or its envelope
+   * did not verify, or its record bytes did not travel or did not bind. It never
+   * moves `ok` or the bundle status; the pack grade reads it (section 5.4.5).
+   */
+  agent: AgentRecordReading | null;
+  /**
+   * True where the record's `stamp_ref` or `checkpoint_ref` names a stamp or checkpoint the
+   * pack does not hold: `witnessed` is not proven (`missing`), never disproven, whatever else
+   * about the record fails.
+   */
+  stampAbsent?: boolean;
+  /**
+   * True where the record carries a retired field name, or bytes that are present and cannot
+   * be read: a defect in the artifact that fails the record under a key that can be read.
+   */
+  ownFormFailed?: boolean;
+  /**
+   * True where the record's signed bytes bind to its `payload_hash` under a signature that
+   * holds and are not JSON: the producer broke the format it signed, so `follows_rules` is
+   * disproven and nothing was proven altered.
+   */
+  recordNotJson?: boolean;
+  /**
+   * True where the bytes this record's content was checked against came from the side
+   * input, which nobody signed: a mismatch then leaves `unchanged` not proven
+   * (`not_checked`), never disproven.
+   */
+  contentUnsigned?: boolean;
+  /** Why the record's envelope does not verify: the worst of `envelopeFaults`, or `null`. */
+  envelopeFault?: EnvelopeFault | null;
+  /** Every envelope fault found (`ENVELOPE_FAULTS`), worst first. */
+  envelopeFaults?: EnvelopeFault[];
 }
 
 /** One sub-tree's recomputed result (§5.2). */
 export interface StampSubtreeResult {
-  /** The blinded key the body spells it under. Meaningless without the org's secret. */
+  /** The blinded key the body uses. */
   ref: string;
   firstLeaf: number;
   leafCount: number;
@@ -423,17 +359,13 @@ export interface StampSubtreeResult {
 
 /** One `stamps[]` entry's result (§5.2). */
 export interface StampResult {
-  /** The stamp's derived identity, as the bundle spells it. "" when unusable. */
+  /** The stamp's derived identity. "" when unusable. */
   stampRef: string;
   /** The asserted `stamp_ref` equals SHA-256 of the decoded `stamp_bytes`. */
   stampRefOk: boolean;
   /**
-   * The witnessed bytes decoded, parsed, and re-canonicalized to themselves.
-   *
-   * The last clause is not pedantry. The plane stores these bytes as TEXT and
-   * replays them verbatim precisely because a round-trip through a normalizing
-   * serializer is not guaranteed to reproduce what was signed; a body that is
-   * not JCS-canonical is one that every re-deriving reader hashes differently.
+   * The witnessed bytes decode, parse and re-canonicalize to themselves. A body
+   * that is not JCS-canonical hashes differently for every re-deriving reader.
    */
   bodyOk: boolean;
   stampVersion: string | null;
@@ -442,55 +374,34 @@ export interface StampResult {
   merkleRoot: string | null;
   leafCount: number | null;
   /**
-   * Every sub-tree range accounts for exactly one leaf of the stamp: the
-   * ranges sorted by `first_leaf` tile `[0, leaf_count)` with no gap and no
-   * overlap, and their counts sum to `leaf_count`.
+   * The sub-tree ranges, sorted by `first_leaf`, tile `[0, leaf_count)` with no
+   * gap or overlap.
    */
   subtreesOk: boolean;
   subtrees: StampSubtreeResult[];
   /**
-   * Where it was witnessed, or `null` for a stamp nothing has witnessed yet.
-   *
-   * `null` is NOT a failure and never an accusation — it is the honest state
-   * of every stamp for the first minutes of its life and the permanent state
-   * of every stamp when no witness is configured. It does hold the bundle at
-   * `partial`: a stamp is Sanning's own assertion until something independent
-   * carries it.
+   * Where it was witnessed, or `null` if nothing has witnessed it yet. Never an
+   * accusation, but it holds the bundle at `partial`: until witnessed, a stamp
+   * is Sanning's own assertion.
    */
   anchorRef: AnchorRef | null;
   /**
-   * Per-gateway on-chain outcomes for this stamp's `anchor_ref` (§4.2's shape,
-   * `checkpoints[]`'s vocabulary), or `null` when NOTHING WAS CHECKED.
-   *
-   * ── The four states, and why none of them collapses ──
-   *
-   * `null` means not checked — no gateways were supplied, or this stamp names
-   * no witness to check, or its `anchor_ref.kind` has no witness adapter, or
-   * its id is not one the adapter accepts; the witness was not checked. It is
-   * a statement about the RUN, never about the stamp. The other three are
-   * statements about the stamp and live in `onChain.rollup`: `confirm` (a
-   * gateway returned the witnessed bytes), `mismatch` (a gateway returned
-   * DIFFERENT bytes: a finding, and the only one of the four that fails
-   * anything), `unreachable` (we asked and nobody answered: an availability
-   * gap, never an accusation).
-   *
-   * Keeping "not checked" distinct from "unreachable" is the whole point. A
-   * surface handed a collapsed boolean cannot tell "no gateway could be
-   * reached" from "no gateway was tried", and reported the first when the
-   * second was true — a false accusation manufactured by a missing state.
+   * Per-gateway outcomes for this stamp's `anchor_ref`, or `null` when nothing
+   * was checked (a statement about the run, not the stamp). Of `confirm`,
+   * `mismatch` and `unreachable`, only `mismatch` fails anything. "Not checked"
+   * and "unreachable" stay distinct so a surface never reports an availability
+   * gap that was never tested.
    */
   onChain: OnChainResult | null;
   /**
-   * Derived collapse of `onChain`, mirroring `CheckpointResult.onChainOk` so a
-   * consumer reads one field the same way on both: `false` on mismatch, `true`
-   * on confirm, `null` on unreachable AND on not-checked.
-   *
-   * It is deliberately the LOSSY view — `null` is three-quarters of the state
-   * space here. Anything that needs to tell those apart reads `onChain`.
+   * Lossy collapse of `onChain`, as on `CheckpointResult`: `false` mismatch,
+   * `true` confirm, `null` unreachable or not checked.
    */
   onChainOk: boolean | null;
   ok: boolean;
   errors: string[];
+  /** True where the only thing wrong is a malformed `anchor_ref` (as on a checkpoint). */
+  anchorRefMalformed?: boolean;
 }
 
 export interface EvidenceBundleResult {
@@ -500,37 +411,43 @@ export interface EvidenceBundleResult {
   bodyHashOk: boolean;
   signatureOk: boolean;
   bodyType: string | null;
-  // null when no gateways were supplied (offline-only verification).
   onChainChecked: boolean;
   checkpoints: CheckpointResult[];
   events: EventResult[];
-  // The producer's asserted verdict.status (for display only — never trusted).
-  assertedStatus: string | null;
-  // Present ONLY for a `sanning.evidence.export/v2` body (evidence-export.md §5):
-  // the export-specific dimensions (source linkage, verdict agreement, embedded
-  // attestations, recomputed §4 verdict). The top-level `checkpoints`/`events`
-  // above are the recomputed SOURCE-bundle results in that case. Absent for a
-  // plain anchor-trace bundle — additive, backward-compatible.
+  // Only for a `sanning.evidence.export/v2` body (evidence-export.md §5). The
+  // top-level `checkpoints`/`events` are then the recomputed source bundle's.
   export?: ExportResult;
-  // Present ONLY for a `sanning.stamp.trace/v1` body (evidence-bundle.md §5.2):
-  // the per-stamp recomputed results. `checkpoints`/`events` stay empty for
-  // such a bundle — a stamp body carries neither, and reporting an empty list
-  // as "nothing was wrong" is the exact confusion `partial` exists to prevent.
-  // Absent for every other body — additive, backward-compatible.
+  // Only for a `sanning.stamp.trace/v1` body (§5.2). `checkpoints` and `events`
+  // stay empty: a stamp body carries neither.
   stamps?: StampResult[];
   errors: string[];
-  // Informational only: never read, never gated on, never moves `status` or
-  // the CLI exit code. Carries `CO_SIGNATURES_NOTE` where the wrapper's
-  // reserved `co_signatures` field is present with at least one entry
-  // (evidence-bundle.md §2, §7.1 decision proof#148). Absent for every
-  // bundle without it, additive and backward-compatible.
+  // True where the bundle could not be read as one (the claim it blocks is not proven,
+  // `unreadable`): not a JSON object, an unknown major or `signature_alg`, a required
+  // wrapper field missing, or an export body that cannot be read. `status` is then
+  // `incomplete`.
+  unreadable?: boolean;
+  // True where the wrapper's `body_hash` and signature hold and its `generated_at` has
+  // another form: the producer broke the format it signed (`follows_rules` disproven).
+  // `status` is then `failed`, and the body is still read, so a disproof inside it stands.
+  // Under a key that cannot be read the form is not judged.
+  generatedAtMalformed?: boolean;
+  // True where the wrapper's `public_key` cannot be read as a key: `signed` is not proven
+  // (`unreadable`). `status` is `failed` where `body_hash` does not hold, and otherwise the
+  // body's own reading, never above `incomplete`.
+  keyUnreadable?: boolean;
+  // True where the wrapper's `spec_version` names a major this verifier does not know:
+  // the body is not read, and `follows_rules` is not proven (`not_checked`). The wrapper
+  // signature is still checked: where it fails, `status` is `failed` and `signatureOk` is
+  // false; where it holds, `signatureOk` is true, the only claim about the wrapper this
+  // verifier can make, and `bodyHashOk` stays false, unchecked.
+  versionUnknown?: boolean;
+  // Informational only: never moves `status` or the exit code. Carries
+  // `CO_SIGNATURES_NOTE` when the wrapper's `co_signatures` holds an entry.
   notes?: string[];
 }
 
-// ---- Attested-evidence-export wire + result types (evidence-export.md) -------
-
-// One embedded operator attestation record (§2.2 / §3). RSA-PSS-SHA-256 over
-// JCS(payload); the operator key is the operator's Arweave RSA wallet.
+// One embedded operator attestation (§2.2, §3): RSA-PSS-SHA-256 over
+// JCS(payload), keyed by the operator's Arweave RSA wallet.
 export interface AttestationRecord {
   /** The source checkpoint's derived `checkpoint_ref` this attestation binds to. */
   checkpoint_ref: string;
@@ -562,10 +479,8 @@ export interface ExportBody {
   [k: string]: unknown;
 }
 
-// ---- The §4 kernel verdict object (snake_case, spec-canonical computed wire) --
-// Recomputed by the kernel; the copy cached in body.kernel_verdict is a
-// rendering convenience the verifier recomputes and (over its deterministic
-// dimensions, §5 step 5) confirms.
+// The §4 verdict object, recomputed by the kernel. The copy cached in
+// `body.kernel_verdict` is a convenience the verifier checks (§5 step 5).
 
 export interface VerdictEvent {
   event_id: string;
@@ -621,87 +536,70 @@ export interface AttestationResult {
   checkpointRef: string;
   operator: string;
   gateway: string | null;
-  // The RSA-PSS-SHA-256 signature over JCS(payload) verified (§5 step 6a).
+  // RSA-PSS-SHA-256 over JCS(payload) verified (§5 step 6a).
   signatureOk: boolean;
-  // base64url(SHA-256(public_key.n)) == payload.operator (§3.3 / step 6b).
+  // base64url(SHA-256(public_key.n)) == payload.operator (§5 step 6b).
   operatorAddressBound: boolean;
-  // payload.data_hash == the resolved source checkpoint's committed content hash
-  // (SHA-256(JCS(checkpoint.envelope))) (§5 step 6c).
+  // payload.data_hash == SHA-256(JCS(source checkpoint envelope)) (§5 step 6c).
   dataHashBound: boolean;
   // checkpoint_ref resolved to a present source checkpoint.
   checkpointResolved: boolean;
   level: number | null;
-  // subject_ref (§3.2) tri-state: null absent/undetermined, true/false only
-  // against a supplied side-input subject. Never gates the attestation.
+  // subject_ref (§3.2): null absent or undetermined; true/false only against a
+  // supplied subject. Never gates the attestation.
   subjectRefOk: boolean | null;
   ok: boolean;
   errors: string[];
+  // Set where the signature verifies and a payload field breaks section 3.1: the issuer
+  // signed a record that does not follow its format (`follows_rules` disproven).
+  fieldError?: string | null;
 }
 
 export interface ExportResult {
   // SHA-256(JCS(source_bundle)) == source_bundle_hash (§5 step 3).
   sourceLinkageOk: boolean;
-  // Recomputed source-bundle verdict status (verifyEvidenceBundle over the
-  // inline source_bundle, §5 step 4).
+  // Recomputed source-bundle status (§5 step 4).
   sourceStatus: EvidenceStatus;
-  // Cached-vs-recomputed verdict agreement over the DETERMINISTIC, offline-
-  // recomputable dimensions only (§5 step 5 + the on-chain-is-informational
-  // erratum — see verifyExportBody). The on-chain per-gateway dimension is
-  // environment/time-dependent and is EXCLUDED from this comparison.
+  // Cached-vs-recomputed agreement over the deterministic, offline dimensions
+  // only (§5 step 5). The on-chain dimension depends on time and environment.
   verdictAgreementOk: boolean;
   attestations: AttestationResult[];
-  // The freshly recomputed §4 verdict object (snake_case) — what renderers and
-  // the verify API display (never the cached copy).
+  // The freshly recomputed §4 verdict: what surfaces display, never the cache.
   verdict: VerdictObject;
-  // The export's own rollup status; drives the CLI exit code.
+  // The export's own rollup; drives the CLI exit code.
   status: EvidenceStatus;
+  // True where the inline source bundle cannot be read while `source_bundle_hash` holds
+  // and the export wrapper verifies: the issuer signed a source that does not follow its
+  // format (`follows_rules` disproven), and nothing was proven altered.
+  sourceUnreadable?: boolean;
 }
 
 export interface VerifyEvidenceOptions {
-  // Gateways to re-fetch each anchor_ref.id from (first responsive wins).
-  // When supplied, the on-chain bytes MUST byte-match the bundle's checkpoint
-  // envelope, proving the proof is anchored, not just locally asserted.
+  // Gateways to re-fetch each `anchor_ref.id` from (first responsive wins). The
+  // on-chain bytes must byte-match the checkpoint envelope.
   gateways?: string[];
-  // Out-of-band disclosed raw bytes, keyed by event_id, to bind against each
-  // event's committed content_hash (the rawLog → content_hash link). A
-  // Uint8Array is used as-is; a string is parsed as lowercase hex. In-body
-  // `events[].content` (signed) takes precedence over this side input; if both
-  // are present for an event and disagree, the event fails (§5.1).
-  //
-  // A `Map` is the SAFE shape and the one to prefer — it is what
-  // `disclosedContent` hands back, so our output feeds straight back in, and a
-  // Map keys on the string itself: no prototype to inherit from and no
-  // `__proto__` write that silently lands somewhere else. The plain `Record` is
-  // still accepted (it was the original signature and remains supported), and
-  // the lookup guards it — see `lookupSideContent`. Widening is additive: every
-  // existing caller passing a Record keeps working unchanged.
+  // Out-of-band disclosed bytes by event_id, bound against each event's
+  // committed `content_hash`. A Uint8Array is used as-is; a string is hex.
+  // In-body `events[].content` (signed) wins; if both are present and disagree,
+  // the event fails (§5.1). Prefer a `Map`: a plain object is guarded (see
+  // `./side-content.ts`), but a Map has no prototype to inherit from.
   content?: Record<string, Uint8Array | string> | ReadonlyMap<string, Uint8Array | string>;
-  // Injectable fetch (Node >=18 global `fetch` by default) — test seam.
+  // Injectable fetch (global `fetch` by default).
   fetchImpl?: typeof fetch;
 }
 
 /**
- * A surface MUST NOT present a wrapper's `co_signatures` as evidence
- * (evidence-bundle.md §2, decided by Phil 2026-09-24 on proof#148): nothing
- * in either kernel verifies the field, and it sits outside the wrapper's
- * signed scope (`bundleForSig` below), so anyone holding a pack's bytes can
- * append it with no key at all. This is the one sentence both kernels attach
- * as a note, never a verdict, never an exit code.
+ * A wrapper's `co_signatures` is not evidence (evidence-bundle.md §2): nothing
+ * verifies it, and it sits outside the signed scope, so anyone can append it.
+ * Attached as a note, never a verdict or exit code.
  */
 export const CO_SIGNATURES_NOTE =
   "unverified co-signatures are present in this pack's wrapper and are not part of the evidence";
 
 /**
- * True iff the wrapper's reserved `co_signatures` field carries at least one
- * entry.
- *
- * Absence and an empty array read the same way here: the field asserts
- * nothing about a second signer until it holds one, and evidence-bundle.md's
- * own carve-out language for the analogous envelope field treats "absent"
- * and "an empty array" as one thing (envelope-spec.md §7.1). A non-array
- * value (malformed shape, but the field is reserved, not yet specified)
- * still counts as present: it is not the well-formed absence either rule
- * describes.
+ * Whether the wrapper's reserved `co_signatures` carries at least one entry.
+ * Absent and empty read the same (envelope-spec.md §7.1); a non-array value
+ * counts as present.
  */
 export function coSignaturesPresent(b: unknown): boolean {
   if (b === null || typeof b !== "object" || Array.isArray(b)) return false;
@@ -727,24 +625,20 @@ function isEvidenceMajorAccepted(specVersion: unknown): boolean {
   });
 }
 
-/**
- * A bundle this kernel cannot read.
- *
- * `wrapperOk` is true only where the wrapper signature and `body_hash` were
- * CHECKED and held before the body was found unreadable. It is then reported
- * as held, because it did: `signatureOk` and `bodyHashOk` are statements about
- * the wrapper, and a body this kernel cannot parse does not unsign it. The
- * case reader decides whose pack a bundle is on exactly those two fields
- * (`evidence-bundle.md` 5.5.1), so reporting `false` here let a holder who
- * broke its own body shape read as a forger.
- */
-/** evidence-bundle §2 (A31). Byte-identical to the Python kernel's. */
+/** evidence-bundle.md §2. Byte-identical to the Python kernel's. */
 export const GENERATED_AT_MALFORMED =
-  "malformed generated_at: not an RFC 3339 UTC date-time with Z naming a real date and time (evidence-bundle §2)";
+  "malformed generated_at: not an RFC 3339 UTC date-time with Z naming a real date and time (evidence-bundle section 2)";
 
+/**
+ * A bundle this kernel cannot read. `wrapperOk` is true only where the wrapper
+ * signature and `body_hash` were checked and held: an unparseable body does not
+ * unsign the wrapper, and the case reader decides whose pack it is on those
+ * fields (§5.5.1).
+ */
 function malformed(error: string, specVersionOk = false, wrapperOk = false): EvidenceBundleResult {
   return {
-    status: "malformed",
+    status: "incomplete",
+    unreadable: true,
     specVersionOk,
     bodyHashOk: wrapperOk,
     signatureOk: wrapperOk,
@@ -752,82 +646,87 @@ function malformed(error: string, specVersionOk = false, wrapperOk = false): Evi
     onChainChecked: false,
     checkpoints: [],
     events: [],
-    assertedStatus: null,
     errors: [error],
   };
 }
 
-/**
- * The prefixes of the exception text this kernel writes ITSELF, in the words
- * the Python kernel writes too. Anything outside this set comes from the host:
- * a JSON parser, a codec, a crypto library. See `thrownDetail`.
- */
-// `duplicate key ` is `DuplicateKeyError` in `verifier.ts`, which
-// `DuplicateKey` in the Python twin's `canonicalize.py` words identically.
+// The prefixes of exception text this kernel writes itself, identically in
+// Python. Anything else comes from the host. See `thrownDetail`.
 const KERNEL_WORDING = ["hexToBytes: ", "duplicate key "];
 
