@sanning/proof 0.9.1 → 0.10.0

package/src/evidence.ts

@@ -1,7 +1,7 @@
 // Evidence-bundle verification (sanning-io/proof specs/evidence-bundle.md).
 //
 // A `sanning.evidence/v1` bundle is a SIGNED wrapper around a producer-specific
-// `body`. This module verifies the `sanning.anchor.trace/v1` body — the
+// `body`. This module verifies the `sanning.anchor.trace/v3` body, the
 // @sanning/anchor SDK trace: a self-verifying serialization of InclusionReceipt[]
 // (per-event signed envelopes + their checkpoints + RFC 9162 inclusion proofs).
 //
@@ -48,37 +48,73 @@ const ACCEPTED_EVIDENCE_MAJORS = ["sanning.evidence/v1"];
 // body_type is not a hard failure of the WRAPPER (the signature + body_hash
 // still verify), but its body cannot be re-derived, so the per-body verdict is
 // "undetermined" rather than "verified".
-export const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v2";
+//
+// The producer-to-agent cut (W-3, DL-73) renamed `record_bytes` to
+// `event_bytes` and moved every body that carries it to a new major. This
+// kernel reads ONLY those majors: `sanning.anchor.trace/v1` and `/v2`,
+// `sanning.stamp.evidence/v1` and `sanning.evidence.export/v1` are unknown body
+// types here and answer `partial`. DL-73 releases evidence made before the cut
+// from any obligation to keep verifying, so there is no second field name to
+// read and no dual-accept path.
+export const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v3";
 
 /**
- * The frozen pre-`anchor_ref` body (evidence-bundle.md §5.1.3).
- *
- * Accepted PERMANENTLY, not for a deprecation window. Every bundle emitted
- * before 2026-09-03 carries this shape, and those bundles are evidence — a
- * reader that stopped accepting them would destroy the record it exists to
- * defend (DL-30). Nothing new emits it.
+ * The name `event_bytes` replaced. Under the new majors a body entry that still
+ * carries it is a hard reject, never an ignored unknown field: ignored, it
+ * would read as a withheld record and the event would verify with nothing
+ * checked, the fail-open the new majors exist to prevent (governance.md §8,
+ * W-3).
  */
-export const ANCHOR_TRACE_BODY_TYPE_V1 = "sanning.anchor.trace/v1";
+export const LEGACY_EVENT_BYTES_FIELD = "record_bytes";
+
+/**
+ * Name an envelope the accept-set refused. Without this a bundle whose
+ * envelopes carry a retired profile major (a half-migrated producer still
+ * writing `sanning.events/v1`) fails with no reason at all. Spelled with
+ * `JSON.stringify` so both kernels write the same sentence.
+ */
+function specVersionFinding(
+  what: "checkpoint" | "event",
+  envelope: unknown,
+  res: { specVersionOk: boolean },
+): string | null {
+  if (!isJsonObject(envelope) || res.specVersionOk) return null;
+  if (!Object.prototype.hasOwnProperty.call(envelope, "spec_version")) {
+    return `${what} envelope has no spec_version`;
+  }
+  const sv = (envelope as Record<string, unknown>).spec_version;
+  return `${what} envelope spec_version ${JSON.stringify(sv)} is not accepted by this kernel`;
+}
 
-/** Every anchor-trace body this kernel verifies. Order is newest-first. */
-export const ANCHOR_TRACE_BODY_TYPES = [
-  ANCHOR_TRACE_BODY_TYPE,
-  ANCHOR_TRACE_BODY_TYPE_V1,
-] as const;
+/**
+ * The reject for an entry that still carries `record_bytes`. One sentence,
+ * spelled the same in both kernels, so a negative vector can assert it.
+ */
+function legacyEventBytesError(
+  entry: object,
+  what: "checkpoint" | "event",
+  bodyType: string,
+): string | null {
+  if (!Object.prototype.hasOwnProperty.call(entry, LEGACY_EVENT_BYTES_FIELD)) return null;
+  return (
+    `${what} carries ${LEGACY_EVENT_BYTES_FIELD} in a ${bodyType} body ` +
+    "(renamed event_bytes) -- one bundle speaks one vocabulary"
+  );
+}
 