 /**
- * The detail a finding may append about a caught exception.
- *
- * THE RULE: a finding carries the text of a caught exception only where this
- * kernel wrote that text. A finding travels into a case reading through `case`
- * `reasons`, and both kernels promise one reading and one rendered sentence for
- * one set of bytes; a host JSON parser says `Unexpected token 'h', "hello" is
- * not valid JSON` here and `Expecting value: line 1 column 1 (char 0)` there,
- * for one pack anyone can build (gate 4 on proof#140, finding 1).
- *
- * Returns `": <text>"` for this kernel's own wording and the empty string for
- * anything else. The label at the call site already names the check that
- * failed and both kernels agree on it character for character; what is dropped
- * is the host's parse offset, which no reader can act on and which was never
- * the same in the two kernels.
+ * The record as the agent reader holds it, or `null` where it takes no part:
+ * only a `sanning.events/v2` record whose envelope verified and whose bytes
+ * bound to it (section 10).
  */
+function agentItem(ev: { envelope?: unknown }, eventBytes: Uint8Array | undefined, bound: boolean): AgentHeldRecord | null {
+  if (!bound || eventBytes === undefined) return null;
+  const envelope = ev.envelope;
+  if (!isObject(envelope) || !specVersionSupported(envelope.spec_version as string, AGENT_RECORD_PROFILES)) {
+    return null;
+  }
+  let record: unknown;
+  try {
+    record = jcsParse(eventBytes);
+  } catch {
+    return null;
+  }
+  return {
+    event_id: envelope.event_id as string,
+    public_key: envelope.public_key as string,
+    record,
+  };
+}
+
+// The profile whose records the agent vocabulary governs (agent-events.md section 3).
+const AGENT_RECORD_PROFILES = ["sanning.events/v2"];
+
+/** Read the bundle's records as one pile and put each agent record's reading on its result. */
+async function attachAgentReadings(
+  results: EventResult[],
+  items: readonly (AgentHeldRecord | null)[],
+): Promise<void> {
+  const pile = items.filter((item): item is AgentHeldRecord => item !== null);
+  const readings = await readAgentRecords(pile);
+  let next = 0;
+  for (const [i, item] of items.entries()) {
+    if (item !== null) results[i]!.agent = readings[next++]!;
+  }
+}
+
 /**
- * The kernel's `duplicate key "<name>"` when a record repeats a member name,
- * else `undefined` (proof#144; `_record_duplicate_key` in the Python twin).
- *
- * ONLY A DUPLICATE, and not every unreadable record. Every reader below this
- * one that parses a record treats an unreadable one as absent, so the content
- * binding reads undetermined and the pack said "1 record discloses no bytes"
- * about a record whose bytes it had read. A record that repeats a name is
- * a defect in the artifact, and a defect this kernel can see fails, the rule
- * `event_bytes` that are not hex already follow.
+ * The finding for record bytes a producer signed that are not JSON, else
+ * `undefined` (`_record_not_json` in the Python twin): `event record is not
+ * JSON`, with the kernel's `duplicate key "<name>"` where the bytes repeat a
+ * member name. The bytes are signed, so the defect is the producer's and
+ * visible, and the record fails (evidence-bundle.md section 4), never reads as
+ * withheld.
  */
-function recordDuplicateKey(eventBytes: Uint8Array | undefined): string | undefined {
+function recordNotJson(eventBytes: Uint8Array | undefined): string | undefined {
   if (eventBytes === undefined) return undefined;
   try {
     jcsParse(eventBytes);
   } catch (e) {
-    if (e instanceof DuplicateKeyError) return e.message;
+    return `event record is not JSON${thrownDetail(e)}`;
   }
   return undefined;
 }
 
+/**
+ * The detail a finding may append about a caught exception: `": <text>"` for
+ * this kernel's own wording, `""` for anything else. Host parser messages
+ * differ by kernel, and both kernels must render one sentence for one set of
+ * bytes.
+ */
 function thrownDetail(e: unknown): string {
   const text = e instanceof Error ? e.message : String(e);
   return KERNEL_WORDING.some((w) => text.startsWith(w)) ? `: ${text}` : "";
 }
 
 /**
- * Decode `bytes` as UTF-8 the way every other kernel does: a byte sequence that
- * is not valid UTF-8 THROWS, and a leading byte-order mark is kept rather than
- * eaten.
- *
- * ONE CALLER LEFT, and it is not a parse. `jcsParse` (`verifier.ts`) reads
- * every set of signed bytes in this kernel now; this function survives only for
- * the canonicality comparison on the stamp path, which needs the DECODED TEXT
- * of bytes `jcsParse` has already accepted, to compare against `jcs(body)`. It
- * performs exactly the decode `jcsParse` performs, so the comparison cannot
- * read the bytes differently from the parse that produced `body`.
- *
- * `new TextDecoder()` alone is neither strict nor BOM-preserving: it replaces
- * every invalid sequence with U+FFFD and strips a BOM. A stamp body carrying
- * one raw `0x80` inside a string value read `verified` here and `failed` there
- * because of it (gate 4 on proof#140). The symmetric claim the first version of
- * this comment made, that "Python's `json.loads` raises on both", is FALSE and
- * is what hid gate 5's defect for a round: `json.loads(<bytes>)` strips a BOM
- * too. Python's strict reader is `jcs_loads`, and the rule both kernels hold to
- * is stated once, in `jcsParse`.
+ * Decode `bytes` as strict UTF-8, keeping a leading BOM: the decode `jcsParse`
+ * performs, for the stamp path's canonicality comparison on bytes `jcsParse`
+ * already accepted.
  */
 function decodeUtf8Strict(bytes: Uint8Array): string {
   return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
@@ -835,12 +734,59 @@ function decodeUtf8Strict(bytes: Uint8Array): string {
 
 /**
  * Name an envelope `public_key` or `signature` spelled outside the hex charset
- * or at the wrong length (proof#142). This kernel's envelope layer already
- * fails such an envelope, and the Python one's decoder accepts ASCII
- * whitespace (proof#135), so both bundle verifiers name it here, in the same
- * words, and the two kernels give one reading. Only a STRING is checked: a
- * missing or non-string field is the envelope layer's to fail, and it does.
+ * or at the wrong length, in the same words as Python, so both kernels give one
+ * reading. Only a string is checked; a missing one is the envelope layer's to
+ * fail.
+ */
+/**
+ * The envelope faults that leave a claim not proven rather than disproven: the record's
+ * envelope or key cannot be read, or its version is one this verifier does not know.
+ */
+export const UNPROVEN_ENVELOPE_FAULTS: readonly EnvelopeFault[] = [
+  "not_an_envelope",
+  "key_unreadable",
+  "spec_version_unknown",
+];
+
+/**
+ * A record that fails only on something not proven: a stamp or checkpoint the pack does not
+ * hold, an envelope or key that cannot be read, or a version this verifier does not know,
+ * while every check that runs without it holds (the binding, the inclusion proof and the
+ * content). It holds the bundle at `incomplete`, never `failed`.
  */
+function unproven(e: EventResult): boolean {
+  const envelopeUnproven =
+    e.envelopeFault !== undefined && e.envelopeFault !== null && UNPROVEN_ENVELOPE_FAULTS.includes(e.envelopeFault);
+  const stampAbsent = e.stampAbsent === true;
+  return (
+    (stampAbsent || envelopeUnproven) &&
+    (e.envelopeOk || envelopeUnproven) &&
+    (envelopeUnproven || e.ownFormFailed !== true) &&
+    e.payloadBindingOk !== false &&
+    e.contentOk !== false &&
+    (stampAbsent || (e.inclusionOk && e.checkpointBound))
+  );
+}
+
+/**
+ * Why a record's envelope does not verify, worst first: the envelope layer's own faults,
+ * and, where only this kernel's strict hex reading refuses a field, a key that cannot be read
+ * or a signature that does not hold. A field's form is not judged under either.
+ */
+function eventEnvelopeFaults(faults: readonly EnvelopeFault[], hexError: string | null): EnvelopeFault[] {
+  const found = new Set<EnvelopeFault>(faults);
+  if (hexError !== null) {
+    found.delete("nonconforming");
+    if (hexError.includes("public_key")) {
+      found.delete("signature_failed");
+      found.add("key_unreadable");
+    } else {
+      found.add("signature_failed");
+    }
+  }
+  return ENVELOPE_FAULTS.filter((f) => found.has(f));
+}
+
 function envelopeHexError(what: string, envelope: unknown): string | null {
   if (!isJsonObject(envelope)) return null;
   for (const [name, nibbles] of [
@@ -856,34 +802,24 @@ function envelopeHexError(what: string, envelope: unknown): string | null {
 }
 
 /**
- * Spell a value inside a finding the way the Python kernel spells it.
- *
- * `JSON.stringify(undefined)` is `undefined` (the value, not a string), so an
- * absent field interpolates as the word `undefined` where Python writes `null`.
- * One word, and a real difference in what an auditor reads: someone comparing
- * the two CLIs on one bundle sees two different sentences for one fact. Both
- * kernels route every quoted value through this spelling, and the cross-kernel
- * anchor-trace leg byte-compares them.
+ * Spell a value inside a finding as Python does: an absent value reads `null`,
+ * never `undefined`.
  */
 function jsonStr(value: unknown): string {
   return JSON.stringify(value === undefined ? null : value) ?? "null";
 }
 
-// Verify a `sanning.evidence/v1` bundle and dispatch on its `body_type`.
-//
-// Returns a structured per-checkpoint + per-event result and a recomputed
-// rollup `status`. The producer's asserted `verdict.status` is surfaced
-// (`assertedStatus`) but NEVER trusted — the displayed status is the one this
-// function recomputes (evidence-bundle §1 principle 3 / §4 step 4).
+/**
+ * Verify a `sanning.evidence/v1` bundle, dispatching on its `body_type`. The
+ * returned `status` is recomputed from the body; a wrapper `verdict` member,
+ * where a producer still writes one, is never read (evidence-bundle.md section 4).
+ */
 export async function verifyEvidenceBundle(
   bundle: unknown,
   options: VerifyEvidenceOptions = {},
 ): Promise<EvidenceBundleResult> {
-  // The ONE place a present `co_signatures` becomes a note, so every caller
-  // (including `case.ts`, which calls this function directly per pack) gets
-  // it, however the wrapper otherwise verifies. Never touches `status` or
-  // the exit code: a bundle that would otherwise verify still verifies, note
-  // or not (proof#148).
+  // The one place a present `co_signatures` becomes a note, so `case.ts` gets
+  // it too. Never touches `status`.
   const result = await verifyBundle(bundle, options, false);
   const note = coSignaturesNote(bundle);
   if (note !== undefined) {
@@ -893,20 +829,18 @@ export async function verifyEvidenceBundle(
 }
 
 // `exportSource`: read the bundle as an export's source (evidence-export.md
-// §2.4), where the only recognised body is `sanning.anchor.trace/v3`.
+// §2.4), where only `sanning.anchor.trace/v3` is recognised.
 async function verifyBundle(
   bundle: unknown,
   options: VerifyEvidenceOptions,
   exportSource: boolean,
 ): Promise<EvidenceBundleResult> {
-  // --- Step 1: parse + reject unknown spec_version major ---------------------
+  // Step 1: parse and reject an unknown spec_version major.
   if (bundle === null || typeof bundle !== "object" || Array.isArray(bundle)) {
     return malformed("evidence bundle is not a JSON object");
   }
-  // Reject a pathologically deep bundle BEFORE any canonicalization (which
-  // recurses). A fixed shared bound keeps this a `malformed` verdict in every
-  // kernel rather than a stack-limit-dependent split verdict — see
-  // MAX_CANONICAL_DEPTH.
+  // Reject a pathologically deep bundle before canonicalization recurses (see
+  // MAX_CANONICAL_DEPTH).
   if (exceedsDepth(bundle, MAX_CANONICAL_DEPTH)) {
     return malformed(
       `evidence bundle nesting exceeds the ${MAX_CANONICAL_DEPTH}-level canonicalization depth bound`,
@@ -915,15 +849,38 @@ async function verifyBundle(
   const b = bundle as EvidenceBundle;
   const specVersionOk = isEvidenceMajorAccepted(b.spec_version);
   if (!specVersionOk) {
-    // `?? null`: an ABSENT field is spelled `null`, as the Python twin's
-    // `_json_str` spells it. `JSON.stringify(undefined)` is `undefined`, and
-    // the two kernels printed two different sentences for one bundle until
-    // `verify --json` compared them byte for byte (0.13.0).
-    return malformed(`unsupported evidence spec_version: ${JSON.stringify(b.spec_version ?? null)}`, false);
+    // An absent field is spelled `null`, as in Python.
+    const unknown = malformed(
+      `unsupported evidence spec_version: ${JSON.stringify(b.spec_version ?? null)}`,
+      false,
+    );
+    unknown.versionUnknown = typeof b.spec_version === "string";
+    if (unknown.versionUnknown && typeof b.public_key === "string" && typeof b.signature === "string") {
+      // A version this verifier does not know still carries a signature it can check: one
+      // that fails is a pack changed after it was signed.
+      const found: string[] = [];
+      const [keyFormOk, signatureOk] = await checkWrapperSignature(b, found);
+      if (keyFormOk && !signatureOk) {
+        return {
+          status: "failed",
+          specVersionOk: false,
+          // Not checked under this version, so not the disproof here.
+          bodyHashOk: true,
+          signatureOk: false,
+          bodyType: null,
+          onChainChecked: false,
+          checkpoints: [],
+          events: [],
+          errors: [...unknown.errors, ...found],
+          versionUnknown: true,
+        };
+      }
+      unknown.signatureOk = signatureOk;
+    }
+    return unknown;
   }
   if (typeof b.signature_alg === "string" && b.signature_alg !== "ed25519") {
-    // The reference verifier implements ed25519 only (evidence-bundle §2 +
-    // decision #2); other algs are a deliberate future addition.
+    // Ed25519 only (evidence-bundle.md §2).
     return malformed(`unsupported signature_alg: ${JSON.stringify(b.signature_alg ?? null)}`, true);
   }
   if (typeof b.public_key !== "string" || typeof b.signature !== "string") {
@@ -933,22 +890,18 @@ async function verifyBundle(
     return malformed("evidence bundle is missing body_hash", true);
   }
   if (b.body === undefined || b.body === null) {
-    // body_ref (out-of-line body) is a defined growth hook but not part of the
-    // anchor-trace use case — refuse rather than silently pass.
+    // `body_ref` (out-of-line body) is refused rather than passed.
     return malformed("evidence bundle has no inline body (body_ref unsupported here)", true);
   }
 
-  // --- Step 2: verify the wrapper signature + recompute body_hash ------------
+  // Step 2: verify the wrapper signature and recompute `body_hash`.
   const errors: string[] = [];
 
-  // Every wrapper hex field is read STRICTLY, before any decoder sees it
-  // (proof#142). The Python decoder skipped ASCII whitespace, and the wrapper
-  // `signature` sits outside the signed scope, so one space in it, added by
-  // anyone and with no key, made a pack verify there and fail here. The same
-  // named failure in both kernels, for each field: `public_key` and
-  // `signature` are 64 and 128 hex characters in either case (proof#135,
-  // option B), and `body_hash` is 64 LOWER-case hex characters, the form it is
-  // recomputed in and compared against.
+  // Every wrapper hex field is read strictly, before any decoder sees it:
+  // `signature` is outside the signed scope, so a lenient decoder would let
+  // anyone flip a verdict by adding whitespace. `public_key` and `signature`
+  // are 64 and 128 hex characters in either case; `body_hash` is 64 lowercase,
+  // the form it is recomputed in.
   let bodyHashOk = false;
   if (!isHexField(b.body_hash, 64, true)) {
     errors.push("wrapper body_hash is not 64 lowercase hex characters");
@@ -964,27 +917,35 @@ async function verifyBundle(
     }
   }
 
-  let signatureOk = false;
-  const keyFormOk = isHexField(b.public_key, 64);
-  const signatureFormOk = isHexField(b.signature, 128);
-  if (!keyFormOk) errors.push("wrapper public_key is not 64 hex characters");
-  if (!signatureFormOk) errors.push("wrapper signature is not 128 hex characters");
-  if (keyFormOk && signatureFormOk) {
-    try {
-      const { signature: _sig, co_signatures: _co, ...bundleForSig } = b as EvidenceBundle & {
-        co_signatures?: unknown;
-      };
-      signatureOk = await ed25519Verify(utf8(jcs(bundleForSig)), b.signature, b.public_key);
-      if (!signatureOk) errors.push("wrapper Ed25519 signature verification failed");
-    } catch (e) {
-      errors.push(`wrapper signature verification error${thrownDetail(e)}`);
-    }
-  }
+  const [keyFormOk, signatureOk] = await checkWrapperSignature(b, errors);
 
-  const assertedStatus = typeof b.verdict?.status === "string" ? b.verdict.status : null;
+  // A key that cannot be read checks no signature: `signed` is not proven on that claim
+  // only. A `body_hash` that does not hold still fails, and a body that holds is still read,
+  // so a disproof inside it stands.
+  if (!keyFormOk && bodyHashOk) {
+    // Form is judged only under a signature that holds, so the wrapper's time is not.
+    const result = await readWrappedBody(b, specVersionOk, errors, options, exportSource, false);
+    result.signatureOk = false;
+    result.keyUnreadable = true;
+    if (result.status === "verified") result.status = "incomplete";
+    return result;
+  }
+  if (!keyFormOk) {
+    return {
+      status: "failed",
+      specVersionOk,
+      bodyHashOk,
+      signatureOk: false,
+      bodyType: typeof b.body_type === "string" ? b.body_type : null,
+      onChainChecked: false,
+      checkpoints: [],
+      events: [],
+      errors,
+      keyUnreadable: true,
+    };
+  }
 
-  // A broken wrapper (bad signature or tampered body) is a hard failure — the
-  // body is untrustworthy, so we do not pretend to verify its contents.
+  // A broken wrapper is a hard failure: the body is untrustworthy.
   if (!signatureOk || !bodyHashOk) {
     return {
       status: "failed",
@@ -995,102 +956,135 @@ async function verifyBundle(
       onChainChecked: false,
       checkpoints: [],
       events: [],
-      assertedStatus,
       errors,
     };
   }
 
-  // --- The wrapper's own time (evidence-bundle §2, A31) ---------------------
-  // `generated_at` is copied into a recomputed verdict's `as_of` (the export
-  // reading) and printed beside every verdict, so a present value that is not
-  // the RFC 3339 form `signed_at` already pins is a wrapper this kernel cannot
-  // render, whatever its signature. It is read only once the wrapper holds: a
-  // broken wrapper is `failed` above, as it was. Absence is unchanged.
+  return readWrappedBody(b, specVersionOk, errors, options, exportSource);
+}
+
+/** Everything a bundle says past its wrapper: its time, then its body by type. */
+async function readWrappedBody(
+  b: EvidenceBundle,
+  specVersionOk: boolean,
+  errors: string[],
+  options: VerifyEvidenceOptions,
+  exportSource: boolean,
+  judgeTime = true,
+): Promise<EvidenceBundleResult> {
+  const result = await readBody(b, specVersionOk, errors, options, exportSource);
+  // The wrapper's `generated_at` (evidence-bundle.md §2) is printed beside every verdict
+  // and copied into `as_of`, so a present value that is not RFC 3339 UTC is a format the
+  // producer broke. The body is read first, so a disproof inside it stands beside this one.
   if (
+    judgeTime &&
     Object.prototype.hasOwnProperty.call(b, "generated_at") &&
     !isRfc3339UtcInstant((b as { generated_at?: unknown }).generated_at)
   ) {
-    return malformed(GENERATED_AT_MALFORMED, specVersionOk, true);
+    result.status = "failed";
+    result.generatedAtMalformed = true;
+    result.errors = [GENERATED_AT_MALFORMED, ...result.errors.filter((e) => e !== GENERATED_AT_MALFORMED)];
   }
+  return result;
+}
 
-  // --- Body dispatch ---------------------------------------------------------
+/**
+ * `[keyFormOk, signatureOk]` for the wrapper's Ed25519 signature over every field but
+ * `signature` and `co_signatures`. `public_key` and `signature` are strings here.
+ */
+async function checkWrapperSignature(b: EvidenceBundle, errors: string[]): Promise<[boolean, boolean]> {
+  let signatureOk = false;
+  const keyFormOk = isHexField(b.public_key, 64);
+  const signatureFormOk = isHexField(b.signature, 128);
+  if (!keyFormOk) errors.push("wrapper public_key is not 64 hex characters");
+  if (!signatureFormOk) errors.push("wrapper signature is not 128 hex characters");
+  if (keyFormOk && signatureFormOk) {
+    try {
+      const { signature: _sig, co_signatures: _co, ...bundleForSig } = b as EvidenceBundle & {
+        co_signatures?: unknown;
+      };
+      signatureOk = await ed25519Verify(utf8(jcs(bundleForSig)), b.signature, b.public_key);
+      if (!signatureOk) errors.push("wrapper Ed25519 signature verification failed");
+    } catch (e) {
+      errors.push(`wrapper signature verification error${thrownDetail(e)}`);
+    }
+  }
+  return [keyFormOk, signatureOk];
+}
+
+/** A wrapped body, read by its type. */
+async function readBody(
+  b: EvidenceBundle,
+  specVersionOk: boolean,
+  errors: string[],
+  options: VerifyEvidenceOptions,
+  exportSource: boolean,
+): Promise<EvidenceBundleResult> {
   const bodyType = typeof b.body_type === "string" ? b.body_type : null;
 
-  // Read as an export's source (evidence-export.md §2.4), the only body this
-  // kernel recognises is sanning.anchor.trace/v3. Any other body, even one it
-  // verifies on its own, is undetermined here, after the wrapper checks above.
+  // As an export's source, only sanning.anchor.trace/v3 is recognised; any
+  // other body is undetermined.
   if (exportSource && bodyType !== ANCHOR_TRACE_BODY_TYPE) {
     errors.push(
       `body_type ${JSON.stringify(bodyType)} is not an export source ` +
-        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`,
+        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body not checked`,
     );
     return {
-      status: "partial",
+      status: "incomplete",
       specVersionOk,
-      bodyHashOk,
-      signatureOk,
+      bodyHashOk: true,
+      signatureOk: true,
       bodyType,
       onChainChecked: false,
       checkpoints: [],
       events: [],
-      assertedStatus,
       errors,
     };
   }
 
-  // Attested-evidence-export body (evidence-export.md §5). The wrapper is
-  // authentic (Ed25519 issuer signature + body_hash verified above, §5 step 2);
-  // hand off to the export verifier for steps 3–9.
+  // The wrapper is authentic (§5 step 2); the export verifier runs steps 3 to 9.
   if (bodyType === EXPORT_BODY_TYPE) {
-    return verifyExportBody(b, specVersionOk, assertedStatus, errors, options);
+    return verifyExportBody(b, specVersionOk, errors, options);
   }
 
-  // The Sanning-signed interval stamp body (evidence-bundle.md §5.2). The
-  // wrapper is authentic — and for this body that IS "Sanning signed it", since
-  // a stamp carries no second signature of its own inside the bundle.
+  // The stamp body (§5.2). For this body the wrapper signature is what
+  // "Sanning signed it" means: a stamp carries no second signature in the bundle.
   if (bodyType === STAMP_TRACE_BODY_TYPE) {
-    return verifyStampTrace(b, specVersionOk, assertedStatus, errors, options);
+    return verifyStampTrace(b, specVersionOk, errors, options);
   }
 
-  // The DL-52 hand-over body (§5.3): stamps AND the customer's events, joined.
+  // The hand-over body (§5.3): stamps and the customer's events, joined.
   if (bodyType === STAMP_EVIDENCE_BODY_TYPE) {
-    return verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options);
+    return verifyStampEvidence(b, specVersionOk, errors, options);
   }
 
   if (bodyType !== ANCHOR_TRACE_BODY_TYPE) {
-    // The wrapper is authentic but we don't know this body's structure. Per
-    // wrap-don't-merge, that is "partial" (cryptographically sound wrapper,
-    // body verdict undetermined) — not a failure.
+    // An authentic wrapper over an unknown body: `incomplete`, not a failure.
     errors.push(
       `body_type ${JSON.stringify(bodyType)} is not verifiable by this kernel ` +
-        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`,
+        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body not checked`,
     );
     return {
-      status: "partial",
+      status: "incomplete",
       specVersionOk,
-      bodyHashOk,
-      signatureOk,
+      bodyHashOk: true,
+      signatureOk: true,
       bodyType,
       onChainChecked: false,
       checkpoints: [],
       events: [],
-      assertedStatus,
       errors,
     };
   }
 
-  return verifyAnchorTrace(b, specVersionOk, assertedStatus, errors, options);
+  return verifyAnchorTrace(b, specVersionOk, errors, options);
 }
 
 /**
- * Recompute an export's source verdict (evidence-export.md §5 step 4).
- *
- * The only export source is `sanning.anchor.trace/v3` (§2.2, §2.4). Any other
- * inline source body is unrecognised *as a source*, even one this kernel
- * verifies on its own, such as a `sanning.stamp.evidence/v2` pack: §2.4 makes
- * its source verdict undetermined, so the export cannot reach `verified`. The
- * source wrapper is still checked first, because a forged source is a failure
- * whatever its body.
+ * Recompute an export's source verdict (evidence-export.md §5 step 4). Only a
+ * `sanning.anchor.trace/v3` source is recognised (§2.4); any other reads
+ * undetermined, so the export cannot reach `verified`. The source wrapper is
+ * checked first, because a forged source fails whatever its body.
  */
 async function verifyExportSource(
   source: unknown,
@@ -1100,9 +1094,8 @@ async function verifyExportSource(
 }
 
 /**
- * Index a source bundle's checkpoints by the key its attestations use: the
- * derived `checkpoint_ref`. Only a `sanning.anchor.trace/v3` source has
- * checkpoints an attestation can resolve (evidence-export.md §2.4).
+ * Index a source bundle's checkpoints by derived `checkpoint_ref`, the key
+ * attestations use (evidence-export.md §2.4).
  */
 async function indexSourceCheckpoints(
   bundle: EvidenceBundle,
@@ -1129,20 +1122,10 @@ async function indexSourceCheckpoints(
 type AnyTraceCheckpoint = Partial<TraceCheckpoint> & { tx_id?: unknown };
 
 /**
- * Resolve a checkpoint's join key and its witness reference.
- *
- * ── Why a retired spelling is a reject rather than a preference ──
- *
- * A checkpoint carrying a retired spelling beside the current one is two
- * answers to one question inside one signature. A reader that silently prefers
- * one gives a different answer from a reader that prefers the other, over the
- * same signed bytes, and both look like they verified. So `tx_id` and
- * `record_bytes` are rejected rather than resolved.
- *
- * ── Why the key is recomputed ──
- *
- * The key IS the bytes: relabelling a checkpoint and every event pointing at it
- * fails here, because nothing is taken from the label.
+ * Resolve a checkpoint's join key and witness reference. The key is recomputed
+ * from the bytes, never taken from the label. A retired spelling (`tx_id`,
+ * `record_bytes`) beside the current one is two answers inside one signature,
+ * so it is rejected rather than resolved.
  */
 async function resolveCheckpointKey(
   cp: AnyTraceCheckpoint,
@@ -1154,8 +1137,7 @@ async function resolveCheckpointKey(
   errors: string[];
 }> {
   const errors: string[] = [];
-  // Every early return below leaves before `anchor_ref` is ever looked at, so
-  // nothing there is "malformed": it is unexamined, which is not the same claim.
+  // Early returns never look at `anchor_ref`, so it is unexamined, not malformed.
   const unexamined = { key: null, anchorRef: null, anchorRefMalformed: false, errors };
 
   if (cp.tx_id !== undefined) {
@@ -1196,33 +1178,12 @@ async function resolveCheckpointKey(
 }
 
 /**
- * Validate an optional `anchor_ref` (§5.1.1).
+ * Validate an optional `anchor_ref` (§5.1.1): its shape, never its vocabulary.
  *
- * ── An unrecognised `kind` is NOT a failure, and that is the point ──
- *
- * The offline verdict — signatures, payload binding, Merkle inclusion — is
- * computed with no witness access at all. A reader that cannot resolve a
- * witness has therefore learned NOTHING about whether the evidence was
- * altered, and must not say otherwise. The shipped issuer did the opposite:
- * an unrecognised signature type returned `false` rather than `null`, mapped
- * to `tampered`, and was cached as permanent — a false accusation, produced
- * by a coverage gap, for a company whose product is telling people whether
- * records were altered.
- *
- * So this validates the SHAPE and never the vocabulary. A malformed
- * `anchor_ref` is a defect in the bundle; an unknown `kind` is a defect in
- * the reader, and only the first is the bundle's fault.
- *
- * ── Absent and malformed are not the same null (proof#120) ──
- *
- * Both leave no `AnchorRef` to re-fetch, and both used to be reported the same
- * way downstream: an all-`unreachable` on-chain result, although no gateway was
- * asked in either case. For the ABSENT case that is at least the note
- * `evidence-bundle.md` §5.1.1 reserves for "a checkpoint with no `anchor_ref`".
- * For the MALFORMED case it is a manufactured outage: the bundle named a
- * witness, the name was unreadable, and the reader was told the public record
- * could not be reached. So the two come back as different facts, and `malformed`
- * carries the difference.
+ * An unrecognised `kind` is not a failure: the offline verdict needs no witness,
+ * so a reader that cannot resolve one has learned nothing about alteration and
+ * must not accuse. A malformed `anchor_ref` is a defect in the bundle, and is
+ * returned as `malformed` so it is never reported as an unreachable witness.
  */
 function parseAnchorRef(
   raw: unknown,
@@ -1262,7 +1223,6 @@ function parseAnchorRef(
 async function verifyAnchorTrace(
   b: EvidenceBundle,
   specVersionOk: boolean,
-  assertedStatus: string | null,
   errors: string[],
   options: VerifyEvidenceOptions,
 ): Promise<EvidenceBundleResult> {
@@ -1275,31 +1235,17 @@ async function verifyAnchorTrace(
   const gateways = options.gateways ?? [];
   const onChainChecked = gateways.length > 0;
 
-  // --- Step 3: per-checkpoint -------------------------------------------------
-  //
-  // ── Why the join key is resolved BEFORE anything else ──
-  //
-  // `byKey` is what binds an event to the root its inclusion proof is checked
-  // against. Get it wrong and an event proves inclusion in a tree it was never
-  // in — the one failure in this file that produces a WRONG VERIFIED, not a
-  // failed verify. Everything below is downstream of it.
+  // Step 3: per checkpoint. `byKey` binds each event to the root its inclusion
+  // is checked against; a wrong key here would yield a wrong `verified`.
   const byKey = new Map<string, AnyTraceCheckpoint>();
   const anchorByKey = new Map<string, AnchorRef | null>();
   const checkpointResults: CheckpointResult[] = [];
-  // proof#120. Kept beside the results rather than on them: "the bundle named
-  // a witness we could not read" is an input defect the checkpoint's own
-  // `errors` already states, not a new dimension of the published verdict, and
-  // `CheckpointResult` is a shape downstream surfaces render.
+  // Kept beside the results: an unreadable witness name is an input defect the
+  // checkpoint's `errors` already states, not a verdict dimension.
   const malformedAnchorRef = new Set<CheckpointResult>();
   for (const rawCp of body.checkpoints as unknown[]) {
-    // `checkpoints[]` is attacker-shaped, and a verifier must never raise on
-    // adversarial input: a null entry used to reach `cp.tx_id` and hand the
-    // caller a TypeError instead of a verdict, which an auditor cannot tell
-    // apart from a broken tool. Graded and reported as "not a checkpoint"
-    // rather than coerced into an empty one: probing the envelope layer with
-    // nothing asks it a question about an object that was never an envelope.
-    // Same treatment, same words, as the §5.3 path's `events[] entry is not an
-    // object`.
+    // `checkpoints[]` is attacker-shaped; a verifier never raises on it. A
+    // non-object entry is reported as not a checkpoint, never coerced.
     if (rawCp === null || typeof rawCp !== "object" || Array.isArray(rawCp)) {
       checkpointResults.push({
         checkpointRef: "",
@@ -1319,8 +1265,7 @@ async function verifyAnchorTrace(
     let merkleRootOk = false;
     let leafCountOk = false;
 
-    // Decode event_bytes first: in v2 the join key is DERIVED from it, so it
-    // is an input to identity, not just to the payload binding below.
+    // The join key is derived from `event_bytes`, so decode them first.
     let eventBytes: Uint8Array | undefined;
     try {
       if (typeof cp.event_bytes === "string") eventBytes = hexToBytes(cp.event_bytes);
@@ -1330,15 +1275,9 @@ async function verifyAnchorTrace(
 
     const keyed = await resolveCheckpointKey(cp, eventBytes);
     cpErrors.push(...keyed.errors);
-    // A duplicate key is a HARD failure, not a note. `byKey` below keeps the
-    // FIRST occurrence, so a second checkpoint claiming the same key is
-    // verified against the first one's envelope and its own stated identity is
-    // never independently checked. Recording the finding and leaving `ok` true
-    // let the bundle roll up to `verified` while carrying a checkpoint nothing
-    // had verified: a false pass, which is what `evidence-bundle.md` §3
-    // principle 3 exists to prevent (the displayed verdict must be the
-    // recomputed one, and here the recomputation quietly dropped a finding it
-    // had made).
+    // A duplicate key is a hard failure: `byKey` keeps the first, so a second
+    // checkpoint's identity would otherwise never be checked and the bundle
+    // could roll up `verified` over it.
     let duplicateKey = false;
     if (keyed.key !== null) {
       if (byKey.has(keyed.key)) {
@@ -1350,20 +1289,17 @@ async function verifyAnchorTrace(
       }
     }
 
-    // Verify the checkpoint envelope against its committed record (external
-    // commitment — the record is the payload these external envelopes bind to).
+    // The record is the payload these external-commitment envelopes bind to.
     try {
       const res = await verifyEnvelope(
         cp.envelope as Envelope,
         eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
-      // A checkpoint must fully bind: signature + the committed record matching
-      // payload_hash. An undetermined binding (no record) is not enough to
-      // anchor the events' inclusion claims to a trustworthy root.
+      // A checkpoint must fully bind: an undetermined binding cannot anchor the
+      // events' inclusion claims to a trustworthy root.
       const hexError = envelopeHexError("checkpoint", cp.envelope);
       envelopeOk = res.ok && res.payloadHashOk === true && hexError === null;
-      // See the event loop below: a degenerate envelope is a malformed input,
-      // not a failed check (proof#76).
+      // A degenerate envelope is malformed input, not a failed check.
       if (!isJsonObject(cp.envelope)) {
         cpErrors.push("checkpoint envelope is not a JSON object");
       } else if (hexError !== null) {
@@ -1372,16 +1308,12 @@ async function verifyAnchorTrace(
         cpErrors.push("checkpoint envelope signature failed");
       }
       if (res.payloadHashOk === false) cpErrors.push("checkpoint record does not bind to payload_hash");
-      // proof#95: a malformed skeleton field fails the envelope with a valid
-      // signature and binding; name it rather than fail with no reason.
+      // Name a malformed skeleton field, which fails an otherwise valid envelope.
       for (const m of res.errors) if (m.startsWith("malformed ")) cpErrors.push(`checkpoint envelope ${m}`);
       const specFinding = specVersionFinding("checkpoint", cp.envelope, res);
       if (specFinding !== null) cpErrors.push(specFinding);
-      // WHY the binding is undetermined decides which sentence is true.
-      // event_bytes really absent is one thing; event_bytes present and
-      // unbindable (a degenerate envelope, unreadable hex) is another, and
-      // naming the wrong cause sends a reader to look for a field that is
-      // sitting right there (proof#76).
+      // Name why the binding is undetermined: absent bytes and unbindable bytes
+      // are different causes.
       if (res.payloadHashOk === null) {
         cpErrors.push(
           eventBytes === undefined
@@ -1393,8 +1325,7 @@ async function verifyAnchorTrace(
       cpErrors.push(`checkpoint envelope verify error${thrownDetail(e)}`);
     }
 
-    // The committed record's merkle_root must equal the checkpoint's claimed
-    // merkle_root (recompute, don't trust the bundle's top-level claim).
+    // Recompute: the committed record's merkle_root must equal the claimed one.
     if (eventBytes !== undefined) {
       try {
         const record = jcsParse(eventBytes) as {
@@ -1408,12 +1339,9 @@ async function verifyAnchorTrace(
               `committed=${jsonStr(committedRoot)}`,
           );
         }
-        // §5.1, A38 (proof#197), decided by Phil 2026-10-06: fail closed. The
-        // count the record signs is what every inclusion bound to this
-        // checkpoint is held to, so a record that signs no integer count fails
-        // the checkpoint, as a record that signs no merkle_root does. Read by
-        // value through the one reader the inclusion compare and the
-        // completeness notes share, so `3.0` and `3e0` are 3.
+        // Fail closed (§5.1): every inclusion is held to the count the record
+        // signs, so a record that signs no integer count fails the checkpoint.
+        // Read by value through the shared reader, so `3.0` and `3e0` are 3.
         leafCountOk = signedLeafCount(cp as { event_bytes?: unknown }) !== null;
         if (!leafCountOk) cpErrors.push("checkpoint record leaf_count is not an integer");
       } catch (e) {
@@ -1428,26 +1356,32 @@ async function verifyAnchorTrace(
       merkleRootOk,
       onChainOk: null, // filled in step 5 if a gateway re-fetch was requested
       onChain: null, // per-gateway (§4.2), filled in step 5
-      // `keyed.errors` is load-bearing here, not decorative. A structurally
-      // invalid anchor_ref rides INSIDE the signature, so it is a defect we
-      // can see rather than a coverage gap we cannot — and this kernel's
-      // standing rule is that malformed is a failure while absent is
-      // undetermined (the same rule disclosed `content` follows). Without
-      // this term the vector `trace-v2-malformed-anchor-ref` verified GREEN.
+      // A malformed `anchor_ref` is inside the signature: a visible defect,
+      // which fails, while an absent one is undetermined.
       ok: envelopeOk && merkleRootOk && leafCountOk && keyed.errors.length === 0 && !duplicateKey,
       errors: cpErrors,
+      anchorRefMalformed:
+        keyed.anchorRefMalformed && envelopeOk && merkleRootOk && leafCountOk && !duplicateKey,
     });
     if (keyed.anchorRefMalformed) {
       malformedAnchorRef.add(checkpointResults[checkpointResults.length - 1]);
     }
   }
 
-  // --- Step 4: per-event ------------------------------------------------------
+  // Every checkpoint ref the pack holds, derived or stated, compared as hex is. A ref
+  // outside it names a checkpoint the pack does not hold, which is a stamp missing, never a
+  // stamp proven wrong (section 5.1, as section 5.3.3 rule 1 reads a stamp).
+  const heldRefs = new Set<string>([...byKey.keys()].map((k) => k.toLowerCase()));
+  for (const raw of body.checkpoints as unknown[]) {
+    const ref = isJsonObject(raw) ? (raw as { checkpoint_ref?: unknown }).checkpoint_ref : undefined;
+    if (typeof ref === "string") heldRefs.add(ref.toLowerCase());
+  }
+
+  // Step 4: per event.
   const eventResults: EventResult[] = [];
+  const agentItems: (AgentHeldRecord | null)[] = [];
   for (const rawEv of body.events as unknown[]) {
-    // Same rule as `checkpoints[]` above, and the same words the §5.3 path
-    // already uses: a null or non-object entry is graded as not an event,
-    // never raised on.
+    // A non-object entry is graded as not an event, never raised on.
     if (rawEv === null || typeof rawEv !== "object" || Array.isArray(rawEv)) {
       eventResults.push({
         eventId: "<unknown>",
@@ -1458,35 +1392,24 @@ async function verifyAnchorTrace(
         contentOk: null,
         ok: false,
         errors: ["events[] entry is not an object"],
+        agent: null,
       });
+      agentItems.push(null);
       continue;
     }
     const ev = rawEv as TraceEvent;
     const evErrors: string[] = [];
     const eventId = getEventId(ev.envelope);
     let envelopeOk = false;
+    let envelopeFaults: EnvelopeFault[] = [];
     let payloadBindingOk: boolean | null = null;
 
-    // A retired field name under this major is a reject, never an ignored
-    // unknown field: ignored, it reads as a withheld record (W-3).
+    // A retired field name is a reject: ignored, it would read as withheld.
     const legacyError = legacyEventBytesError(ev, "event", bodyType);
     if (legacyError !== null) evErrors.push(legacyError);
 
-    // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
-    //
-    // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
-    // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
-    // line down. So an event carrying garbage in place of its record used to
-    // reach the same tri-state as an event carrying nothing: `payloadHashOk`
-    // null, `ok` true, a leading tick on the line, and a `verified` rollup over
-    // a record nobody could read. The only thing wrong with the pack was the
-    // bytes, and it was the one thing the verdict did not say.
-    //
-    // A record the producer chose not to disclose is the customer exercising
-    // minimum disclosure. A record that is present and unreadable is a defect
-    // in the artifact, and this kernel's standing rule (the same one
-    // `checkpoints[]` already applies through `keyed.errors`) is that a defect
-    // we can see fails.
+    // Malformed is a failure; absent is undetermined. Undecodable `event_bytes`
+    // would otherwise look exactly like a withheld record and verify.
     let eventBytes: Uint8Array | undefined;
     let eventBytesMalformed = false;
     try {
@@ -1495,10 +1418,10 @@ async function verifyAnchorTrace(
       eventBytesMalformed = true;
       evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
     }
-    const duplicate = recordDuplicateKey(eventBytes);
-    if (duplicate !== undefined) {
+    const notJson = recordNotJson(eventBytes);
+    if (notJson !== undefined) {
       eventBytesMalformed = true;
-      evErrors.push(`event record is not JSON: ${duplicate}`);
+      evErrors.push(notJson);
     }
     try {
       const res = await verifyEnvelope(
@@ -1506,16 +1429,12 @@ async function verifyAnchorTrace(
         eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
       const hexError = envelopeHexError("event", ev.envelope);
-      // ok tolerates an undetermined binding (withheld record)
+      // Tolerates an undetermined binding (withheld record).
       envelopeOk = res.ok && hexError === null;
+      envelopeFaults = eventEnvelopeFaults(res.faults, hexError);
       payloadBindingOk = res.payloadHashOk;
-      // P-10: report what could not be determined, never a fault that was never
-      // observed. There is no envelope here, so no signature was checked and no
-      // binding was attempted. "signature failed" named a check that never ran,
-      // and it was the only thing said about an event whose undetermined
-      // binding then rendered as a WITHHELD record, a claim about the
-      // producer's disclosure choice out of an input that says nothing about
-      // the producer at all (proof#76).
+      // No envelope, so no signature was checked: report it as malformed, not as
+      // a failed signature or a withheld record.
       if (!isJsonObject(ev.envelope)) {
         evErrors.push("event envelope is not a JSON object");
       } else if (hexError !== null) {
@@ -1524,27 +1443,27 @@ async function verifyAnchorTrace(
         evErrors.push("event envelope signature failed");
       }
       if (res.payloadHashOk === false) evErrors.push("event record does not bind to payload_hash");
-      // A malformed skeleton field fails the envelope with a valid signature
-      // and binding (proof#95), so without this the event fails with no reason.
+      // Name a malformed skeleton field, which fails an otherwise valid envelope.
       for (const m of res.errors) if (m.startsWith("malformed ")) evErrors.push(`event envelope ${m}`);
+      if (res.errors.some((m) => m.startsWith("missing payload_hash"))) evErrors.push("event envelope missing payload_hash");
       const specFinding = specVersionFinding("event", ev.envelope, res);
       if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
       evErrors.push(`event envelope verify error${thrownDetail(e)}`);
     }
 