 // The issuer-composed attested-evidence-export body (specs/evidence-export.md
 // §2). The wrapper is unchanged (`sanning.evidence/v1`, Ed25519-signed); this body
 // carries a cached verdict + the inline source bundle + embedded RSA-PSS
 // operator attestations. verifyEvidenceBundle dispatches on it to
 // verifyExportBody (§5).
-export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
+export const EXPORT_BODY_TYPE = "sanning.evidence.export/v2";
 
 /**
  * The Sanning-signed interval stamp body (evidence-bundle.md §5.2, DL-58).
  *
  * Its own `body_type` rather than a widened anchor-trace body, and the reason
  * is the whole decision: an anchor-trace checkpoint carries a PRODUCER-signed
- * `sanning.events/v1` envelope, and a stamp has no producer signature at all —
+ * `sanning.events/v2` envelope, and a stamp has no producer signature at all:
  * Sanning places it, under DL-52, for a customer who holds no chain identity.
  * The two rejected options were making `envelope` optional and synthesising an
  * envelope that Sanning signs; the second would have made a Sanning
@@ -86,7 +122,7 @@ export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
  * unrecoverable once witnessed.
  */
 export const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
-export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v1";
+export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v2";
 
 /**
  * The version string INSIDE a witnessed stamp body — a different string from
@@ -107,7 +143,6 @@ export interface EvidenceIssuer {
   kind: string;
   tenant_id?: string;
   agent_id?: string;
-  producer_id?: string;
   [k: string]: unknown;
 }
 
@@ -136,13 +171,12 @@ export interface AnchorRef {
   ref?: Record<string, unknown>;
 }
 
-// `sanning.anchor.trace/v2` body (§5.1). Uint8Array fields ride as lowercase hex.
+// `sanning.anchor.trace/v3` body (§5.1). Uint8Array fields ride as lowercase hex.
 export interface TraceCheckpoint {
   /**
    * The checkpoint's identity and the join key, DERIVED: hex SHA-256 of the
-   * decoded `record_bytes`. Recomputed by the verifier — in v1 this was an
-   * asserted label matched against another asserted label, so a producer could
-   * relabel a checkpoint and the bundle still verified.
+   * decoded `event_bytes`. Recomputed by the verifier, never taken from the
+   * label.
    */
   checkpoint_ref: string;
   /**
@@ -152,32 +186,24 @@ export interface TraceCheckpoint {
    */
   anchor_ref?: AnchorRef;
   envelope: Envelope;
-  record_bytes: string; // hex of JCS(checkpoint record)
+  event_bytes: string; // hex of JCS(checkpoint record)
   merkle_root: string; // hex
 }
 
-/** The frozen `sanning.anchor.trace/v1` checkpoint (§5.1.3). Read, never written. */
-export interface TraceCheckpointV1 {
-  tx_id: string;
-  envelope: Envelope;
-  record_bytes: string;
-  merkle_root: string;
-}
-
 export interface TraceInclusion {
   leaf_hash: string; // hex
   leaf_index: number;
   leaf_count: number;
   audit_path: string[]; // hex[]
-  /** Resolves against `checkpoints[].checkpoint_ref`. v1 spells this `checkpoint_tx_id`. */
+  /** Resolves against `checkpoints[].checkpoint_ref`. */
   checkpoint_ref: string;
 }
 
 export interface TraceEvent {
   envelope: Envelope;
-  record_bytes?: string; // hex of JCS(event record); omitted == record withheld
+  event_bytes?: string; // hex of JCS(event record); omitted == record withheld
   // Opt-in disclosed raw bytes (lowercase hex) whose SHA-256 MUST equal the
-  // committed event.content_hash inside record_bytes (evidence-bundle §5.1).
+  // committed event.content_hash inside event_bytes (evidence-bundle §5.1).
   // Default-absent (minimal disclosure); absent ⇒ undetermined, not failed.
   content?: string;
   inclusion: TraceInclusion;
@@ -246,7 +272,7 @@ export interface StampTraceBody {
   stamps: StampEntry[];
 }
 