-    // Bind the event to exactly one checkpoint in the bundle, then verify
-    // RFC 9162 inclusion against THAT checkpoint's merkle_root.
+    // Bind the event to exactly one checkpoint, then verify RFC 9162 inclusion
+    // against that checkpoint's merkle_root.
     const incl = ev.inclusion as (TraceInclusion & { checkpoint_tx_id?: unknown }) | undefined;
-    // An inclusion carrying the retired `checkpoint_tx_id` spelling is a mixed
-    // bundle, and resolving it anyway is how an event silently binds to a
-    // checkpoint nobody meant.
+    // The retired `checkpoint_tx_id` spelling marks a mixed bundle; resolving
+    // it could bind the event to an unintended checkpoint.
     const keyField = "checkpoint_ref";
     const wrongField = "checkpoint_tx_id";
     const inclAsRecord = incl as unknown as Record<string, unknown> | undefined;
     const rawKey = inclAsRecord ? inclAsRecord[keyField] : undefined;
     const strayKey = inclAsRecord ? inclAsRecord[wrongField] : undefined;
     let cp: AnyTraceCheckpoint | undefined;
+    let stampAbsent = false;
     if (!incl || typeof incl !== "object") {
       evErrors.push("event missing inclusion proof");
     } else if (strayKey !== undefined) {
@@ -1555,7 +1474,14 @@ async function verifyAnchorTrace(
       evErrors.push(`event inclusion missing ${keyField}`);
     } else {
       cp = byKey.get(rawKey);
-      if (cp === undefined) {
+      if (cp === undefined && !heldRefs.has(rawKey.toLowerCase())) {
+        // The pack does not hold the checkpoint the record names: `witnessed` is not
+        // proven (`missing`).
+        stampAbsent = true;
+        evErrors.push(
+          `event inclusion.${keyField} ${JSON.stringify(rawKey)} names a checkpoint this pack does not hold`,
+        );
+      } else if (cp === undefined) {
         evErrors.push(
           `event inclusion.${keyField} ${JSON.stringify(rawKey)} resolves to no checkpoint`,
         );
@@ -1564,22 +1490,12 @@ async function verifyAnchorTrace(
     const checkpointBound = cp !== undefined;
 
     let inclusionOk = false;
-    // §5.1, A38 (proof#197): the tree walked must be the tree the checkpoint
-    // record signed, the same rule and the same sentence as the stamp path's
-    // rule 3. RFC 9162's walk reads one audit path as valid at more than one
-    // (leaf_index, leaf_count), so without this a real proof at (2, 3) also
-    // verified as (1, 2) or (4, 5). A signed count that cannot be read is not
-    // compared here: it has already failed its checkpoint (above), so the
-    // bundle cannot verify. One reader of the signed count, shared with the
-    // completeness notes, so the verdict and the grade never read two
-    // different numbers.
-    //
-    // Every number here is read BY VALUE (`Number.isSafeInteger`), the model
-    // JCS signs, and the Python kernel reads the same way (`_safe_integer`):
-    // JCS writes `3.0` as `3`, so a stated `3.0` is the integer 3 under the
-    // same wrapper signature. A value that is not a safe integer is malformed,
-    // with one sentence that prints no value, because the two kernels cannot
-    // print `2.5`, `1e400` or `9007199254740993` the same way.
+    // The tree walked must be the tree the checkpoint record signed (§5.1): an
+    // RFC 9162 audit path is valid at more than one (leaf_index, leaf_count),
+    // so a proof at (2, 3) would also verify as (1, 2). An unreadable signed
+    // count already failed its checkpoint. Numbers are read by value, as JCS
+    // signs them; a non-safe-integer is malformed, in a sentence that prints no
+    // value because the kernels cannot print it alike.
     const signedCount = cp ? signedLeafCount(cp as { event_bytes?: unknown }) : null;
     if (incl && checkpointBound && cp) {
       const statedCount = safeInteger(incl.leaf_count);
@@ -1600,19 +1516,14 @@ async function verifyAnchorTrace(
             statedIndex,
             statedCount,
             (incl.audit_path ?? []).map((h) => hexToBytes(h)),
-            // No `?? ""` fallback. A checkpoint that claims NO root must not be
-            // handed an invented empty one: the Python kernel refuses the same
-            // value and reports the decode failure, so substituting "" here had
-            // the two kernels say different things about one bundle (TS: "the
-            // proof did not reconstruct the checkpoint root", which is not what
-            // happened: there was no claimed root to reconstruct).
+            // No `?? ""` fallback: a checkpoint claiming no root must not be
+            // handed an invented one.
             hexToBytes(cp.merkle_root as string),
           );
           if (!inclusionOk) evErrors.push("RFC 9162 inclusion proof did not reconstruct the checkpoint root");
 
-          // Defense in depth: the claimed leaf_hash MUST be the hash of the
-          // event's own signed envelope bytes (profile §6) — otherwise a valid
-          // inclusion proof for an UNRELATED leaf could be smuggled in.
+          // The claimed leaf_hash must hash the event's own signed envelope
+          // (profile §6), or a proof for an unrelated leaf could be smuggled in.
           const expectedLeaf = await leafHash(utf8(jcs(ev.envelope)));
           const expectedLeafHex = toHex(expectedLeaf);
           if (expectedLeafHex !== (incl.leaf_hash ?? "").toLowerCase()) {
@@ -1627,10 +1538,12 @@ async function verifyAnchorTrace(
       }
     }
 
-    // Content (raw-log) binding — shared with every other event-carrying body.
     const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
     const contentOk = contentRes.contentOk;
     evErrors.push(...contentRes.errors);
+    agentItems.push(
+      agentItem(ev, eventBytes, envelopeOk && payloadBindingOk === true && !eventBytesMalformed),
+    );
 
     eventResults.push({
       eventId,
@@ -1639,13 +1552,9 @@ async function verifyAnchorTrace(
       inclusionOk,
       checkpointBound,
       contentOk,
-      // An event is "ok" when its envelope is authentic (signature + binding
-      // not-failed), its inclusion proof reconstructs the root, it binds to a
-      // present checkpoint, and its disclosed content did not MISMATCH. A
-      // withheld record or undisclosed content (binding/content null) does not
-      // fail it.
-      // `!eventBytesMalformed`: present-and-unreadable record bytes are a
-      // defect in the artifact, never a disclosure choice (proof#85).
+      // Ok when the envelope is authentic, inclusion reconstructs the root, the
+      // checkpoint is present, and disclosed content did not mismatch. Withheld
+      // or undisclosed content does not fail it; unreadable record bytes do.
       ok:
         envelopeOk &&
         inclusionOk &&
@@ -1654,16 +1563,24 @@ async function verifyAnchorTrace(
         legacyError === null &&
         !eventBytesMalformed,
       errors: evErrors,
+      agent: null,
+      envelopeFault: envelopeFaults[0] ?? null,
+      envelopeFaults,
+      recordNotJson: notJson !== undefined && envelopeOk && payloadBindingOk === true,
+      contentUnsigned: contentOk === false && contentRes.unsigned,
+      stampAbsent,
+      ownFormFailed: legacyError !== null || eventBytesMalformed,
     });
   }
 
-  // --- Step 5: optional on-chain re-fetch ------------------------------------
+  await attachAgentReadings(eventResults, agentItems);
+
+  // Step 5: optional on-chain re-fetch.
   const fetchImpl = options.fetchImpl ?? (globalThis.fetch as typeof fetch | undefined);
   let gatewayUnavailable = false;
   let uncheckedKind = false;
   let uncheckedId = false;
-  // Simulated witnesses against witnesses of any other kind, counted over the
-  // checkpoints that name one, as `refetchStamps` counts stamps.
+  // Simulated witnesses against any other kind, as `refetchStamps` counts.
   let simulated = 0;
   let onChainKinds = 0;
   if (onChainChecked) {
@@ -1674,21 +1591,11 @@ async function verifyAnchorTrace(
       for (const cpr of checkpointResults) {
         const cp = byKey.get(cpr.checkpointRef);
         if (!cp) continue;
-        // A checkpoint with no anchor_ref has NOTHING to re-fetch. Under DL-52
-        // that is the normal state inside a stamp interval — placed, readable,
-        // not yet witnessed — so it reports as unreachable (which downgrades
-        // the run to partial) and NEVER as a mismatch. Treating "we never
-        // anchored it yet" as "the chain disagrees" would be the same false
-        // accusation this whole change is removing.
-        // proof#120. An `anchor_ref` that failed structural validation is not
-        // an absent one. Nothing was fetched, so the witness dimension is NOT
-        // CHECKED — `onChain: null`, exactly as when the caller supplied no
-        // adapter — and it must not raise `gatewayUnavailable`, which is what
-        // puts "could not be re-fetched from the supplied gateways" on the
-        // bundle. Reporting an outage nobody observed is a claim about the
-        // public record made out of a defect in the artifact, and verify-page
-        // renders it word for word. The run still fails: the structural error
-        // is already in `cpr.errors` and already in `ok` above.
+        // No `anchor_ref`: nothing to re-fetch. Absent (placed, not yet
+        // witnessed) reports as unreachable, downgrading the run to partial and
+        // never to a mismatch. Malformed reports as not checked (`onChain:
+        // null`) and must not raise `gatewayUnavailable`: no outage was
+        // observed, and the structural error already fails the run.
         if (cpr.anchorRef === null && malformedAnchorRef.has(cpr)) {
           cpr.onChain = null;
           cpr.onChainOk = null;
@@ -1714,54 +1621,46 @@ async function verifyAnchorTrace(
         if (outcome.unchecked === "kind") uncheckedKind = true;
         if (outcome.unchecked === "id") uncheckedId = true;
         if (outcome.error) cpr.errors.push(outcome.error);
-        // Fold the on-chain dimension in: a MISMATCH (false) fails the
-        // checkpoint — the proof was not anchored as claimed. An UNREACHABLE
-        // gateway (null) leaves the offline-sound checkpoint ok; the run
-        // downgrades to "partial" (exit 3) via gatewayUnavailable, not a hard
-        // failure. A match (true) keeps it ok.
-        // AND into the verdict already computed, never rebuild it from a
-        // hand-listed set of dimensions. Rebuilding silently dropped every
-        // term not in that list: the duplicate-key gate (proof#28) and the
-        // `keyed.errors` term with it, so supplying a gateway turned a hard
-        // reject back into `verified` and an UNREACHABLE gateway turned it
-        // into `partial` (exit 3), which reads as a network problem an
-        // operator retries. Neither is conditioned on a gateway by the spec:
-        // `evidence-bundle.md` says two checkpoints carrying one key is a
-        // hard reject, full stop. Written this way, a term added at
-        // construction survives here by construction.
+        // A mismatch fails the checkpoint; unreachable leaves it ok and
+        // downgrades the run to partial. AND into the verdict already computed,
+        // never rebuild it, so every construction-time term (the duplicate-key
+        // gate included) survives.
         cpr.ok = cpr.ok && cpr.onChainOk !== false;
       }
     }
   }
 
-  // --- Rollup ----------------------------------------------------------------
+  // Rollup.
   const allCheckpointsOk = checkpointResults.length > 0 && checkpointResults.every((c) => c.ok);
   const allEventsOk = eventResults.every((e) => e.ok);
   const anyHardFailure =
-    checkpointResults.some((c) => !c.ok) || eventResults.some((e) => !e.ok);
+    checkpointResults.some((c) => !c.ok) || eventResults.some((e) => !e.ok && !unproven(e));
   const anyWithheldRecord = eventResults.some((e) => e.payloadBindingOk === null);
-
+  const anyStampAbsent = eventResults.some((e) => e.stampAbsent === true);
+
+  // A lookup that did not settle is the witness line's to say, never the status's: the
+  // witness is proven offline by the checkpoint and its inclusion proof, and only a lookup
+  // that finds other bytes (a hard failure above) moves anything.
+  pushRefetchGapNotes(errors, "checkpoints", {
+    unavailable: gatewayUnavailable,
+    kind: uncheckedKind,
+    id: uncheckedId,
+  });
+  // A checkpoint nobody has witnessed yet (no anchor_ref) is placed, not witnessed: the
+  // `witnessed` claim is not proven (evidence-bundle.md section 3), as for a stamp.
+  const anyUnwitnessed = checkpointResults.some((c) => c.anchorRef === null);
   let status: EvidenceStatus;
   if (anyHardFailure) {
     status = "failed";
-  } else if (gatewayUnavailable || uncheckedKind || uncheckedId) {
-    // Every offline check passed and nothing MISMATCHED, but a requested
-    // on-chain confirmation could not be made — the bundle is offline-sound,
-    // its anchored state unconfirmed. "partial" + a note the CLI maps to exit 3.
-    status = "partial";
-    pushRefetchGapNotes(errors, "checkpoints", {
-      unavailable: gatewayUnavailable,
-      kind: uncheckedKind,
-      id: uncheckedId,
-    });
+  } else if (anyUnwitnessed || anyStampAbsent || eventResults.some(unproven)) {
+    status = "incomplete";
   } else if (anyWithheldRecord) {
-    // Everything that COULD be checked passed; some record bytes were withheld
-    // so their semantic binding is undetermined (not a failure) — "partial".
-    status = "partial";
+    // Some record bytes were withheld, so their binding is not checked.
+    status = "incomplete";
   } else if (allCheckpointsOk && allEventsOk) {
     status = "verified";
   } else {
-    status = "partial";
+    status = "incomplete";
   }
 
   return {
@@ -1770,63 +1669,22 @@ async function verifyAnchorTrace(
     bodyHashOk: true,
     signatureOk: true,
     bodyType,
-    // A run whose only witnessed checkpoints are simulated looked nothing up
-    // on a chain, so it is not counted as checked on one (the stamp rule in
-    // `refetchStamps`). The checkpoints stay not checked and the run partial.
+    // Simulated-only witnesses looked nothing up on a chain, so the run is not
+    // counted as checked on one.
     onChainChecked: onChainChecked && !(simulated > 0 && onChainKinds === 0),
     checkpoints: checkpointResults,
     events: eventResults,
-    assertedStatus,
     errors,
   };
 }
 
-// ===========================================================================
-// `sanning.stamp.trace/v1` — the Sanning-signed interval stamp (§5.2, DL-58)
-//
-// ── What this can prove, and what it deliberately does not claim ──
-//
-// A stamp is not a producer artifact. Under DL-52 the customer signs an
-// envelope and POSTs it; the commitment is witnessed later, on an interval, by
-// a stamp the customer never sees and holds no key for. So there is no
-// producer signature inside this body to check, and — this is the part worth
-// being precise about — there is no SECOND Sanning signature either. The
-// control plane stores the stamp's canonical bytes and hands them to a witness
-// as a signed chain data item; the signature lives on the chain, not in the
-// `stamps` table and not in this body.
-//
-// What "Sanning signed this" means for a stamp bundle is therefore exactly the
-// WRAPPER signature, verified generically before this function is reached. And
-// what makes the stamp evidence rather than an assertion is the witness, which
-// is on a chain and not checkable offline. Hence the rollup below: a stamp we
-// can read but nobody has witnessed holds the bundle at `partial`.
-//
-// So the checkable surface here is the stamp's INTERNAL consistency against
-// the one authority in the bundle — the witnessed bytes:
-//
-//   1. `stamp_ref` is SHA-256 of the DECODED bytes (derived, not asserted).
-//   2. Those bytes parse and re-canonicalize to themselves under JCS.
-//   3. Their `stamp_version` is the one this body_type pins.
-//   4. Every sub-tree range accounts for exactly one leaf of the stamp.
-//
-// (4) is the one that carries customer weight. R-8's whole per-agent story is
-// "prove this agent was under evidence over window W", answered by a
-// contiguous `first_leaf`/`leaf_count` slice of the org tree. Ranges that do
-// not tile `[0, leaf_count)` describe a partition that does not exist, so a
-// slice claim resting on them is unfounded — and unlike a bad signature,
-// nothing else in the stack would ever notice.
-// ===========================================================================
-
-// A JSON object, as opposed to null, an array, a string or a number. Used at
-// every point where a nested field MUST be an object before any check of it
-// means anything: probing a verifier with a non-object asks a question about
-// something that was never the thing, and the answer must say so rather than
-// name a check that never ran (proof#76).
+// A JSON object, as opposed to null, an array, a string or a number. A nested
+// field must be one before any check of it means anything.
 function isJsonObject(v: unknown): v is Record<string, unknown> {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 
-/** Lowercase hex, even length, non-empty. The family's serialization rule. */
+/** Lowercase hex, even length, non-empty. */
 function isLowerHex(s: unknown, nibbles?: number): s is string {
   if (typeof s !== "string" || s.length === 0 || s.length % 2 !== 0) return false;
   if (nibbles !== undefined && s.length !== nibbles) return false;
@@ -1834,61 +1692,36 @@ function isLowerHex(s: unknown, nibbles?: number): s is string {
 }
 
 /**
- * A JSON number read BY VALUE as a non-negative safe integer, or null.
- * `safeInteger`, the reader every leaf count and leaf index in this kernel
- * goes through (A38), mirrored by `_non_neg_integer` in
- * `src/sanning_proof/evidence.py`. `Number.isInteger` alone accepted `1e+21`,
- * JCS's own spelling of a count past 2**53 - 1, which Python refused.
+ * A JSON number read by value as a non-negative safe integer, or null. Matches
+ * Python's `_non_neg_integer`; `Number.isInteger` alone would accept `1e+21`.
  */
 function nonNegInteger(n: unknown): number | null {
   const v = safeInteger(n);
   return v !== null && v >= 0 ? v : null;
 }
 
-/**
- * Parse and check one stamp's witnessed bytes.
- *
- * Errors accumulate rather than short-circuit wherever a later check is still
- * meaningful, so a bundle with two independent defects reports two — a
- * verifier that stops at the first one turns a second fix into a second
- * round-trip.
- */
-// ===========================================================================
-// Disclosed-content binding, shared by every body that carries events.
-//
-// Extracted for `sanning.stamp.evidence/v2` (§5.3) rather than copied. The
-// rawLog -> content_hash link is the one step the chain
-// (content_hash -> record -> payload_hash -> signature -> leaf -> root) does
-// not otherwise cover, and a second copy of it is a second place for the
-// never-fail-on-absent discipline to drift. The rules are unchanged from the
-// anchor-trace path this came from: undetermined (null) when nothing is
-// disclosed or nothing is committed; false ONLY on a real mismatch or an
-// in-body vs side-input disagreement.
-// ===========================================================================
+// Disclosed-content binding, shared by every body that carries events. The
+// raw log to `content_hash` link is the one step the signature chain does not
+// cover. Undetermined (null) when nothing is disclosed or committed; false only
+// on a real mismatch or an in-body vs side-input disagreement.
 async function verifyDisclosedContent(
   ev: { envelope?: unknown; content?: unknown },
   eventId: string,
   eventBytes: Uint8Array | undefined,
   sideContent: VerifyEvidenceOptions["content"],
-): Promise<{ contentOk: boolean | null; errors: string[] }> {
+): Promise<{ contentOk: boolean | null; unsigned: boolean; errors: string[] }> {
   const evErrors: string[] = [];
   let contentOk: boolean | null = null;
-
-  // WHICH hash in the record is decided by the record's STRUCTURE
-  // (evidence-bundle §5.1 v1.19, A20). A record `envelope-spec.md` §4.1
-  // governs (`isHandoffNamespace`) commits to its message through
-  // `event.message_hash`, SHA-256 of `JCS(message object)`, and has no
-  // `content_hash`, so until A20 its disclosure bound to nothing and an honest
-  // hand-off pack could never grade `verified`. For such a record the committed
-  // hash is `event.message_hash` and nothing else: not a `content_hash` it also
-  // carries, and not the envelope's. It binds only when the record is a
-  // CONFORMANT hand-off record under the key that signed it
-  // (`isConformantHandoffRecord`) and the value is 64 characters of lowercase
-  // hex. Anything short of that commits nothing this reader will bind to, so
-  // the reading is undetermined and never true: a record dressed as a hand-off
-  // record gains no binding from the dress, and a record outside §4.1 keeps its
-  // `content_hash` exactly as before, whatever `message_hash` field it writes.
-  // The Python twin is `evidence._evaluate_content`.
+  // Whether a `false` rests on side bytes nobody signed: the side input checked alone, or
+  // side bytes that differ from in-body bytes that do not fail on their own.
+  let unsigned = false;
+
+  // Which hash binds depends on the record's structure (§5.1). A record §4.1
+  // governs commits through `event.message_hash` (SHA-256 of the message's
+  // JCS), and binds only when it is a conformant hand-off record and the value
+  // is 64 lowercase hex characters; otherwise the reading is undetermined, never
+  // true. Any other record binds through `content_hash`. Python's twin is
+  // `_evaluate_content`.
   const committed: string[] = [];
   let recordContentHash: string | undefined;
   let governed = false;
@@ -1922,8 +1755,8 @@ async function verifyDisclosedContent(
         }
       }
     } catch {
-      // record not JSON — the payload binding already reflects that; content
-      // stays undetermined rather than throwing.
+      // Record not JSON: the payload binding reflects that; content stays
+      // undetermined.
     }
   }
   if (governed) {
@@ -1931,9 +1764,8 @@ async function verifyDisclosedContent(
   } else if (recordContentHash !== undefined) {
     committed.push(recordContentHash);
   } else if (ev.envelope && typeof ev.envelope === "object") {
-    // Promoted fallback. Guarded: contentHashes() dereferences env.payload,
-    // which throws on a null/non-object envelope — a verifier must never raise
-    // on adversarial input.
+    // Promoted fallback, guarded: `contentHashes` would throw on a non-object
+    // envelope.
     for (const c of contentHashes(ev.envelope as Envelope)) committed.push(c.hash.toLowerCase());
   }
 