-// ---- `sanning.stamp.evidence/v1` wire types (evidence-bundle.md §5.3) -----
+// ---- `sanning.stamp.evidence/v2` wire types (evidence-bundle.md §5.3) -----
 //
 // Both halves of a DL-52 record, bound: the producer signs the envelope, and
 // Sanning signs and witnesses the stamp whose root commits to it. Neither
@@ -266,7 +292,7 @@ export interface StampEvidenceInclusion {
 
 export interface StampEvidenceEvent {
   envelope: Envelope;
-  record_bytes?: string; // hex of JCS(event record); omitted == withheld
+  event_bytes?: string; // hex of JCS(event record); omitted == withheld
   content?: string; // opt-in disclosed raw bytes, lowercase hex
   inclusion: StampEvidenceInclusion;
 }
@@ -327,23 +353,12 @@ export interface OnChainResult {
 }
 
 export interface CheckpointResult {
-  /**
-   * The checkpoint's join key AS THE BUNDLE SPELLS IT — the derived
-   * `checkpoint_ref` for a v2 body, the legacy `tx_id` for a frozen v1 body.
-   * Never re-derived across forms: a v1 bundle's key is its `tx_id`, because
-   * that is what its own events resolve against and what an attestation
-   * written against it carries.
-   */
+  /** The derived `checkpoint_ref`, empty when it could not be derived. */
   checkpointRef: string;
   /**
-   * Where this checkpoint was witnessed, normalised to one shape.
-   *
-   * `null` when a v2 checkpoint carries no `anchor_ref` — placed but not yet
-   * witnessed, which is a normal state and NOT a deficiency. For a frozen v1
-   * checkpoint this is synthesised as `{ kind: "arweave", id: tx_id }`, which
-   * is exactly what v1's spec said the field was ("the Arweave TX the
-   * checkpoint envelope was anchored as"). The synthesis is reader-side only
-   * and never re-enters a signed artifact or a verdict.
+   * Where this checkpoint was witnessed. `null` when the checkpoint carries no
+   * `anchor_ref`: placed but not yet witnessed, which is a normal state and NOT
+   * a deficiency.
    */
   anchorRef: AnchorRef | null;
   // The checkpoint envelope verified (signature + payload binding to its record).
@@ -351,11 +366,15 @@ export interface CheckpointResult {
   // The committed record's merkle_root equals the checkpoint's claimed merkle_root.
   merkleRootOk: boolean;
   // If gateways were supplied: the on-chain bytes at tx_id matched the envelope.
-  // null when no gateway re-fetch was requested. Derived collapse of `onChain`
-  // (§4.2), retained so existing consumers keep the single-boolean field.
+  // null when no gateway re-fetch was requested, or when `anchor_ref.kind` has
+  // no witness adapter, or its id is not one the adapter accepts; the witness
+  // was not checked. Derived collapse of `onChain` (§4.2), retained so existing
+  // consumers keep the single-boolean field.
   onChainOk: boolean | null;
   // Per-gateway on-chain outcomes (§4.2), ADDITIVE to `onChainOk`. null when no
-  // gateway re-fetch was requested (offline-only verification).
+  // gateway re-fetch was requested (offline-only verification), or when
+  // `anchor_ref.kind` has no witness adapter, or its id is not one the adapter
+  // accepts; the witness was not checked.
   onChain: OnChainResult | null;
   ok: boolean;
   errors: string[];
@@ -373,7 +392,7 @@ export interface EventResult {
   // The inclusion's checkpoint_ref resolved to a checkpoint in the bundle.
   checkpointBound: boolean;
   // Raw-log (content) binding: SHA-256 of the disclosed bytes equals the
-  // committed event.content_hash (in record_bytes) — or, for a promoted
+  // committed event.content_hash (in event_bytes), or, for a promoted
   // envelope, a hash it commits to. true matched, false mismatch (→ event
   // fails), null undetermined (nothing disclosed OR nothing committed OR record
   // withheld — NOT a failure, mirroring payloadBindingOk).
@@ -435,12 +454,14 @@ export interface StampResult {
    * ── The four states, and why none of them collapses ──
    *
    * `null` means not checked — no gateways were supplied, or this stamp names
-   * no witness to check. It is a statement about the RUN, never about the
-   * stamp. The other three are statements about the stamp and live in
-   * `onChain.rollup`: `confirm` (a gateway returned the witnessed bytes),
-   * `mismatch` (a gateway returned DIFFERENT bytes — a finding, and the only
-   * one of the four that fails anything), `unreachable` (we asked and nobody
-   * answered — an availability gap, never an accusation).
+   * no witness to check, or its `anchor_ref.kind` has no witness adapter, or
+   * its id is not one the adapter accepts; the witness was not checked. It is
+   * a statement about the RUN, never about the stamp. The other three are
+   * statements about the stamp and live in `onChain.rollup`: `confirm` (a
+   * gateway returned the witnessed bytes), `mismatch` (a gateway returned
+   * DIFFERENT bytes: a finding, and the only one of the four that fails
+   * anything), `unreachable` (we asked and nobody answered: an availability
+   * gap, never an accusation).
    *
    * Keeping "not checked" distinct from "unreachable" is the whole point. A
    * surface handed a collapsed boolean cannot tell "no gateway could be
@@ -474,7 +495,7 @@ export interface EvidenceBundleResult {
   events: EventResult[];
   // The producer's asserted verdict.status (for display only — never trusted).
   assertedStatus: string | null;
-  // Present ONLY for a `sanning.evidence.export/v1` body (evidence-export.md §5):
+  // Present ONLY for a `sanning.evidence.export/v2` body (evidence-export.md §5):
   // the export-specific dimensions (source linkage, verdict agreement, embedded
   // attestations, recomputed §4 verdict). The top-level `checkpoints`/`events`
   // above are the recomputed SOURCE-bundle results in that case. Absent for a
@@ -494,11 +515,7 @@ export interface EvidenceBundleResult {
 // One embedded operator attestation record (§2.2 / §3). RSA-PSS-SHA-256 over
 // JCS(payload); the operator key is the operator's Arweave RSA wallet.
 export interface AttestationRecord {
-  /**
-   * The source checkpoint this attestation binds to, spelled in the SOURCE
-   * bundle's vocabulary: `checkpoint_ref` for a v2 source, the legacy `tx_id`
-   * for a frozen v1 one. Not re-derived across forms.
-   */
+  /** The source checkpoint's derived `checkpoint_ref` this attestation binds to. */
   checkpoint_ref: string;
   payload: AttestationPayload;
   signature_alg: string; // "rsa-pss-sha256"
@@ -689,7 +706,7 @@ function jsonStr(value: unknown): string {
   return JSON.stringify(value === undefined ? null : value) ?? "null";
 }
 
-// Verify a `sanning.evidence/v1` bundle carrying a `sanning.anchor.trace/v1` body.
+// Verify a `sanning.evidence/v1` bundle and dispatch on its `body_type`.
 //
 // Returns a structured per-checkpoint + per-event result and a recomputed
 // rollup `status`. The producer's asserted `verdict.status` is surfaced
@@ -698,6 +715,16 @@ function jsonStr(value: unknown): string {
 export async function verifyEvidenceBundle(
   bundle: unknown,
   options: VerifyEvidenceOptions = {},
+): Promise<EvidenceBundleResult> {
+  return verifyBundle(bundle, options, false);
+}
+
+// `exportSource`: read the bundle as an export's source (evidence-export.md
+// §2.4), where the only recognised body is `sanning.anchor.trace/v3`.
+async function verifyBundle(
+  bundle: unknown,
+  options: VerifyEvidenceOptions,
+  exportSource: boolean,
 ): Promise<EvidenceBundleResult> {
   // --- Step 1: parse + reject unknown spec_version major ---------------------
   if (bundle === null || typeof bundle !== "object" || Array.isArray(bundle)) {
@@ -781,6 +808,28 @@ export async function verifyEvidenceBundle(
   // --- Body dispatch ---------------------------------------------------------
   const bodyType = typeof b.body_type === "string" ? b.body_type : null;
 