@@ -1946,6 +1778,8 @@ async function verifyDisclosedContent(
     evErrors.push(
       "disclosed content disagreement: in-body events[].content and the supplied content differ",
     );
+    // Unsigned unless the in-body bytes, which the wrapper signs, fail on their own.
+    unsigned = committed.length === 0 || committed.includes(await sha256Hex(inBody));
   } else {
     const disclosed = inBody ?? side;
     if (disclosed === undefined || committed.length === 0) {
@@ -1955,14 +1789,15 @@ async function verifyDisclosedContent(
           governed
             ? "disclosed content present but this hand-off record commits no " +
                 "message_hash a reader can bind to (not a conformant hand-off " +
-                "record, or message_hash is not 64 lowercase hex) -- undetermined"
+                "record, or message_hash is not 64 lowercase hex) -- not checked"
             : "disclosed content present but no committed content_hash to bind to " +
-                "(record withheld or record has no event.content_hash) -- undetermined",
+                "(record withheld or record has no event.content_hash) -- not checked",
         );
       }
     } else {
       const got = await sha256Hex(disclosed);
       contentOk = committed.includes(got);
+      unsigned = !contentOk && inBody === undefined;
       if (!contentOk) {
         const fieldName = governed ? "message_hash" : "content_hash";
         evErrors.push(
@@ -1972,28 +1807,23 @@ async function verifyDisclosedContent(
       }
     }
   }
-  return { contentOk, errors: evErrors };
+  return { contentOk, unsigned, errors: evErrors };
 }
 
 /**
  * One `stamps[]` entry's result, plus the witnessed bytes it was graded on.
- *
- * `witnessedHex` is internal and never surfaces on `StampResult`: it is the
- * whole stamp body again, and putting it back on the result would double every
- * serialized verdict to carry a copy of what the bundle already holds. It
- * exists so the optional on-chain re-fetch compares the chain against THE SAME
- * BYTES this function hashed to derive `stamp_ref`, rather than re-reading
- * `stamp_bytes` out of the body a second time — one value, so the graded bytes
- * and the compared bytes cannot come apart.
- *
- * Undefined exactly when `stamp_bytes` was unusable, in which case the entry
- * has already failed and there is nothing a gateway could confirm.
+ * `witnessedHex` stays internal so the on-chain re-fetch compares the same
+ * bytes that derived `stamp_ref`. Undefined when `stamp_bytes` was unusable.
  */
 interface StampEntryOutcome {
   result: StampResult;
   witnessedHex?: string;
 }
 
+/**
+ * Parse and check one stamp's witnessed bytes. Errors accumulate wherever a
+ * later check still means something, so independent defects are all reported.
+ */
 async function verifyStampEntry(
   raw: unknown,
   seen: Set<string>,
@@ -2023,7 +1853,7 @@ async function verifyStampEntry(
   }
   const e = raw as Partial<StampEntry> & Record<string, unknown>;
 
-  // --- the witnessed bytes, which are the only authority in this body -------
+  // The witnessed bytes are the only authority in this body.
   if (!isLowerHex(e.stamp_bytes)) {
     errors.push("stamp_bytes is missing or not lowercase hex");
     return { result: base };
@@ -2035,19 +1865,14 @@ async function verifyStampEntry(
     errors.push(`stamp_bytes is not hex${thrownDetail(err)}`);
     return { result: base };
   }
-  // Gated by `isLowerHex` above, so this is already the exact lowercase hex of
-  // the exact witnessed bytes — §5.2.2's "one authority in this body".
+  // Gated by `isLowerHex` above: already the exact witnessed bytes' hex (§5.2.2).
   const witnessedHex: string = e.stamp_bytes;
 
-  // --- the derived identity -------------------------------------------------
   const derived = await sha256Hex(bytes);
   if (typeof e.stamp_ref !== "string" || e.stamp_ref === "") {
     errors.push("stamp entry missing stamp_ref");
   } else if (e.stamp_ref.toLowerCase() !== derived) {
-    // The bytes were edited and the label was not — or the label was edited
-    // and the bytes were not. Either way the bundle names a stamp it is not
-    // carrying, and quoting that name to a witness would resolve to something
-    // else entirely.
+    // Bytes and label disagree: the bundle names a stamp it is not carrying.
     errors.push(
       `stamp_ref does not match SHA-256(stamp_bytes): claimed=${e.stamp_ref} derived=${derived}`,
     );
@@ -2062,7 +1887,6 @@ async function verifyStampEntry(
     }
   }
 
-  // --- the body itself ------------------------------------------------------
   let body: StampBody;
   try {
     const parsed: unknown = jcsParse(bytes);
@@ -2071,10 +1895,8 @@ async function verifyStampEntry(
       return { result: base, witnessedHex };
     }
     body = parsed as StampBody;
-    // Re-canonicalize and compare. The plane replays these bytes verbatim on
-    // every submit attempt for exactly this reason: a non-canonical body makes
-    // a retry a DIFFERENT submission, and makes every independent re-derivation
-    // of the stamp disagree with the one that was witnessed.
+    // Must re-canonicalize to itself: a non-canonical body makes every
+    // independent re-derivation disagree with what was witnessed.
     if (jcs(body as unknown as Record<string, unknown>) !== decodeUtf8Strict(bytes)) {
       errors.push("stamp_bytes are not JCS-canonical (RFC 8785)");
       return { result: base, witnessedHex };
@@ -2085,10 +1907,8 @@ async function verifyStampEntry(
   }
 
   if (body.stamp_version !== STAMP_BODY_VERSION) {
-    // A `sanning.stamp.trace/v1` body whose inner version is something else is
-    // two answers to one question inside one signature. The body_type is the
-    // reader's dispatch key and it said v1; honouring the other spelling is
-    // how a reader half-parses a shape it does not know.
+    // The inner version must match the body type: two answers inside one
+    // signature are rejected.
     errors.push(
       `unsupported stamp_version ${JSON.stringify(body.stamp_version ?? null)} in a ` +
         `${STAMP_TRACE_BODY_TYPE} body (expected ${STAMP_BODY_VERSION})`,
@@ -2103,7 +1923,7 @@ async function verifyStampEntry(
       errors.push(`stamp body ${f} is missing or not a non-empty string`);
       base.bodyOk = false;
     } else if (f !== "org_ref" && !isRfc3339UtcInstant(body[f])) {
-      // §5.2 (A31): the promise window is the form `signed_at` pins.
+      // The promise window uses the form `signed_at` pins (§5.2).
       errors.push(`stamp body ${f} is not an RFC 3339 UTC date-time with Z naming a real date and time`);
       base.bodyOk = false;
     }
@@ -2125,30 +1945,26 @@ async function verifyStampEntry(
     base.leafCount = stampCount;
   }
 
-  // --- the sub-tree ranges --------------------------------------------------
   base.subtreesOk = checkSubtrees(body, base, errors);
 
-  // A stamp needs no malformed/absent split: the §5.2 re-fetch path already
-  // leaves `onChain` null whenever there is no `AnchorRef`, so it never
-  // synthesised the outage proof#120 is about.
-  base.anchorRef = parseAnchorRef(e.anchor_ref, errors).ref;
+  // No malformed/absent split is needed: the re-fetch leaves `onChain` null
+  // whenever there is no `AnchorRef`.
+  const clean = errors.length === 0;
+  const parsedRef = parseAnchorRef(e.anchor_ref, errors);
+  base.anchorRef = parsedRef.ref;
 
   base.ok =
     base.stampRefOk && base.bodyOk && base.subtreesOk && errors.length === 0;
+  base.anchorRefMalformed =
+    parsedRef.malformed && clean && base.stampRefOk && base.bodyOk && base.subtreesOk;
   return { result: base, witnessedHex };
 }
 
 /**
- * The range arithmetic (§5.2), and the reason it is a hard check.
- *
- * `buildStampTree` orders a stamp's leaves agent-major, which is the only
- * reason `first_leaf` + `leaf_count` can describe an agent's slice at all: the
- * ranges partition `[0, leaf_count)` exactly, by construction. A body whose
- * ranges do not is either not a stamp this stack built or one built wrong, and
- * in both cases the per-agent claim the ranges exist to support is unfounded.
- *
- * The sum is checked BEFORE the tiling and reports its own message, so a body
- * that is merely short does not get filed under a gap it does not have.
+ * The range arithmetic (§5.2). Leaves are agent-major, so the ranges must
+ * partition `[0, leaf_count)` exactly, or the per-agent slice claims they
+ * support are unfounded. The sum is checked before the tiling so a short body
+ * is not reported as a gap.
  */
 function checkSubtrees(body: StampBody, out: StampResult, errors: string[]): boolean {
   const raw = body.subtrees;
@@ -2172,9 +1988,8 @@ function checkSubtrees(body: StampBody, out: StampResult, errors: string[]): boo
       errors.push(`sub-tree ${ref} first_leaf is not a non-negative integer`);
       shapeOk = false;
     }
-    // A zero-leaf sub-tree is not a slice of anything, and admitting one lets
-    // an arbitrary number of empty ranges sit inside a tiling that still adds
-    // up.
+    // A zero-leaf range is a slice of nothing, and empty ranges could pad a
+    // tiling that still adds up.
     if (subCount === null || subCount === 0) {
       errors.push(`sub-tree ${ref} leaf_count is not a positive integer`);
       shapeOk = false;
@@ -2198,9 +2013,7 @@ function checkSubtrees(body: StampBody, out: StampResult, errors: string[]): boo
   const total = out.leafCount;
   if (total === null) return false; // already reported by the caller
 
-  // Summed exactly. Each count is a safe integer but their sum need not be,
-  // and a float sum past 2**53 prints a different number than Python's
-  // unbounded one in the sentence below.
+  // Summed exactly: the sum can pass 2**53 and must print as Python's does.
   const sum = subtrees.reduce((n, s) => n + BigInt(s.leafCount), 0n);
   if (sum !== BigInt(total)) {
     errors.push(
@@ -2223,10 +2036,21 @@ function checkSubtrees(body: StampBody, out: StampResult, errors: string[]): boo
   return true;
 }
 
+// `sanning.stamp.trace/v1`: the Sanning-signed interval stamp (§5.2).
+//
+// A stamp has no producer signature and no second Sanning signature in the
+// bundle: "Sanning signed this" is the wrapper signature, and the witness on a
+// chain is what makes it evidence. So an unwitnessed stamp holds the bundle at
+// `partial`. Offline, this checks the stamp against its witnessed bytes:
+//
+//   1. `stamp_ref` is SHA-256 of the decoded bytes.
+//   2. The bytes parse and re-canonicalize to themselves under JCS.
+//   3. Their `stamp_version` is the one this body type pins.
+//   4. The sub-tree ranges tile the stamp's leaves exactly: per-agent slice
+//      claims rest on that, and nothing else in the stack would notice.
 async function verifyStampTrace(
   b: EvidenceBundle,
   specVersionOk: boolean,
-  assertedStatus: string | null,
   errors: string[],
   options: VerifyEvidenceOptions,
 ): Promise<EvidenceBundleResult> {
@@ -2244,13 +2068,8 @@ async function verifyStampTrace(
     witnessed.push(outcome.witnessedHex);
   }
 
-  // --- The optional on-chain re-fetch (§5.2.4's "online act") ---------------
-  //
-  // The SAME stamps[] array §5.3 carries, so it gets the same capability. The
-  // alternative — a stamp that can be re-fetched inside one body and not the
-  // other — asks every consumer to remember which wrapper it is holding before
-  // it can trust `onChain: null`, and that is exactly the kind of per-body
-  // exception a reader eventually gets wrong.
+  // The optional on-chain re-fetch (§5.2.4), shared with §5.3 so `onChain:
+  // null` means the same thing in both bodies.
   const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(
     stamps,
     witnessed,
@@ -2258,38 +2077,31 @@ async function verifyStampTrace(
     errors,
   );
 
-  // --- Rollup ----------------------------------------------------------------
+  // Rollup.
   const anyHardFailure = stamps.some((s) => !s.ok);
   const anyUnwitnessed = stamps.some((s) => s.anchorRef === null);
 
+  // A lookup that did not settle is said here and moves nothing (the witness line says it).
+  pushRefetchGapNotes(errors, "stamps", {
+    unavailable: gatewayUnavailable,
+    kind: uncheckedKind,
+    id: uncheckedId,
+  });
   let status: EvidenceStatus;
   if (anyHardFailure) {
     status = "failed";
   } else if (stamps.length === 0) {
-    // A bundle asserting nothing. Not a failure — nothing here is wrong — but
-    // it must never read `verified`, which a caller would take as a witness it
-    // does not have.
-    status = "partial";
+    // Asserts nothing: not a failure, but never `verified`.
+    status = "incomplete";
     errors.push(`${STAMP_TRACE_BODY_TYPE} body carries no stamps`);
-  } else if (gatewayUnavailable || uncheckedKind || uncheckedId || anyUnwitnessed) {
-    // Both hold the bundle at `partial`, and both get said — see §5.3's rollup
-    // for why one note is not enough when there are two different gaps.
-    status = "partial";
-    pushRefetchGapNotes(errors, "stamps", {
-      unavailable: gatewayUnavailable,
-      kind: uncheckedKind,
-      id: uncheckedId,
-    });
-    if (anyUnwitnessed) {
-      // The honest half of P-10, one layer up. A stamp with no `anchor_ref` is
-      // sealed and unwitnessed: `retained-by-sanning`, which is a statement
-      // about our coverage and never an accusation about their evidence. It is
-      // also not `verified`, because for a stamp the witness is the entire
-      // independent part — unlike an anchor-trace checkpoint, which still
-      // carries a producer signature and an inclusion proof that stand on
-      // their own offline.
+  } else if (anyUnwitnessed) {
+    status = "incomplete";
+    {
+      // A stamp with no `anchor_ref` is sealed and unwitnessed: a statement
+      // about Sanning's coverage, never an accusation. Not `verified` either:
+      // for a stamp the witness is the whole independent part.
       errors.push(
-        "one or more stamps carries no anchor_ref — sealed by Sanning, witnessed by nobody",
+        "one or more stamps carries no anchor_ref: sealed by Sanning, witnessed by nobody",
       );
     }
   } else {
@@ -2305,31 +2117,19 @@ async function verifyStampTrace(
     onChainChecked,
     checkpoints: [],
     events: [],
-    assertedStatus,
     stamps,
     errors,
   };
 }
 
-// ===========================================================================
-// `sanning.stamp.evidence/v2`: the two halves, bound (evidence-bundle.md §5.3)
-//
-// The stamp half is §5.2's code unchanged (`verifyStampEntry`, which carries
-// the sub-tree partition check). The event half reuses the same primitives the
-// anchor-trace path uses — `verifyEnvelope`, `verifyInclusion`, `leafHash`,
-// `verifyDisclosedContent` — because a second copy of Merkle verification is a
-// second place for it to drift.
-//
-// What differs, and only this: the join. An event resolves `inclusion.stamp_ref`
-// to a stamps[] entry and walks its audit path to the root committed INSIDE
-// that stamp's witnessed bytes. There is no `merkle_root` field on the event to
-// read instead — repeating the root beside its own authoritative bytes would be
-// two answers to one question inside one signature (§5.1.2).
-// ===========================================================================
+// `sanning.stamp.evidence/v2`: both halves, bound (evidence-bundle.md §5.3).
+// The stamp half is `verifyStampEntry`; the event half reuses the anchor-trace
+// primitives. Only the join differs: an event resolves `inclusion.stamp_ref`
+// and walks to the root inside that stamp's witnessed bytes. There is no
+// `merkle_root` on the event, which would be a second answer (§5.1.2).
 async function verifyStampEvidence(
   b: EvidenceBundle,
   specVersionOk: boolean,
-  assertedStatus: string | null,
   errors: string[],
   options: VerifyEvidenceOptions,
 ): Promise<EvidenceBundleResult> {
@@ -2342,7 +2142,7 @@ async function verifyStampEvidence(
     );
   }
 
-  // --- The stamp half: §5.2's rules, §5.2's code ----------------------------
+  // The stamp half.
   const seen = new Set<string>();
   const stamps: StampResult[] = [];
   const witnessed: (string | undefined)[] = [];
@@ -2352,31 +2152,32 @@ async function verifyStampEvidence(
     witnessed.push(outcome.witnessedHex);
   }
 
-  // The join table. ONLY a stamp whose derived ref and witnessed bytes both
-  // checked out is joinable: a root read out of bytes that failed their own
-  // verification is not a root anyone should walk a proof to, and admitting one
-  // would let a broken stamp lend its authority to an event.
+  // Only a stamp whose derived ref and witnessed bytes both checked out is
+  // joinable: a failed stamp must not lend its root to an event.
   const byRef = new Map<string, StampResult>();
   for (const st of stamps) {
     if (st.stampRef && st.stampRefOk && st.bodyOk) byRef.set(st.stampRef, st);
   }
+  // Every ref a stamp entry claims or derives. A ref outside it names a stamp the pack
+  // does not hold, which is a stamp missing, never a stamp proven wrong (section 5.3.3
+  // rule 1).
+  const heldRefs = new Set<string>();
+  for (const st of stamps) if (st.stampRef) heldRefs.add(st.stampRef);
+  for (const raw of body.stamps as unknown[]) {
+    if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
+      const claimed = (raw as Record<string, unknown>).stamp_ref;
+      if (typeof claimed === "string") heldRefs.add(claimed);
+    }
+  }
 
-  // --- The event half -------------------------------------------------------
+  // The event half.
   const eventResults: EventResult[] = [];
+  const agentItems: (AgentHeldRecord | null)[] = [];
   for (const rawEv of body.events) {
     const evErrors: string[] = [];
-    // A verifier must never RAISE on adversarial input — a caller handed a
-    // stack trace instead of a verdict cannot tell a malformed pack from a
-    // broken tool. `events[]` is attacker-shaped, so a null/non-object entry
-    // is coerced to an empty event and fails through the normal path, exactly
-    // as the Python kernel does. Found by adversarial review, not by the
-    // cross-kernel leg — whose cases did not include one, and now do.
+    // `events[]` is attacker-shaped; a verifier never raises on it.
     if (rawEv === null || typeof rawEv !== "object" || Array.isArray(rawEv)) {
-      // NOT an event. Graded and reported as such rather than coerced to an
-      // empty one: probing verifyEnvelope with nothing asks the envelope layer
-      // a question about an object that was never an envelope, and the two
-      // kernels answer it differently (undetermined vs failed) — a real
-      // divergence, but not this body's to resolve. Reported separately.
+      // Graded as not an event, never coerced to an empty one.
       eventResults.push({
         eventId: "<unknown>",
         envelopeOk: false,
@@ -2386,34 +2187,23 @@ async function verifyStampEvidence(
         contentOk: null,
         ok: false,
         errors: ["events[] entry is not an object"],
+        agent: null,
       });
+      agentItems.push(null);
       continue;
     }
     const ev = rawEv as StampEvidenceEvent;
     const eventId = getEventId(ev.envelope);
     let envelopeOk = false;
+    let envelopeFaults: EnvelopeFault[] = [];
     let payloadBindingOk: boolean | null = null;
 
-    // A retired field name under this major is a reject, never an ignored
-    // unknown field: ignored, it reads as a withheld record (W-3).
+    // A retired field name is a reject: ignored, it would read as withheld.
     const legacyError = legacyEventBytesError(ev, "event", STAMP_EVIDENCE_BODY_TYPE);
     if (legacyError !== null) evErrors.push(legacyError);
 