+  // Read as an export's source (evidence-export.md §2.4), the only body this
+  // kernel recognises is sanning.anchor.trace/v3. Any other body, even one it
+  // verifies on its own, is undetermined here, after the wrapper checks above.
+  if (exportSource && bodyType !== ANCHOR_TRACE_BODY_TYPE) {
+    errors.push(
+      `body_type ${JSON.stringify(bodyType)} is not an export source ` +
+        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`,
+    );
+    return {
+      status: "partial",
+      specVersionOk,
+      bodyHashOk,
+      signatureOk,
+      bodyType,
+      onChainChecked: false,
+      checkpoints: [],
+      events: [],
+      assertedStatus,
+      errors,
+    };
+  }
+
   // Attested-evidence-export body (evidence-export.md §5). The wrapper is
   // authentic (Ed25519 issuer signature + body_hash verified above, §5 step 2);
   // hand off to the export verifier for steps 3–9.
@@ -800,13 +849,13 @@ export async function verifyEvidenceBundle(
     return verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options);
   }
 
-  if (bodyType !== ANCHOR_TRACE_BODY_TYPE && bodyType !== ANCHOR_TRACE_BODY_TYPE_V1) {
+  if (bodyType !== ANCHOR_TRACE_BODY_TYPE) {
     // The wrapper is authentic but we don't know this body's structure. Per
     // wrap-don't-merge, that is "partial" (cryptographically sound wrapper,
     // body verdict undetermined) — not a failure.
     errors.push(
       `body_type ${JSON.stringify(bodyType)} is not verifiable by this kernel ` +
-        `(only ${ANCHOR_TRACE_BODY_TYPES.join(", ")}); wrapper verified, body undetermined`,
+        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`,
     );
     return {
       status: "partial",
@@ -822,108 +871,101 @@ export async function verifyEvidenceBundle(
     };
   }
 
-  return verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, errors, options);
+  return verifyAnchorTrace(b, specVersionOk, assertedStatus, errors, options);
 }
 
 /**
- * Index a source bundle's checkpoints by the key its attestations will use.
+ * Recompute an export's source verdict (evidence-export.md §5 step 4).
  *
- * The attestation join key follows the SOURCE bundle's own vocabulary — a
- * v2 source is keyed by `checkpoint_ref`, a frozen v1 source by `tx_id`. The
- * alternative (always deriving a v2-style key) would silently un-resolve every
- * attestation ever written against a v1 export: `data_hash_bound` would go
- * false, the export would stop reaching `verified`, and nothing would say why.
+ * The only export source is `sanning.anchor.trace/v3` (§2.2, §2.4). Any other
+ * inline source body is unrecognised *as a source*, even one this kernel
+ * verifies on its own, such as a `sanning.stamp.evidence/v2` pack: §2.4 makes
+ * its source verdict undetermined, so the export cannot reach `verified`. The
+ * source wrapper is still checked first, because a forged source is a failure
+ * whatever its body.
+ */
+async function verifyExportSource(
+  source: unknown,
+  options: VerifyEvidenceOptions,
+): Promise<EvidenceBundleResult> {
+  return verifyBundle(source, options, true);
+}
+
+/**
+ * Index a source bundle's checkpoints by the key its attestations use: the
+ * derived `checkpoint_ref`. Only a `sanning.anchor.trace/v3` source has
+ * checkpoints an attestation can resolve (evidence-export.md §2.4).
  */
 async function indexSourceCheckpoints(
   bundle: EvidenceBundle,
 ): Promise<Map<string, AnyTraceCheckpoint>> {
   const out = new Map<string, AnyTraceCheckpoint>();
+  if (!isJsonObject(bundle) || bundle.body_type !== ANCHOR_TRACE_BODY_TYPE) return out;
   const sb = bundle.body as AnchorTraceBody | undefined;
-  const isV1 = bundle.body_type === ANCHOR_TRACE_BODY_TYPE_V1;
   if (!sb || typeof sb !== "object" || !Array.isArray(sb.checkpoints)) return out;
   for (const cp of sb.checkpoints as AnyTraceCheckpoint[]) {
     if (!cp || typeof cp !== "object") continue;
-    let recordBytes: Uint8Array | undefined;
+    let eventBytes: Uint8Array | undefined;
     try {
-      if (typeof cp.record_bytes === "string") recordBytes = hexToBytes(cp.record_bytes);
+      if (typeof cp.event_bytes === "string") eventBytes = hexToBytes(cp.event_bytes);
     } catch {
-      recordBytes = undefined;
+      eventBytes = undefined;
     }
-    const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
+    const keyed = await resolveCheckpointKey(cp, eventBytes);
     if (keyed.key !== null && !out.has(keyed.key)) out.set(keyed.key, cp);
   }
   return out;
 }
 
-/** Either shape of checkpoint, before the form is resolved. */
-type AnyTraceCheckpoint = Partial<TraceCheckpoint> & Partial<TraceCheckpointV1>;
+/** A checkpoint as it arrives, before any field is trusted. */
+type AnyTraceCheckpoint = Partial<TraceCheckpoint> & { tx_id?: unknown };
 
 /**
- * Resolve a checkpoint's join key and its witness reference, for whichever
- * body form we are reading.
+ * Resolve a checkpoint's join key and its witness reference.
  *
- * ── The rule that matters, and why it is a reject rather than a preference ──
+ * ── Why a retired spelling is a reject rather than a preference ──
  *
- * A checkpoint carrying BOTH vocabularies is two answers to one question
- * inside one signature. A reader that silently prefers one gives a different
- * answer from a reader that prefers the other, over the same signed bytes —
- * and both look like they verified. So a v2 body carrying `tx_id`, or a v1
- * body carrying `anchor_ref`/`checkpoint_ref`, is rejected rather than
- * resolved. This is cheap to enforce here and impossible to enforce later.
+ * A checkpoint carrying a retired spelling beside the current one is two
+ * answers to one question inside one signature. A reader that silently prefers
+ * one gives a different answer from a reader that prefers the other, over the
+ * same signed bytes, and both look like they verified. So `tx_id` and
+ * `record_bytes` are rejected rather than resolved.
  *
- * ── Why v2's key is recomputed ──
+ * ── Why the key is recomputed ──
  *
- * In v1 the key was an asserted label matched against another asserted label;
- * nothing tied either to the bytes, so relabelling a checkpoint and every
- * event pointing at it left a bundle that still verified. In v2 the key IS the
- * bytes, so the same relabel fails here. v1's behaviour is preserved exactly
- * as it was — deliberately, because those bundles are already signed and
- * re-interpreting them is not backwards compatibility.
+ * The key IS the bytes: relabelling a checkpoint and every event pointing at it
+ * fails here, because nothing is taken from the label.
  */
 async function resolveCheckpointKey(
   cp: AnyTraceCheckpoint,
-  recordBytes: Uint8Array | undefined,
-  isV1: boolean,
+  eventBytes: Uint8Array | undefined,
 ): Promise<{ key: string | null; anchorRef: AnchorRef | null; errors: string[] }> {
   const errors: string[] = [];
 
-  if (isV1) {
-    if (cp.checkpoint_ref !== undefined || cp.anchor_ref !== undefined) {
-      errors.push(
-        "sanning.anchor.trace/v1 checkpoint carries v2 fields (checkpoint_ref/anchor_ref) -- " +
-          "one bundle speaks one vocabulary",
-      );
-      return { key: null, anchorRef: null, errors };
-    }
-    if (typeof cp.tx_id !== "string" || cp.tx_id === "") {
-      errors.push("checkpoint missing tx_id");
-      return { key: null, anchorRef: null, errors };
-    }
-    // v1's tx_id IS an Arweave transaction — its own spec said so. Surfacing it
-    // through the same shape as v2 gives ONE reader-side vocabulary without
-    // touching a byte of the signed bundle.
-    return { key: cp.tx_id, anchorRef: { kind: "arweave", id: cp.tx_id }, errors };
-  }
-
   if (cp.tx_id !== undefined) {
     errors.push(
-      "sanning.anchor.trace/v2 checkpoint carries legacy tx_id -- one bundle speaks one vocabulary",
+      `${ANCHOR_TRACE_BODY_TYPE} checkpoint carries legacy tx_id -- one bundle speaks one vocabulary`,
     );
     return { key: null, anchorRef: null, errors };
   }
+  const legacy = legacyEventBytesError(cp, "checkpoint", ANCHOR_TRACE_BODY_TYPE);
+  if (legacy !== null) {
+    errors.push(legacy);
+    return { key: null, anchorRef: null, errors };
+  }
   if (typeof cp.checkpoint_ref !== "string" || cp.checkpoint_ref === "") {
     errors.push("checkpoint missing checkpoint_ref");
     return { key: null, anchorRef: null, errors };
   }
-  if (recordBytes === undefined) {
+  if (eventBytes === undefined) {
     // Without the bytes the key cannot be recomputed, so it cannot be trusted.
-    errors.push("checkpoint_ref cannot be verified -- record_bytes missing or not hex");
+    errors.push("checkpoint_ref cannot be verified -- event_bytes missing or not hex");
     return { key: null, anchorRef: null, errors };
   }
-  const derived = await sha256Hex(recordBytes);
+  const derived = await sha256Hex(eventBytes);
   if (derived !== cp.checkpoint_ref.toLowerCase()) {
     errors.push(
-      `checkpoint_ref does not match SHA-256(record_bytes): claimed=${cp.checkpoint_ref} derived=${derived}`,
+      `checkpoint_ref does not match SHA-256(event_bytes): claimed=${cp.checkpoint_ref} derived=${derived}`,
     );
     return { key: null, anchorRef: null, errors };
   }
@@ -979,14 +1021,13 @@ function parseAnchorRef(raw: unknown, errors: string[]): AnchorRef | null {
 