-    // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
-    //
-    // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
-    // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
-    // line down. So an event carrying garbage in place of its record used to
-    // reach the same tri-state as an event carrying nothing: `payloadHashOk`
-    // null, `ok` true, a leading tick on the line, and a `verified` rollup over
-    // a record nobody could read. The only thing wrong with the pack was the
-    // bytes, and it was the one thing the verdict did not say.
-    //
-    // A record the producer chose not to disclose is the customer exercising
-    // minimum disclosure. A record that is present and unreadable is a defect
-    // in the artifact, and this kernel's standing rule (the same one
-    // `checkpoints[]` already applies through `keyed.errors`) is that a defect
-    // we can see fails.
+    // Malformed is a failure; absent is undetermined. Undecodable `event_bytes`
+    // would otherwise look exactly like a withheld record and verify.
     let eventBytes: Uint8Array | undefined;
     let eventBytesMalformed = false;
     try {
@@ -2422,10 +2212,10 @@ async function verifyStampEvidence(
       eventBytesMalformed = true;
       evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
     }
-    const duplicate = recordDuplicateKey(eventBytes);
-    if (duplicate !== undefined) {
+    const notJson = recordNotJson(eventBytes);
+    if (notJson !== undefined) {
       eventBytesMalformed = true;
-      evErrors.push(`event record is not JSON: ${duplicate}`);
+      evErrors.push(notJson);
     }
     try {
       const res = await verifyEnvelope(
@@ -2433,16 +2223,12 @@ async function verifyStampEvidence(
         eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
       const hexError = envelopeHexError("event", ev.envelope);
-      // tolerates an undetermined binding (withheld record)
+      // Tolerates an undetermined binding (withheld record).
       envelopeOk = res.ok && hexError === null;
+      envelopeFaults = eventEnvelopeFaults(res.faults, hexError);
       payloadBindingOk = res.payloadHashOk;
-      // P-10: report what could not be determined, never a fault that was never
-      // observed. There is no envelope here, so no signature was checked and no
-      // binding was attempted. "signature failed" named a check that never ran,
-      // and it was the only thing said about an event whose undetermined
-      // binding then rendered as a WITHHELD record, a claim about the
-      // producer's disclosure choice out of an input that says nothing about
-      // the producer at all (proof#76).
+      // No envelope, so no signature was checked: report it as malformed, not as
+      // a failed signature or a withheld record.
       if (!isJsonObject(ev.envelope)) {
         evErrors.push("event envelope is not a JSON object");
       } else if (hexError !== null) {
@@ -2451,24 +2237,23 @@ async function verifyStampEvidence(
         evErrors.push("event envelope signature failed");
       }
       if (res.payloadHashOk === false) evErrors.push("event record does not bind to payload_hash");
-      // A malformed skeleton field fails the envelope with a valid signature
-      // and binding (proof#95), so without this the event fails with no reason.
+      // Name a malformed skeleton field, which fails an otherwise valid envelope.
       for (const m of res.errors) if (m.startsWith("malformed ")) evErrors.push(`event envelope ${m}`);
+      if (res.errors.some((m) => m.startsWith("missing payload_hash"))) evErrors.push("event envelope missing payload_hash");
       const specFinding = specVersionFinding("event", ev.envelope, res);
       if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
       evErrors.push(`event envelope verify error${thrownDetail(e)}`);
     }
 
-    // --- The join (§5.3.3 rule 1) -------------------------------------------
+    // The join (§5.3.3 rule 1).
     const incl = ev.inclusion as (StampEvidenceInclusion & Record<string, unknown>) | undefined;
     let st: StampResult | undefined;
+    let stampAbsent = false;
     if (!incl || typeof incl !== "object") {
       evErrors.push("event missing inclusion proof");
     } else if (incl.checkpoint_ref !== undefined || incl.checkpoint_tx_id !== undefined) {
-      // One bundle speaks one vocabulary. An inclusion carrying an anchor-trace
-      // join key inside this body is a mixed bundle, and resolving it anyway is
-      // how an event silently binds to something nobody meant (§5.1.2).
+      // An anchor-trace join key inside this body is a mixed bundle (§5.1.2).
       evErrors.push(
         `event inclusion carries an anchor-trace join key in a ${STAMP_EVIDENCE_BODY_TYPE} body`,
       );
@@ -2476,9 +2261,14 @@ async function verifyStampEvidence(
       evErrors.push("event inclusion missing stamp_ref");
     } else {
       st = byRef.get(incl.stamp_ref);
-      if (st === undefined) {
-        // Hard reject, never undetermined: without a resolved stamp the
-        // inclusion proof has no root to check against at all.
+      if (st === undefined && !heldRefs.has(incl.stamp_ref)) {
+        // The pack does not hold the stamp the record names: the inclusion has no root to
+        // check against, so `witnessed` is not proven (`missing`).
+        stampAbsent = true;
+        evErrors.push(
+          `event inclusion.stamp_ref ${JSON.stringify(incl.stamp_ref)} names a stamp this pack does not hold`,
+        );
+      } else if (st === undefined) {
         evErrors.push(
           `event inclusion.stamp_ref ${JSON.stringify(incl.stamp_ref)} resolves to no verified stamp`,
         );
@@ -2488,15 +2278,9 @@ async function verifyStampEvidence(
 
     let inclusionOk = false;
     if (incl && stampBound && st) {
-      // Rule 3: the tree walked must be the tree the stamp committed to. A
-      // proof walked against a different leaf_count is a proof about a
-      // different tree, and RFC 9162's path shape depends on the size.
-      //
-      // Read BY VALUE, as the anchor-trace path reads them (A38), and as the
-      // Python kernel does (`_safe_integer`): the wrapper signs JCS(body),
-      // which writes `3.0` as `3`, so a stated `3.0` is 3 under the same
-      // signature. Anything that is not a safe integer is malformed, with a
-      // sentence that prints no value.
+      // Rule 3: the tree walked must be the tree the stamp committed to; RFC
+      // 9162's path shape depends on the size. Read by value, as JCS signs it
+      // (`3.0` is 3); anything not a safe integer is malformed.
       const statedCount = safeInteger(incl.leaf_count);
       const statedIndex = safeInteger(incl.leaf_index);
       if (statedCount === null) {
@@ -2521,9 +2305,7 @@ async function verifyStampEvidence(
             evErrors.push("RFC 9162 inclusion proof did not reconstruct the stamp root");
           }
 
-          // Defense in depth, as §5.1: the claimed leaf MUST be this event's
-          // own signed envelope bytes, or a valid proof for an UNRELATED leaf
-          // could be smuggled in.
+          // As §5.1: the claimed leaf must be this event's own signed envelope.
           const expectedLeafHex = toHex(await leafHash(utf8(jcs(ev.envelope))));
           if (expectedLeafHex !== (incl.leaf_hash ?? "").toLowerCase()) {
             inclusionOk = false;
@@ -2540,17 +2322,19 @@ async function verifyStampEvidence(
     const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
     const contentOk = contentRes.contentOk;
     evErrors.push(...contentRes.errors);
+    agentItems.push(
+      agentItem(ev, eventBytes, envelopeOk && payloadBindingOk === true && !eventBytesMalformed),
+    );
 
     eventResults.push({
       eventId,
       envelopeOk,
       payloadBindingOk,
       inclusionOk,
-      // Named for §5.1's join; here it reports whether `stamp_ref` resolved.
+      // Here: whether `stamp_ref` resolved.
       checkpointBound: stampBound,
       contentOk,
-      // `!eventBytesMalformed`: present-and-unreadable record bytes are a
-      // defect in the artifact, never a disclosure choice (proof#85).
+      // Unreadable record bytes are a defect, never a disclosure choice.
       ok:
         envelopeOk &&
         inclusionOk &&
@@ -2559,10 +2343,19 @@ async function verifyStampEvidence(
         legacyError === null &&
         !eventBytesMalformed,
       errors: evErrors,
+      agent: null,
+      envelopeFault: envelopeFaults[0] ?? null,
+      envelopeFaults,
+      recordNotJson: notJson !== undefined && envelopeOk && payloadBindingOk === true,
+      contentUnsigned: contentOk === false && contentRes.unsigned,
+      stampAbsent,
+      ownFormFailed: legacyError !== null || eventBytesMalformed,
     });
   }
 
-  // --- The optional on-chain re-fetch (§5.2.4's "online act") ---------------
+  await attachAgentReadings(eventResults, agentItems);
+
+  // The optional on-chain re-fetch (§5.2.4).
   const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(
     stamps,
     witnessed,
@@ -2570,49 +2363,39 @@ async function verifyStampEvidence(
     errors,
   );
 
-  // --- Rollup ---------------------------------------------------------------
-  // Rule 4: a declared event MUST be checked. `events[]` present and unverified
-  // is the false green this body exists to prevent, so an event that did not
-  // verify fails the bundle — it is never rolled up as verified.
-  const anyHardFailure = stamps.some((st) => !st.ok) || eventResults.some((e) => !e.ok);
+  // Rollup. Rule 4: a declared event must be checked, so an event that did
+  // not verify fails the bundle.
+  const anyHardFailure =
+    stamps.some((st) => !st.ok) || eventResults.some((e) => !e.ok && !unproven(e));
   const anyUnwitnessed = stamps.some((st) => st.anchorRef === null);
+  const anyStampAbsent = eventResults.some((e) => e.stampAbsent === true);
 
+  pushRefetchGapNotes(errors, "stamps", {
+    unavailable: gatewayUnavailable,
+    kind: uncheckedKind,
+    id: uncheckedId,
+  });
   let status: EvidenceStatus;
   if (anyHardFailure) {
     status = "failed";
   } else if (stamps.length === 0 && eventResults.length === 0) {
-    status = "partial";
+    status = "incomplete";
     errors.push(`${STAMP_EVIDENCE_BODY_TYPE} body carries no stamps and no events`);
-  } else if (
-    eventResults.length === 0 ||
-    gatewayUnavailable ||
-    uncheckedKind ||
-    uncheckedId ||
-    anyUnwitnessed
-  ) {
-    // Each holds the bundle at `partial`, and EACH gets said. A pack with no
-    // events, a stamp nobody witnessed and a witness we could not reach are
-    // different gaps with different fixes, and an auditor told only about one
-    // would read the others as fine. The order is fixed so the two kernels
-    // emit the same list.
-    status = "partial";
+  } else if (eventResults.length === 0 || anyUnwitnessed || anyStampAbsent || eventResults.some(unproven)) {
+    // Each gap holds the bundle at `incomplete` and each is named, in a fixed order
+    // so both kernels emit the same list.
+    status = "incomplete";
     if (eventResults.length === 0) {
-      // §5.3.2: an events-empty body is exactly a §5.2 stamp trace, and is
-      // partial, never verified. It says nothing about any event.
+      // Section 5.3.2: an events-empty body is a section 5.2 stamp trace: incomplete, never
+      // verified.
       errors.push(
         `${STAMP_EVIDENCE_BODY_TYPE} body carries no events -- it evidences no event, only its stamps`,
       );
     }
-    pushRefetchGapNotes(errors, "stamps", {
-      unavailable: gatewayUnavailable,
-      kind: uncheckedKind,
-      id: uncheckedId,
-    });
     if (anyUnwitnessed) {
-      // §5.3.3 rule 6, inherited whole from §5.2.4: for a stamp the witness IS
-      // the independent part, so the events resting on it inherit `partial`.
+      // Section 5.3.3 rule 6: events resting on an unwitnessed stamp inherit `incomplete`.
       errors.push(
-        "one or more stamps carries no anchor_ref — sealed by Sanning, witnessed by nobody",
+        "one or more stamps carries no anchor_ref: sealed by Sanning, witnessed by nobody",
       );
     }
   } else {
@@ -2628,7 +2411,6 @@ async function verifyStampEvidence(
     onChainChecked,
     checkpoints: [],
     events: eventResults,
-    assertedStatus,
     stamps,
     errors,
   };
@@ -2636,37 +2418,10 @@ async function verifyStampEvidence(
 
 /**
  * The optional on-chain re-fetch over `stamps[]`, shared by §5.2 and §5.3.
- *
- * ── Why the results land on `stamps[]` and `checkpoints` stays empty ──
- *
- * A stamp body carries no checkpoints. Synthesising `CheckpointResult`s to
- * carry these outcomes would make a stamp indistinguishable from a checkpoint
- * in every consumer that reads `checkpoints[]` — the exact conflation §5.2.1
- * and §5.3.1 refused twice, most sharply in "a Sanning attestation
- * indistinguishable on the wire from a producer's". They are different
- * artifacts with different signers and different meanings when absent, and a
- * reader must never have to guess which one it is holding. So the stamp
- * results go on the stamps, and `checkpoints: []` keeps saying the true thing:
- * this body has none.
- *
- * ── Why an unwitnessed stamp gets `onChain: null` and NOT all-unreachable ──
- *
- * The anchor-trace path synthesises an all-`unreachable` result for a
- * checkpoint with no `anchor_ref`. That is not copied here, for two reasons.
- *
- * It would be untrue: nothing was asked of any gateway, so reporting that
- * every gateway failed to answer invents a network event. "Not checked" and
- * "we asked and nobody answered" are different facts, and collapsing them is
- * precisely the defect that had a surface reporting an unreachable gateway
- * when it had contacted none.
- *
- * And it would be load-bearing in the wrong direction. Over there the
- * synthesis exists to drive `gatewayUnavailable`, which is what downgrades that
- * run to `partial`. Here §5.2.4 already downgrades an unwitnessed stamp to
- * `partial` on its own, with a better error. Copying the synthesis would add
- * nothing to the status, which is `partial` either way, and would add an
- * unreachable-gateway note for a network event that never happened, based on
- * nothing but whether the caller happened to pass a gateway list.
+ * Results land on the stamps and `checkpoints` stays empty: a stamp must never
+ * be mistaken for a producer checkpoint. An unwitnessed stamp gets `onChain:
+ * null`, not a synthesized all-unreachable result: no gateway was asked, and
+ * §5.2.4 already holds it at `partial`.
  */
 async function refetchStamps(
   stamps: StampResult[],
@@ -2693,8 +2448,7 @@ async function refetchStamps(
   for (let i = 0; i < stamps.length; i++) {
     const st = stamps[i]!;
     const witnessedHex = witnessed[i];
-    // No witness named, or bytes we could not read: nothing to re-fetch, and
-    // nothing a gateway could confirm or deny. Left as `onChain: null`.
+    // No witness named, or unreadable bytes: nothing to re-fetch.
     if (st.anchorRef === null || witnessedHex === undefined) continue;
     if (st.anchorRef.kind === SIMULATED_WITNESS_KIND) simulated++;
     else onChainKinds++;
@@ -2706,22 +2460,13 @@ async function refetchStamps(
     if (outcome.unchecked === "kind") uncheckedKind = true;
     if (outcome.unchecked === "id") uncheckedId = true;
     if (outcome.error) st.errors.push(outcome.error);
-    // Fold the on-chain dimension in exactly as a checkpoint does: a MISMATCH
-    // (false) fails the stamp — the chain does not hold what the bundle says
-    // was witnessed. UNREACHABLE (null) leaves an offline-sound stamp ok and
-    // downgrades the run to `partial` via gatewayUnavailable. A confirm (true)
-    // changes nothing that was not already true offline.
-    //
-    // `st.ok` is kept and narrowed rather than recomputed: its offline form
-    // includes `errors.length === 0`, and re-evaluating that AFTER pushing an
-    // unreachable note would fail a stamp for a gateway being down.
+    // As for a checkpoint: a mismatch fails the stamp, unreachable downgrades
+    // the run to `partial`. Narrowed, not recomputed, so an unreachable note
+    // does not fail the stamp.
     st.ok = st.ok && st.onChainOk !== false;
   }
-  // A simulated witness is a sandbox plane's stand-in for a chain: there is no
-  // chain to look it up on, so it is never counted as checked on one.
-  // It stays not checked like any kind this verifier has no adapter for, and
-  // the run stays undetermined; what changes is that a run whose only
-  // witnesses are simulated no longer says it checked anything on a chain.
+  // A simulated witness has no chain to look up, so it is never counted as
+  // checked on one; the run stays undetermined.
   if (simulated > 0 && onChainKinds === 0) {
     return { onChainChecked: false, gatewayUnavailable, uncheckedKind, uncheckedId };
   }
@@ -2742,78 +2487,54 @@ interface StampRefetchSummary {
   uncheckedId: boolean;
 }
 
-// ===========================================================================
-// Ingest: materializing the disclosed raw bytes (evidence-bundle.md §5.1).
-//
-// The receiving half of a handoff. `events[].content` rides as lowercase hex
-// (JSON cannot carry arbitrary bytes), and until now every consumer that wanted
-// the actual log bytes back had to know that and decode them itself —
-// re-implementing an encoding convention the kernel already applies internally.
-// A consumer that copied `content` VERBATIM into a file shipped packs that
-// failed verification on genuine, untampered evidence, because the hash of the
-// hex text is not the hash of the bytes it encodes.
-//
-// `disclosedContent` closes that gap with one rule: bytes come back only when
-// they are BOUND. It verifies the bundle first and hands back a decoded
-// Uint8Array only for events whose whole chain held AND whose disclosed bytes
-// hash to the committed `content_hash`. Everything else comes back as a status
-// with a reason and NO bytes — in particular a minimal-disclosure event reports
-// `not_disclosed` rather than empty bytes, because a caller that cannot tell
-// those apart writes an empty log file and believes it succeeded.
-// ===========================================================================
+// Ingest (evidence-bundle.md §5.1): `events[].content` rides as hex, and
+// `disclosedContent` hands back decoded bytes only when they are bound: the
+// event's chain held and the bytes hash to the committed `content_hash`.
+// Everything else returns a status with a reason and no bytes; minimal
+// disclosure is `not_disclosed`, never empty bytes.
 
 // Per-event outcome of an ingest attempt. Only `verified` carries bytes.
 export type DisclosureStatus =
-  | "verified" // bytes decoded AND bound to the committed content_hash
-  | "not_disclosed" // nothing disclosed for this event — minimal disclosure, nothing to write
-  | "undetermined" // bytes disclosed but nothing to bind them to (record withheld / no commitment)
-  | "failed"; // the event's chain did not verify, or the disclosure did not bind/decode
+  | "verified" // decoded and bound to the committed content_hash
+  | "not_disclosed" // nothing disclosed: minimal disclosure
+  | "undetermined" // disclosed, but nothing to bind to
+  | "failed"; // the event did not verify, or the disclosure did not bind or decode
 
 export interface DisclosedEventContent {
   eventId: string;
   status: DisclosureStatus;
-  // The decoded raw bytes. Non-null ONLY when status === "verified" — an
-  // unbound or unverified disclosure is withheld, never handed back.
+  // Non-null only when status is "verified": unbound bytes are never handed back.
   bytes: Uint8Array | null;
-  // Why, whenever bytes are absent for a reason other than plain non-disclosure.
+  // Why, when bytes are absent for a reason other than non-disclosure.
   errors: string[];
 }
 
 export interface DisclosedContentResult {
   // The bundle-level rollup, verbatim from verifyEvidenceBundle.
   status: EvidenceStatus;
-  // The full verification result, so a caller verifies ONCE: render the verdict
-  // from this and materialize from `content` in the same pass.
+  // The full result, so a caller verifies once and renders from it.
   verification: EvidenceBundleResult;
   // One entry per event in the bundle body, in body order.
   events: DisclosedEventContent[];
-  // event_id → verified raw bytes: the materialization map. Contains ONLY
-  // entries whose status is "verified", so `for (const [id, bytes] of
-  // result.content)` is always safe to write straight to disk.
+  // event_id to verified bytes. Only "verified" entries, so it is always safe
+  // to write straight to disk.
   content: Map<string, Uint8Array>;
   // Bundle-level reasons no content could be materialized at all.
   errors: string[];
 }
 
-// How many `sanning.evidence.export/v2` wrappers deep the source bundle may be
-// nested before this path gives up. verifyEvidenceBundle's canonicalization
-// depth bound already rejects a pathological bundle, but the unwrap must be
-// independently bounded rather than trusting that it ran first.
+// How many export wrappers deep the source bundle may nest. Bounded here
+// independently of the canonicalization depth bound.
 const MAX_EXPORT_UNWRAP = 4;
 
 /**
- * Materialize the disclosed raw bytes of a received bundle (evidence-bundle §5.1).
- *
- * Verify-then-return: the bundle is verified with {@link verifyEvidenceBundle}
- * (same options — gateways, out-of-band `content`, `fetchImpl`), and an event's
- * bytes are returned ONLY when that verification bound them to the committed
- * `content_hash`. There is no path through this function that yields bytes
- * whose SHA-256 is not the commitment.
+ * Materialize the disclosed raw bytes of a received bundle (evidence-bundle.md
+ * §5.1). The bundle is verified with {@link verifyEvidenceBundle}, and an
+ * event's bytes are returned only when that verification bound them to the
+ * committed `content_hash`.
  *
- * Returns `Uint8Array`, never a string: the spec commits to raw bytes, and a
- * UTF-8 decode is lossy for any payload that is not valid UTF-8 — re-encoding
- * such a string would produce different bytes and a different hash. Callers who
- * know their payload is text decode it themselves and own that assumption.
+ * Returns `Uint8Array`, never a string: a UTF-8 decode is lossy and would
+ * change the hash.
  */
 export async function disclosedContent(
   bundle: unknown,
@@ -2841,11 +2562,9 @@ export async function disclosedContent(
     return empty();
   }
 