 async function verifyAnchorTrace(
   b: EvidenceBundle,
-  bodyType: string,
   specVersionOk: boolean,
   assertedStatus: string | null,
   errors: string[],
   options: VerifyEvidenceOptions,
 ): Promise<EvidenceBundleResult> {
   const body = b.body as AnchorTraceBody;
-  const isV1 = bodyType === ANCHOR_TRACE_BODY_TYPE_V1;
+  const bodyType = ANCHOR_TRACE_BODY_TYPE;
   if (!Array.isArray(body.checkpoints) || !Array.isArray(body.events)) {
     return malformed(`${bodyType} body must have checkpoints[] and events[]`, true);
   }
@@ -1032,16 +1073,16 @@ async function verifyAnchorTrace(
     let envelopeOk = false;
     let merkleRootOk = false;
 
-    // Decode record_bytes first: in v2 the join key is DERIVED from it, so it
+    // Decode event_bytes first: in v2 the join key is DERIVED from it, so it
     // is an input to identity, not just to the payload binding below.
-    let recordBytes: Uint8Array | undefined;
+    let eventBytes: Uint8Array | undefined;
     try {
-      if (typeof cp.record_bytes === "string") recordBytes = hexToBytes(cp.record_bytes);
+      if (typeof cp.event_bytes === "string") eventBytes = hexToBytes(cp.event_bytes);
     } catch (e) {
-      cpErrors.push(`checkpoint record_bytes is not hex: ${stringifyErr(e)}`);
+      cpErrors.push(`checkpoint event_bytes is not hex: ${stringifyErr(e)}`);
     }
 
-    const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
+    const keyed = await resolveCheckpointKey(cp, eventBytes);
     cpErrors.push(...keyed.errors);
     // A duplicate key is a HARD failure, not a note. `byKey` below keeps the
     // FIRST occurrence, so a second checkpoint claiming the same key is
@@ -1055,7 +1096,7 @@ async function verifyAnchorTrace(
     let duplicateKey = false;
     if (keyed.key !== null) {
       if (byKey.has(keyed.key)) {
-        cpErrors.push(`duplicate checkpoint ${isV1 ? "tx_id" : "checkpoint_ref"} ${keyed.key}`);
+        cpErrors.push(`duplicate checkpoint checkpoint_ref ${keyed.key}`);
         duplicateKey = true;
       } else {
         byKey.set(keyed.key, cp);
@@ -1068,7 +1109,7 @@ async function verifyAnchorTrace(
     try {
       const res = await verifyEnvelope(
         cp.envelope as Envelope,
-        recordBytes !== undefined ? { payloadBytes: recordBytes } : {},
+        eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
       // A checkpoint must fully bind: signature + the committed record matching
       // payload_hash. An undetermined binding (no record) is not enough to
@@ -1082,15 +1123,20 @@ async function verifyAnchorTrace(
         cpErrors.push("checkpoint envelope signature failed");
       }
       if (res.payloadHashOk === false) cpErrors.push("checkpoint record does not bind to payload_hash");
+      // proof#95: a malformed skeleton field fails the envelope with a valid
+      // signature and binding; name it rather than fail with no reason.
+      for (const m of res.errors) if (m.startsWith("malformed ")) cpErrors.push(`checkpoint envelope ${m}`);
+      const specFinding = specVersionFinding("checkpoint", cp.envelope, res);
+      if (specFinding !== null) cpErrors.push(specFinding);
       // WHY the binding is undetermined decides which sentence is true.
-      // record_bytes really absent is one thing; record_bytes present and
+      // event_bytes really absent is one thing; event_bytes present and
       // unbindable (a degenerate envelope, unreadable hex) is another, and
       // naming the wrong cause sends a reader to look for a field that is
       // sitting right there (proof#76).
       if (res.payloadHashOk === null) {
         cpErrors.push(
-          recordBytes === undefined
-            ? "checkpoint record_bytes missing -- root untrusted"
+          eventBytes === undefined
+            ? "checkpoint event_bytes missing -- root untrusted"
             : "checkpoint record binding not checked: root untrusted",
         );
       }
@@ -1100,9 +1146,9 @@ async function verifyAnchorTrace(
 