-  // Fail closed on any drift between the body we are decoding and the results
-  // we are trusting. Both must be the same events in the same order, or the
-  // "these bytes are the bytes that verified" guarantee is void — which is the
-  // only guarantee this function makes. A broken wrapper lands here too:
-  // verifyEvidenceBundle returns zero event results, so nothing is emitted.
+  // Fail closed unless the decoded body and the trusted results are the same
+  // events in the same order. A broken wrapper yields zero results, so nothing
+  // is emitted.
   if (traceEvents.length !== verification.events.length) {
     errors.push(
       "the bundle did not verify far enough to materialize content: " +
@@ -2874,18 +2593,16 @@ export async function disclosedContent(
     let status: DisclosureStatus;
 
     if (!res.ok || res.contentOk === false) {
-      // The event itself is not trustworthy (bad signature, broken inclusion,
-      // unbound checkpoint) or its disclosure contradicts the commitment.
+      // The event is not trustworthy, or its disclosure contradicts the commitment.
       status = "failed";
       evErrors.push(
         res.contentOk === false
-          ? "disclosed content does not bind to the committed content_hash — withheld"
-          : "the event's own proof chain did not verify — nothing here is safe to materialize",
+          ? "disclosed content does not bind to the committed content_hash; withheld"
+          : "the event's own proof chain did not verify; nothing here is safe to materialize",
       );
       evErrors.push(...res.errors);
     } else if (!selection.offered) {
-      // Minimal disclosure: the committed hash is there, the bytes are not.
-      // Distinct from empty bytes, and never an error.
+      // Minimal disclosure: distinct from empty bytes, and never an error.
       status = "not_disclosed";
     } else if (bytes === undefined) {
       status = "failed";
@@ -2894,12 +2611,10 @@ export async function disclosedContent(
       );
       evErrors.push(...selection.errors);
     } else if (res.contentOk !== true) {
-      // Disclosed and decodable, but there is no commitment to check it against
-      // (withheld record, or a record committing no content_hash). Unbound
-      // bytes are exactly what a consumer must not silently write out.
+      // Nothing to check the bytes against: unbound bytes must not be written.
       status = "undetermined";
       evErrors.push(
-        "disclosed bytes are not bound to any committed content_hash — withheld rather than returned",
+        "disclosed bytes are not bound to any committed content_hash; withheld rather than returned",
       );
       evErrors.push(...res.errors);
     } else {
@@ -2911,7 +2626,7 @@ export async function disclosedContent(
       if (content.has(res.eventId)) {
         errors.push(
           `duplicate event_id ${JSON.stringify(res.eventId)}: the content map keeps the first ` +
-            "occurrence — read events[] for every event",
+            "occurrence; read events[] for every event",
         );
       } else {
         content.set(res.eventId, bytes);
@@ -2928,35 +2643,18 @@ export async function disclosedContent(
   return { status: verification.status, verification, events, content, errors };
 }
 
-// The events a bundle carries, unwrapping any evidence-export wrapper(s) to
-// the inline source bundle — mirroring how verifyEvidenceBundle recurses into
-// `source_bundle`, so the events line up with its results.
-// `undefined` when the bundle carries no events this reader understands, which
-// a caller must distinguish from a body that has events and no links.
-//
-// BOTH event-carrying bodies, not just anchor-trace (proof#73): §5.3's
-// `sanning.stamp.evidence/v2` is the hand-over pack, and it presents the same
-// event shape.
-//
-// Exported for `chain.ts`, which needs the same descent and must not derive it
-// again: two answers to "which events is this bundle actually about" inside one
-// kernel is two implementations of one rule, and the one that drifted would be
-// the one nobody was looking at. Deliberately NOT re-exported from `index.ts` —
-// same posture as `side-content.ts`, internal and shared.
+// The events a bundle carries, through any export wrappers to the inline
+// source, as `verifyEvidenceBundle` recurses, so they line up with its results.
+// Both event-carrying bodies (anchor trace and §5.3 stamp evidence). `undefined`
+// when the bundle carries no events this reader understands. Exported for
+// `chain.ts`, so there is one answer to which events a bundle is about; not
+// re-exported from `index.ts`.
 export function resolveTraceEvents(bundle: unknown): TraceEvent[] | undefined {
   let cur: unknown = bundle;
   for (let depth = 0; depth < MAX_EXPORT_UNWRAP; depth++) {
     if (cur === null || typeof cur !== "object" || Array.isArray(cur)) return undefined;
     const b = cur as EvidenceBundle;
     const bodyType = typeof b.body_type === "string" ? b.body_type : null;
-    // Both event-carrying bodies, not just anchor-trace (proof#73). §5.3's
-    // `sanning.stamp.evidence/v2` presents the SAME event shape (a
-    // producer-signed envelope, optional `event_bytes`, an inclusion proof),
-    // and it is the HAND-OVER PACK: the only artifact an auditor is ever
-    // handed. Dispatching on anchor-trace alone meant `readChains` reported
-    // zero chains on every pack, however well-formed the links inside its
-    // records were, so "is it in order?" read as NOT CHECKED on the one shape
-    // that matters. The writers have been emitting those links the whole time.
     if (
       bodyType === ANCHOR_TRACE_BODY_TYPE ||
       bodyType === STAMP_EVIDENCE_BODY_TYPE
@@ -2973,26 +2671,20 @@ export function resolveTraceEvents(bundle: unknown): TraceEvent[] | undefined {
   return undefined;
 }
 
-// ===========================================================================
-// Attested-evidence-export verification (evidence-export.md §5, steps 3–9).
-// Reached from verifyEvidenceBundle AFTER the wrapper (Ed25519 issuer signature
-// + body_hash) has already verified (steps 1–2). This composes the existing
-// evidence path (recompute the inline source verdict) with the one new
-// primitive (embedded RSA-PSS operator attestations, verifyRsaPssSha256).
-// ===========================================================================
+// Attested-evidence-export verification (evidence-export.md §5, steps 3 to 9),
+// reached after the wrapper verified. Recomputes the inline source verdict and
+// checks the embedded RSA-PSS operator attestations.
 async function verifyExportBody(
   b: EvidenceBundle,
   specVersionOk: boolean,
-  assertedStatus: string | null,
   errors: string[],
   options: VerifyEvidenceOptions,
 ): Promise<EvidenceBundleResult> {
-  // Malformed-as-an-export (§5 exit 2): a required field is missing or a key is
-  // unparseable — the wrapper verified, but no verdict can be rendered. The
-  // wrapper fields stay true (they DID verify) for any consumer that inspects
-  // them; the CLI's malformed branch shows the errors and exits 2.
+  // The wrapper verified but no verdict can be rendered: unreadable as an export.
+  // The wrapper fields stay true, because they did verify.
   const exportMalformed = (error: string): EvidenceBundleResult => ({
-    status: "malformed",
+    status: "incomplete",
+    unreadable: true,
     specVersionOk,
     bodyHashOk: true,
     signatureOk: true,
@@ -3000,7 +2692,6 @@ async function verifyExportBody(
     onChainChecked: false,
     checkpoints: [],
     events: [],
-    assertedStatus,
     errors: [...errors, error],
   });
 
@@ -3022,14 +2713,13 @@ async function verifyExportBody(
     return exportMalformed("export body missing kernel_verdict");
   }
 
-  // --- Step 3: source-bundle linkage ----------------------------------------
+  // Step 3: source-bundle linkage.
   const inline = body.source_bundle;
   if (inline === undefined || inline === null) {
-    // source_bundle_ref (out-of-line) is not verifiable on a network-isolated
-    // machine unless the referenced bytes are co-delivered — the source-
-    // dependent checks are UNDETERMINED (exit 3), NOT a failure (§5 step 3).
+    // An out-of-line source is not verifiable offline unless co-delivered: the
+    // source-dependent checks are not checked, never failed.
     return {
-      status: "partial",
+      status: "incomplete",
       specVersionOk,
       bodyHashOk: true,
       signatureOk: true,
@@ -3037,11 +2727,10 @@ async function verifyExportBody(
       onChainChecked: false,
       checkpoints: [],
       events: [],
-      assertedStatus,
       errors: [
         ...errors,
-        "source_bundle is not inline (source_bundle_ref) — bytes unavailable offline; " +
-          "source-dependent checks undetermined",
+        "source_bundle is not inline (source_bundle_ref): bytes unavailable offline; " +
+          "source-dependent checks not checked",
       ],
     };
   }
@@ -3059,86 +2748,70 @@ async function verifyExportBody(
     errors.push(`source_bundle canonicalization failed${thrownDetail(e)}`);
   }
 
-  // --- Step 4: recompute the source verdict ---------------------------------
-  // The existing evidence path over the inline source bundle — same primitives
-  // (Ed25519 envelopes, payload binding, RFC 9162 inclusion, merkle roots,
-  // content_ok, and the optional per-gateway on-chain re-fetch, §4.2 / step 7).
+  // Step 4: recompute the source verdict, including the optional re-fetch.
   const sourceResult = await verifyExportSource(inline, options);
 
-  // Attestation data_hash binding (§5 6c).
+  // For the attestation data_hash binding (§5 step 6c).
   const sourceCheckpoints = await indexSourceCheckpoints(inline);
 
-  // --- Step 6: embedded attestation records ---------------------------------
+  // Step 6: embedded attestation records.
   const attestations: AttestationResult[] = [];
   for (const rec of body.attestations) {
     const r = await verifyAttestation(rec, sourceCheckpoints);
     if (r.malformed !== undefined) return exportMalformed(r.malformed);
+    if (typeof r.result.fieldError === "string") errors.push(r.result.fieldError);
     attestations.push(r.result);
   }
 
-  // --- Build the recomputed §4 verdict object -------------------------------
   const verdict = buildVerdictObject(sourceResult, attestations);
   if (typeof b.generated_at === "string") verdict.as_of = b.generated_at;
 
-  // --- Step 5: verdict agreement (DETERMINISTIC dimensions only) ------------
-  // The cached body.kernel_verdict is recompute-don't-trust (principle 3). But
-  // agreement compares ONLY the deterministic, offline-recomputable dimensions:
-  // per-event signature/payload-binding/inclusion/content, per-checkpoint
-  // merkle roots, and per-attestation signature/operator-address/data_hash
-  // binding. The on-chain per-gateway dimension is environment/time-dependent —
-  // the issuer observed it online at compose time; an offline verifier
-  // legitimately sees `null` — so it is INFORMATIONAL and MUST NOT by itself
-  // trigger an exit-1 tamper verdict (the verifier's own on-chain outcomes fold
-  // in at step 7 only if it re-fetches). Advisory rollups (status / counts /
-  // summary / as_of / custody_chain) are derived, not compared. See the §5
-  // step-5 erratum flagged in the slice report.
+  // Step 5: the cached `kernel_verdict` is never trusted, and agreement compares
+  // only the deterministic, offline-recomputable dimensions. The on-chain
+  // dimension depends on when and where it was observed, so it must not by
+  // itself read as tamper. Derived rollups are not compared.
   let verdictAgreementOk = false;
   try {
     const cached = projectVerdictForAgreement(body.kernel_verdict);
     const fresh = projectVerdictForAgreement(verdict);
-    toleratePreA20Content(cached, fresh, sourceEventsGoverned(inline));
+    tolerateUnboundMessageContent(cached, fresh, sourceEventsGoverned(inline));
     const cachedProjection = jcs(cached);
     const freshProjection = jcs(fresh);
     verdictAgreementOk = cachedProjection === freshProjection;
     if (!verdictAgreementOk) {
       errors.push(
         "recomputed verdict disagrees with the cached kernel_verdict " +
-          "(deterministic dimensions) — recompute-don't-trust",
+          "(deterministic dimensions); recompute-don't-trust",
       );
     }
   } catch (e) {
     errors.push(`verdict agreement comparison failed${thrownDetail(e)}`);
   }
 
-  // --- Step 7 already folded in by the source recompute ---------------------
-  // (verifyEvidenceBundle merged per-gateway outcomes into sourceResult.status:
-  // a checkpoint `mismatch` made it "failed"; an all-`unreachable` checkpoint
-  // made it "partial" + an unreachable note → exit 3.)
+  // Step 7 is already folded into `sourceResult.status` by the source recompute.
 
-  // Propagate the source recompute's notes so the auditor — and the CLI's
-  // exit-3 detection (which keys off "unreachable") — see them.
+  // The CLI's exit-3 detection keys off "unreachable" in these notes.
   for (const e of sourceResult.errors) errors.push(`source: ${e}`);
 
-  // --- Step 9: export rollup + exit -----------------------------------------
+  // Step 9: export rollup.
   const anyAttestationFailed = attestations.some((a) => !a.ok);
   let status: EvidenceStatus;
   if (
     !sourceLinkageOk ||
     !verdictAgreementOk ||
     sourceResult.status === "failed" ||
-    sourceResult.status === "malformed" ||
+    sourceResult.unreadable === true ||
     anyAttestationFailed
   ) {
     status = "failed";
-  } else if (sourceResult.status === "partial") {
-    // Undetermined source (a withheld record, or an unreachable gateway):
-    // exit 3 either way since 0.13.0. Never a failure.
-    status = "partial";
+  } else if (sourceResult.status === "incomplete") {
+    // A source not fully checked (a withheld record). Never a failure.
+    status = "incomplete";
   } else {
     status = "verified";
   }
 
-  // The DISPLAYED verdict reflects the full recompute (incl. attestations).
+  // The displayed verdict reflects the full recompute, attestations included.
   verdict.status = status;
   verdict.summary = summarizeExport(status, sourceResult, attestations);
 
@@ -3149,11 +2822,9 @@ async function verifyExportBody(
     signatureOk: true,
     bodyType: EXPORT_BODY_TYPE,
     onChainChecked: sourceResult.onChainChecked,
-    // The top-level per-checkpoint / per-event results ARE the recomputed source
-    // results, so the CLI's existing rendering shows them unchanged.
+    // The recomputed source results, so the CLI renders them unchanged.
     checkpoints: sourceResult.checkpoints,
     events: sourceResult.events,
-    assertedStatus,
     export: {
       sourceLinkageOk,
       sourceStatus: sourceResult.status,
@@ -3161,33 +2832,26 @@ async function verifyExportBody(
       attestations,
       verdict,
       status,
+      // A source whose own wrapper time breaks its format is a source that does not follow
+      // its format, as one that cannot be read is.
+      sourceUnreadable:
+        (sourceResult.unreadable === true || sourceResult.generatedAtMalformed === true) && sourceLinkageOk,
     },
     errors,
   };
 }
 
-// ===========================================================================
-// Compose-side verdict recompute (evidence-export.md §5 steps 4 + 6, minus the
-// wrapper). The `proof export` composer must embed a cached `kernel_verdict`
-// (§4) whose deterministic dimensions BYTE-AGREE with what verifyExportBody will
-// later recompute over the same inline source bundle + attestation records (§5
-// step 5). Rather than reimplement that recompute, this reuses the EXACT verify
-// primitives verifyExportBody uses — verifyEvidenceBundle over the source,
-// verifyAttestation per record, then buildVerdictObject — so the composed cache
-// and the verifier's recompute cannot drift. Offline/pure: no gateways, so the
-// on-chain dimension is null (excluded from agreement anyway, §5 step 5).
-//
-// Throws on a malformed attestation record (unparseable RSA key, wrong
-// signature_alg, missing field) — a composer INPUT error the caller surfaces,
-// mirroring verifyExportBody's malformed→exit-2 for the same conditions.
-// ===========================================================================
+// Compose-side verdict recompute (evidence-export.md §5 steps 4 and 6). The
+// `proof export` composer embeds a cached `kernel_verdict` that must agree with
+// what `verifyExportBody` later recomputes, so it uses the same primitives.
+// Offline: the on-chain dimension is null. Throws on a malformed attestation
+// record, a composer input error.
 export interface ComposeVerdictResult {
-  // The §4 verdict object to embed as body.kernel_verdict (status/summary/as_of
-  // finalized exactly as verifyExportBody would render them).
+  // The §4 verdict to embed as `body.kernel_verdict`, finalized as
+  // `verifyExportBody` renders it.
   verdict: VerdictObject;
-  // The recomputed inline-source-bundle status (verifyEvidenceBundle).
   sourceStatus: EvidenceStatus;
-  // The export rollup status (§4.5 / §5 step 9) — verified | partial | failed.
+  // The export rollup (§5 step 9).
   status: EvidenceStatus;
   // Per-attestation results (each already bound to a source checkpoint).
   attestations: AttestationResult[];
@@ -3201,15 +2865,15 @@ export async function recomputeExportVerdict(
 ): Promise<ComposeVerdictResult> {
   const sourceResult = await verifyExportSource(sourceBundle, options);
 
-  // Attestation data_hash binding (§5 6c) — the SAME index construction as
-  // verifyExportBody, deliberately shared rather than restated.
+  // The same index `verifyExportBody` builds (§5 step 6c).
   const sourceCheckpoints = await indexSourceCheckpoints(sourceBundle);
 
   const attestations: AttestationResult[] = [];
   for (const rec of attestationRecords) {
     const r = await verifyAttestation(rec, sourceCheckpoints);
-    if (r.malformed !== undefined) {
-      throw new Error(`attestation record is malformed: ${r.malformed}`);
+    const malformedField = r.malformed ?? r.result.fieldError ?? undefined;
+    if (malformedField !== undefined) {
+      throw new Error(`attestation record is malformed: ${malformedField}`);
     }
     attestations.push(r.result);
   }
@@ -3217,20 +2881,18 @@ export async function recomputeExportVerdict(
   const verdict = buildVerdictObject(sourceResult, attestations);
   verdict.as_of = generatedAt;
 
-  // Export rollup (§5 step 9). Source linkage and verdict agreement are always
-  // satisfied at compose time (the composer computes the source hash itself and
-  // there is no prior cached verdict to disagree with), so the only failure
-  // inputs here are the recomputed source status and any failed attestation.
+  // Linkage and agreement always hold at compose time, so only the source
+  // status and the attestations can fail the rollup.
   const anyAttestationFailed = attestations.some((a) => !a.ok);
   let status: EvidenceStatus;
   if (
     sourceResult.status === "failed" ||
-    sourceResult.status === "malformed" ||
+    sourceResult.unreadable === true ||
     anyAttestationFailed
   ) {
     status = "failed";
-  } else if (sourceResult.status === "partial") {
-    status = "partial";
+  } else if (sourceResult.status === "incomplete") {
+    status = "incomplete";
   } else {
     status = "verified";
   }
@@ -3240,19 +2902,10 @@ export async function recomputeExportVerdict(
   return { verdict, sourceStatus: sourceResult.status, status, attestations };
 }
 
-// Verify one embedded attestation record (§5 step 6a–d). Returns `malformed`
-// (→ exit 2) for an unparseable RSA key / signature hex or a missing required
-// field; otherwise a per-dimension AttestationResult whose `ok` gates on the
-// three binding checks (sig / operator-address / data_hash). subject_ref is
-// undetermined-tolerant and never gates.
-// The attestation payload fields evidence-export.md §3.1 marks Required, with
-// the type it gives each. A record whose payload lacks one, or carries another
-// type (null included), is malformed: §5 step 9 and §4.5 make "a missing
-// required field" an export the verifier cannot render (exit 2). §5 step 6
-// gates a WELL-FORMED record on signature, operator and data_hash only; these
-// checks decide whether the record is well-formed at all. `level` is the §3.1
-// enum 1 | 2 | 3. The integers are non-negative and within 2**53 - 1 (the
-// §3.1 clarification).
+// The payload fields evidence-export.md section 3.1 requires, with their types. Read only
+// under a signature that verifies: a record then missing one, or carrying another type
+// (null included), is one the issuer signed that does not follow its format (section 4.5,
+// `follows_rules` disproven). `level` is 1, 2 or 3; integers are non-negative safe integers.
 const PAYLOAD_REQUIRED: readonly (readonly [string, "string" | "boolean" | "integer" | "level"])[] = [
   ["attested_at", "string"],
   ["tx_id", "string"],
@@ -3279,7 +2932,6 @@ function payloadFieldError(payload: Record<string, unknown>): string | null {
       ok = typeof v === "boolean";
       want = "a boolean";
     } else if (kind === "integer") {
-      // §3.1 (clarified): a non-negative integer no larger than 2**53 - 1.
       ok = typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
       want = "a non-negative integer";
     } else {
@@ -3288,13 +2940,17 @@ function payloadFieldError(payload: Record<string, unknown>): string | null {
     }
     if (!ok) return `attestation payload field ${JSON.stringify(name)} is missing or not ${want}`;
     if (name === "attested_at" && !isRfc3339UtcInstant(v)) {
-      // evidence-export §3.1 (v3.4): the form `signed_at` pins.
+      // The form `signed_at` pins (evidence-export.md §3.1).
       return 'attestation payload field "attested_at" is not an RFC 3339 UTC date-time with Z naming a real date and time';
     }
   }
   return null;
 }
 
+// Verify one embedded attestation record (section 5 step 6). Returns `malformed` (exit 2)
+// where the signature cannot be checked (no payload, an unparseable key or signature);
+// otherwise `ok` gates on the signature, then the payload fields under it (`fieldError`),
+// then the operator address and data_hash. `subject_ref` never gates.
 async function verifyAttestation(
   rec: AttestationRecord,
   sourceCheckpoints: Map<string, AnyTraceCheckpoint>,
@@ -3341,17 +2997,14 @@ async function verifyAttestation(
   if (typeof rec.signature !== "string") {
     return { result, malformed: "attestation record missing signature" };
   }
-  const fieldError = payloadFieldError(payload as unknown as Record<string, unknown>);
-  if (fieldError !== null) return { result, malformed: fieldError };
   const rsaKey = { kty: "RSA" as const, n: pub.n, e: pub.e };
 
   result.operator = typeof payload.operator === "string" ? payload.operator : "";
   result.gateway = typeof payload.gateway === "string" ? payload.gateway : null;
-  result.level = typeof payload.level === "number" ? payload.level : null;
+  result.level = safeInteger(payload.level);
 
-  // (a) RSA-PSS-SHA-256 signature over JCS(payload). A malformed sig hex or
-  // unimportable key THROWS (malformed → exit 2); a well-formed key that simply
-  // fails to verify returns false (→ exit 1).
+  // (a) RSA-PSS-SHA-256 over JCS(payload). Malformed hex or an unimportable key
+  // is malformed (exit 2); a signature that does not verify is false (exit 1).
   let payloadBytes: Uint8Array;
   try {
     payloadBytes = utf8(jcs(payload));
@@ -3362,17 +3015,17 @@ async function verifyAttestation(
     result.signatureOk = await verifyRsaPssSha256(payloadBytes, rec.signature, rsaKey);
     if (!result.signatureOk) errs.push("attestation RSA-PSS signature verification failed");
   } catch {
-    // A FIXED sentence, not the library's. This kernel throws
-    // `verifyRsaPssSha256: malformed signature hex: ...` and the Python kernel
-    // raises `malformed signature hex: ...`, so quoting either one split the
-    // two kernels on a finding a holder can put in an export body it signs,
-    // and an export pack's findings reach a case reading through `reasons`
-    // (gate 4 on proof#140, finding 1). Callers of `verifyRsaPssSha256` still
-    // get this kernel's own words.
+    // A fixed sentence, not the library's, so both kernels report one finding.
     return { result, malformed: "attestation signature or key is malformed" };
   }
+  // The fields are read only under a signature that holds: over bytes the issuer did not
+  // sign, a bad field says nothing the failed signature does not.
+  if (result.signatureOk) {
+    result.fieldError = payloadFieldError(payload as unknown as Record<string, unknown>);
+    if (result.fieldError !== null) errs.push(result.fieldError);
+  }
 
-  // (b) operator-address binding: base64url(SHA-256(modulus)) == payload.operator.
+  // (b) base64url(SHA-256(modulus)) == payload.operator.
   try {
     const derived = await deriveOperatorAddress(pub.n);
     result.operatorAddressBound = result.operator !== "" && derived === result.operator;
@@ -3385,10 +3038,8 @@ async function verifyAttestation(
     return { result, malformed: `attestation operator key${thrownDetail(e)}` };
   }
 
-  // (c) checkpoint resolution + data_hash binding. The checkpoint tx data IS the
-  // uploaded JCS(envelope) bytes (the same bytes the on-chain re-fetch compares
-  // against, §4.2), so the checkpoint's committed content hash is
-  // SHA-256(JCS(checkpoint.envelope)).
+  // (c) data_hash binding. The checkpoint's witnessed data is its uploaded
+  // JCS(envelope), so the committed hash is SHA-256(JCS(checkpoint.envelope)).
   const cp = sourceCheckpoints.get(result.checkpointRef);
   result.checkpointResolved = cp !== undefined;
   if (!cp) {
@@ -3411,21 +3062,20 @@ async function verifyAttestation(
     }
   }
 
-  // (d) subject_ref (§3.2) — well-formedness only (no side-input subject channel
-  // in v1); undetermined (null), never a hard failure.
+  // (d) subject_ref (§3.2): well-formedness only; null, never a failure.
   result.subjectRefOk = evaluateSubjectRef(payload.subject_ref, errs);
 
   result.ok =
     result.signatureOk &&
+    (result.fieldError ?? null) === null &&
     result.operatorAddressBound &&
     result.dataHashBound &&
     result.checkpointResolved;
   return { result };
 }
 
-// subject_ref (§3.2): absent → null (unbound). Present + well-formed but no
-// side-input subject supplied → null (undetermined, mirrors disclosed-content).
-// Present + malformed → null + a surfaced note (never gates the attestation).
+// subject_ref (§3.2): null when absent, when well-formed with no side input to
+// compare against, and when malformed (with a note). Never gates.
 function evaluateSubjectRef(subjectRef: unknown, errs: string[]): boolean | null {
   if (subjectRef === undefined || subjectRef === null) return null;
   if (typeof subjectRef !== "object" || Array.isArray(subjectRef)) {
@@ -3439,13 +3089,11 @@ function evaluateSubjectRef(subjectRef: unknown, errs: string[]): boolean | null
     errs.push("subject_ref is present but not well-formed ({hash: sha256-hex, type: token})");
     return null;
   }
-  return null; // well-formed, no side input → undetermined
+  return null;
 }
 
-// Build the §4 verdict object (snake_case, spec-canonical) from the recomputed
-// source result + the attestation results. This is the recomputed copy the
-// renderer/verify-API display; it is compared (over its deterministic subset)
-// to the cached body.kernel_verdict in step 5.
+// Build the §4 verdict object from the recomputed source result and the
+// attestations: what surfaces display, compared with the cached copy in step 5.
 function buildVerdictObject(
   source: EvidenceBundleResult,
   attestations: AttestationResult[],
@@ -3496,7 +3144,7 @@ function buildVerdictObject(
 
   return {
     schema_version: "sanning.evidence.verdict/v1",
-    status: source.status === "malformed" ? "failed" : source.status,
+    status: source.unreadable === true ? "failed" : source.status,
     counts: { verified, failed, undetermined },
     events,
     checkpoints,
@@ -3508,8 +3156,7 @@ function toVerdictOnChain(o: OnChainResult): VerdictOnChain {
   return {
     rollup: o.rollup,
     on_chain_ok: o.onChainOk,
-    // The kernel emits {gateway, outcome}; block_height is issuer-side
-    // enrichment (optional in the §4.4 schema) the offline verifier does not
+    // `block_height` is issuer-side enrichment the offline verifier does not
     // recompute.
     per_gateway: o.perGateway.map((g) => ({ gateway: g.gateway, outcome: g.outcome })),
   };
@@ -3517,16 +3164,13 @@ function toVerdictOnChain(o: OnChainResult): VerdictOnChain {
 
 function eventVerdictStatus(e: EventResult): string {
   if (!e.ok) return "failed";
-  if (e.payloadBindingOk === null) return "partial"; // withheld record — undetermined
+  if (e.payloadBindingOk === null) return "incomplete"; // withheld record
   return "verified";
 }
 
-// The §5 step-5 agreement projection: strip every environment/time-dependent
-// and derived dimension, leaving only what an offline verifier deterministically
-// recomputes. Tolerant of a hostile/garbled cached verdict (optional chaining +
-// nullish normalization) — a structural difference surfaces as disagreement,
-// which is the correct tamper signal. Works on both the cached snake_case JSON
-// and the freshly built VerdictObject.
+// The §5 step 5 projection: only what an offline verifier deterministically
+// recomputes. Tolerates a garbled cached verdict: a structural difference
+// reads as disagreement, which is the right signal.
 function projectVerdictForAgreement(v: unknown): {
   schema_version: string | null;
   events: { content_ok: boolean | null }[];
@@ -3553,7 +3197,7 @@ function projectVerdictForAgreement(v: unknown): {
       return {
         checkpoint_ref: cp.checkpoint_ref ?? null,
         merkle_root_ok: cp.merkle_root_ok ?? null,
-        // on_chain DELIBERATELY OMITTED — environment/time-dependent (see step 5).
+        // on_chain omitted: environment and time dependent.
         attestations: atts.map((a) => {
           const at = (a ?? {}) as VerdictAttestation;
           return {
@@ -3569,11 +3213,9 @@ function projectVerdictForAgreement(v: unknown): {
   };
 }
 
-// Per event of an export's inline `sanning.anchor.trace/v3` source, in order:
-// whether `envelope-spec.md` §4.1 governs its record. Decoded the way the
-// content binding decodes it, so an event whose record is withheld, not hex or
-// not JCS is not governed here either. The Python twin is
-// `evidence._source_events_governed`.
+// Per event of an export's inline source, in order: whether §4.1 governs its
+// record, decoded as the content binding decodes it. Python's twin is
+// `_source_events_governed`.
 function sourceEventsGoverned(source: unknown): boolean[] {
   if (source === null || typeof source !== "object" || Array.isArray(source)) return [];
   const s = source as { body_type?: unknown; body?: unknown };
@@ -3605,17 +3247,13 @@ function sourceEventsGoverned(source: unknown): boolean[] {
   });
 }
 
-// The one difference §5 step 5 does not read as a disagreement
-// (evidence-export.md, evidence-bundle.md v1.19, A20): a cached `content_ok` of
-// `null` against a recomputed `true`, on an event whose record §4.1 governs. A
-// kernel before A20 could not bind a hand-off record's disclosed message, so an
-// export it composed claims less than the recompute proves, and reading that
-// as tamper failed an honest export. Only that direction: a cached `true`
-// against a recomputed `false` or `null`, `null` against `false`, and any
-// difference on a record outside §4.1 still disagree. Edits `fresh` in place
-// to match `cached` on those events. The Python twin is
-// `evidence._tolerate_pre_a20_content`.
-function toleratePreA20Content(
+// The one difference §5 step 5 tolerates: a cached `content_ok` of `null`
+// against a recomputed `true`, on an event whose record §4.1 governs. A composer
+// that could not bind hand-off messages claims less than the recompute proves,
+// which is not tamper. Only that direction; every other difference still
+// disagrees. Edits `fresh` in place. Python's twin is
+// `_tolerate_unbound_message_content`.
+function tolerateUnboundMessageContent(
   cached: { events: { content_ok: boolean | null }[] },
   fresh: { events: { content_ok: boolean | null }[] },
   governed: boolean[],
@@ -3645,12 +3283,8 @@ function summarizeExport(
   );
 }
 
-// Re-fetch a checkpoint's raw bytes from EACH gateway and classify every
-// gateway's individual outcome (evidence-export.md §4.2), then roll them up
-// worst-finding-wins. Unlike the pre-§4.2 first-responsive-wins collapse, this
-// records a per-gateway array so a confirm/mismatch/unreachable MIX across
-// gateways is preserved; the derived collapsed `onChainOk` reproduces the old
-// single-boolean exactly for a single gateway.
+// Re-fetch a checkpoint's bytes from each gateway and record each outcome
+// (evidence-export.md §4.2), then roll them up worst-finding-wins.
 async function refetchCheckpoint(
   cp: AnyTraceCheckpoint,
   anchorRef: AnchorRef,
@@ -3659,44 +3293,22 @@ async function refetchCheckpoint(
 ): Promise<RefetchOutcome> {
   let expectedHex: string | undefined;
   try {
-    // A checkpoint's witnessed bytes are its envelope RE-CANONICALIZED. The
-    // bundle carries the envelope as a JSON object, not as bytes, so what was
-    // uploaded has to be recomputed from it. See `refetchStamp` for the case
-    // where this step is not merely unnecessary but WRONG.
+    // The bundle carries the envelope as an object, so its witnessed bytes are
+    // recomputed as JCS. Stamps differ: see `refetchStamp`.
     expectedHex = toHex(utf8(jcs(cp.envelope)));
   } catch {
-    // Cannot canonicalize the checkpoint envelope — every gateway is a mismatch
-    // (we can never confirm bytes we cannot compute).
+    // Bytes we cannot compute can never be confirmed: every gateway mismatches.
     expectedHex = undefined;
   }
 
   return refetchAnchored("checkpoint", expectedHex, anchorRef, gateways, fetchImpl);
 }
 
-// Re-fetch a STAMP's witnessed bytes (evidence-bundle.md §5.2.2 / §5.3.2).
-//
-// ── The one step this path must NOT copy from the checkpoint path ──
-//
-// `refetchCheckpoint` recomputes `JCS(envelope)` because a checkpoint's
-// witnessed bytes are not in the bundle — only the object they were derived
-// from is. A stamp is the opposite case: §5.2.2 defines `stamp_bytes` as
-// "lowercase hex of the exact JCS bytes that were handed to the witness", and
-// §5.3.2 repeats it — *"the EXACT bytes that were witnessed, verbatim"*. They
-// are already the bytes, already hex, already lowercase (`isLowerHex` gated
-// them), and `stamp_ref` is their SHA-256.
-//
-// So the expected hex IS `stamp_bytes`, and re-canonicalizing would be a
-// defect, not a redundancy: it would compare the chain against bytes NOBODY
-// SIGNED. On a canonical body the two agree and the bug hides; on a body that
-// is not canonical — the exact case §5.2.2 makes the kernel check for, because
-// the plane replays these bytes as text precisely so a normalizing serializer
-// cannot alter them — a re-canonicalizing verifier reports `mismatch` against
-// a chain that faithfully holds what it was given. A false accusation, from
-// the verifier, about untampered evidence.
-//
-// The bytes handed here are the SAME value `verifyStampEntry` hashed to derive
-// `stamp_ref`, threaded through rather than re-read from the body, so the bytes
-// graded and the bytes compared cannot drift apart.
+// Re-fetch a stamp's witnessed bytes (§5.2.2, §5.3.2). Unlike a checkpoint,
+// `stamp_bytes` already are the exact witnessed bytes, so they are compared
+// verbatim: re-canonicalizing would compare the chain against bytes nobody
+// signed and accuse a faithful chain of mismatch on a non-canonical body. The
+// hex is the same value `verifyStampEntry` hashed for `stamp_ref`.
 async function refetchStamp(
   witnessedHex: string,
   anchorRef: AnchorRef,
@@ -3706,11 +3318,8 @@ async function refetchStamp(
   return refetchAnchored("stamp", witnessedHex, anchorRef, gateways, fetchImpl);
 }
 
-// The part both paths share: probe every gateway, roll the outcomes up under
-// the ONE rule (`rollupOnChain`), and phrase the finding. Extracted rather than
-// copied — a second rollup rule is a second place for "mismatch beats confirm
-// beats unreachable" to drift, and the drifted copy is the one nobody reads.
-// The subject only ever selects wording; it never changes a verdict.
+// Shared by both paths: probe every gateway, roll up with `rollupOnChain`, and
+// phrase the finding. The subject selects wording only, never a verdict.
 async function refetchAnchored(
   subject: "checkpoint" | "stamp",
   expectedHex: string | undefined,
@@ -3718,14 +3327,9 @@ async function refetchAnchored(
   gateways: string[],
   fetchImpl: typeof fetch,
 ): Promise<RefetchOutcome> {
-  // Only a `kind` this kernel has a witness adapter for is re-fetched
-  // (evidence-bundle.md §5.1: "where the verifier has an adapter for its
-  // `kind`"; §5.1.1: an unrecognised kind MUST NOT fail verification). An `id`
-  // of any other kind is not an Arweave id, so whatever a gateway serves at
-  // that path says nothing about the witness, and comparing it would turn an
-  // unrelated 200 into a false mismatch. No fetch, `onChain: null`, and the
-  // run goes `partial`: the caller asked for the witness check and it was not
-  // made.
+  // Only a `kind` with a witness adapter is re-fetched (§5.1.1: an unrecognised
+  // kind must not fail verification). No fetch, `onChain: null`, and the run is
+  // `partial`.
   if (!WITNESS_ADAPTER_KINDS.has(anchorRef.kind)) {
     return {
       onChain: null,
@@ -3734,11 +3338,9 @@ async function refetchAnchored(
       error: `no witness adapter for kind '${anchorRef.kind}'; the witness was not checked`,
     };
   }
-  // The id becomes a URL path segment. Anything but a 43-character base64url
-  // transaction id can leave the gateway's base path once URL parsing
-  // normalises it (`../x`, `%2e%2e/x`), or drop part of the path (`a#b`,
-  // `a?b`), and the two kernels would then request different URLs. Such an id
-  // is never fetched and never failed: the witness is not checked.
+  // The id becomes a URL path segment: anything but a 43-character base64url id
+  // could escape the gateway's base path or make the kernels request different
+  // URLs. Never fetched, never failed: the witness is not checked.
   if (!ARWEAVE_ID_RE.test(anchorRef.id)) {
     return {
       onChain: null,
@@ -3768,9 +3370,7 @@ async function refetchAnchored(
   return { onChain, unavailable: onChain.rollup === "unreachable", unchecked: null, error };
 }
 
-// The `anchor_ref.kind` values this kernel can re-fetch from a gateway
-// (evidence-bundle.md §5.1.1 registers exactly `arweave`). Any other kind is
-// left unchecked by `refetchAnchored`, never probed.
+// The `anchor_ref.kind` values with a witness adapter (§5.1.1 registers `arweave`).
 const WITNESS_ADAPTER_KINDS: ReadonlySet<string> = new Set(["arweave"]);
 
 // The only `arweave` ids the adapter looks up: a 43-character base64url
@@ -3789,9 +3389,8 @@ interface RefetchOutcome {
   error?: string;
 }
 
-// The bundle-level notes for a run where requested re-fetches were not made.
-// Each note keeps the phrase "could not be re-fetched", which is what both
-// CLIs map to exit 3. The order is fixed so the two kernels emit the same list.
+// Notes for requested re-fetches that were not made. Each keeps "could not be
+// re-fetched", which both CLIs map to exit 3. Fixed order across kernels.
 function pushRefetchGapNotes(
   errors: string[],
   subject: "stamps" | "checkpoints",
@@ -3812,8 +3411,7 @@ function pushRefetchGapNotes(
   }
 }
 
-// One gateway's outcome for one checkpoint tx: confirm (bytes match), mismatch
-// (bytes disagree), or unreachable (no response / !ok / network error).
+// One gateway's outcome: confirm, mismatch, or unreachable.
 async function probeGateway(
   anchorRef: AnchorRef,
   gateway: string,
@@ -3835,24 +3433,21 @@ async function probeGateway(
     return "unreachable";
   }
   if (expectedHex === undefined) return "mismatch";
-  // The on-chain bytes are the uploaded envelope bytes (JCS-canonical, per the
-  // family upload invariant). Compare structurally too, so a gateway that
-  // re-pretty-prints does not spuriously fail — but the canonical re-hash is
-  // the load-bearing check.
+  // The on-chain bytes are the uploaded JCS bytes. The structural compare
+  // tolerates a gateway that re-pretty-prints; the canonical match is the
+  // load-bearing check.
   if (toHex(onChainBytes) === expectedHex) return "confirm";
   try {
     const parsed = jcsParse(onChainBytes);
     if (toHex(utf8(jcs(parsed))) === expectedHex) return "confirm";
   } catch {
-    // not JSON / not parseable — a genuine mismatch
+    // Not parseable: a genuine mismatch.
   }
   return "mismatch";
 }
 
-// Rollup rule (§4.2): mismatch if ANY gateway is mismatch; else confirm if ANY
-// is confirm; else unreachable. The collapsed `onChainOk`: false on mismatch,
-// true on confirm, null on all-unreachable. An empty gateway list is treated as
-// all-unreachable (no signal).
+// Rollup (§4.2): mismatch if any gateway mismatched, else confirm if any
+// confirmed, else unreachable. An empty list is all-unreachable.
 function rollupOnChain(perGateway: PerGatewayOutcome[]): OnChainResult {
   let rollup: OnChainOutcome = "unreachable";
   if (perGateway.some((g) => g.outcome === "mismatch")) rollup = "mismatch";
@@ -3868,33 +3463,22 @@ function getEventId(env: unknown): string {
   return "<unknown>";
 }
 
-// The disclosed bytes offered for ONE trace event (evidence-bundle §5.1),
-// decoded once. Shared by the verifier's content check and the `disclosedContent`
-// ingest API: the bytes a consumer receives are then, by construction, the bytes
-// the verifier hashed against the commitment rather than a second decode of the
-// same field that could drift from it.
+// The disclosed bytes offered for one event (§5.1), decoded once and shared by
+// the content check and `disclosedContent`, so a consumer receives exactly the
+// bytes the verifier hashed.
 interface DisclosedSelection {
   // In-body `events[].content` (the signed disclosure), when it decoded.
   inBody?: Uint8Array;
   // Out-of-band `options.content[eventId]`, when it decoded.
   side?: Uint8Array;
-  // A disclosure was OFFERED for this event — in-body or side input — whether or
-  // not it decoded. This is what separates "minimal disclosure, nothing to
-  // materialize" from "disclosed, but unusable"; conflating those is how a
-  // consumer writes an empty log file and believes it succeeded.
+  // A disclosure was offered, in-body or side input, whether or not it
+  // decoded: "nothing disclosed" and "disclosed but unusable" must stay apart.
   offered: boolean;
   // Decode failures, in the verifier's existing wording.
   errors: string[];
 }
 
-// The side-input presence rule lives in `side-content.ts`, stated ONCE.
-//
-// It used to live here as a private `lookupSideContent`, and `grading.ts`
-// carried a second, laxer answer to the same question (`hasEntry`: own +
-// enumerable, nothing more). On one and the same content map the grader said
-// PRESENT while this verifier said nothing was offered, and `gradePack` then
-// returned `incomplete` with ZERO causes. Read `side-content.ts` for the rule
-// and for what each clause of it cost.
+// The side-input presence rule lives in `./side-content.ts`, stated once.
 
 function selectDisclosedBytes(
   ev: TraceEvent,
@@ -3921,15 +3505,8 @@ function selectDisclosedBytes(
       errors.push(`supplied content for ${eventId} is not hex${thrownDetail(e)}`);
     }
   }
-  // `offered` comes from the SAME test that produced the value, never from
-  // `value !== undefined` — that is the conflation this whole guard exists to
-  // remove, and it was removed from ONE of the two operands. The left one
-  // carried it unchanged: an in-body `"content": null` is `!== undefined`, so
-  // the event was marked offered while no bytes were selected, and the kernel
-  // split against itself — `verifyEvidenceBundle` VERIFIED, `disclosedContent`
-  // FAILED, on one bundle. `null` is how an optional field's absence
-  // serializes; `inBodyContentOffered` states that once, beside the side-input
-  // rule it mirrors.
+  // `offered` comes from the same tests that selected the value, never from
+  // `value !== undefined`: an in-body `null` is an absent optional field.
   return {
     inBody,
     side,