     // The committed record's merkle_root must equal the checkpoint's claimed
     // merkle_root (recompute, don't trust the bundle's top-level claim).
-    if (recordBytes !== undefined) {
+    if (eventBytes !== undefined) {
       try {
-        const record = JSON.parse(new TextDecoder().decode(recordBytes)) as {
+        const record = JSON.parse(new TextDecoder().decode(eventBytes)) as {
           event?: { merkle_root?: unknown };
         };
         const committedRoot = record.event?.merkle_root;
@@ -1161,16 +1207,21 @@ async function verifyAnchorTrace(
     let envelopeOk = false;
     let payloadBindingOk: boolean | null = null;
 
-    let recordBytes: Uint8Array | undefined;
+    // A retired field name under this major is a reject, never an ignored
+    // unknown field: ignored, it reads as a withheld record (W-3).
+    const legacyError = legacyEventBytesError(ev, "event", bodyType);
+    if (legacyError !== null) evErrors.push(legacyError);
+
+    let eventBytes: Uint8Array | undefined;
     try {
-      if (typeof ev.record_bytes === "string") recordBytes = hexToBytes(ev.record_bytes);
+      if (typeof ev.event_bytes === "string") eventBytes = hexToBytes(ev.event_bytes);
     } catch (e) {
-      evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+      evErrors.push(`event event_bytes is not hex: ${stringifyErr(e)}`);
     }
     try {
       const res = await verifyEnvelope(
         ev.envelope,
-        recordBytes !== undefined ? { payloadBytes: recordBytes } : {},
+        eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
       envelopeOk = res.ok; // ok tolerates an undetermined binding (withheld record)
       payloadBindingOk = res.payloadHashOk;
@@ -1187,6 +1238,11 @@ async function verifyAnchorTrace(
         evErrors.push("event envelope signature failed");
       }
       if (res.payloadHashOk === false) evErrors.push("event record does not bind to payload_hash");
+      // A malformed skeleton field fails the envelope with a valid signature
+      // and binding (proof#95), so without this the event fails with no reason.
+      for (const m of res.errors) if (m.startsWith("malformed ")) evErrors.push(`event envelope ${m}`);
+      const specFinding = specVersionFinding("event", ev.envelope, res);
+      if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
       evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
     }
@@ -1194,12 +1250,11 @@ async function verifyAnchorTrace(
     // Bind the event to exactly one checkpoint in the bundle, then verify
     // RFC 9162 inclusion against THAT checkpoint's merkle_root.
     const incl = ev.inclusion as (TraceInclusion & { checkpoint_tx_id?: unknown }) | undefined;
-    // The join key is spelled differently in the two forms and MUST NOT be read
-    // from the other one: an inclusion carrying v1's spelling inside a v2 body
-    // is a mixed bundle, and resolving it anyway is how an event silently binds
-    // to a checkpoint nobody meant.
-    const keyField = isV1 ? "checkpoint_tx_id" : "checkpoint_ref";
-    const wrongField = isV1 ? "checkpoint_ref" : "checkpoint_tx_id";
+    // An inclusion carrying the retired `checkpoint_tx_id` spelling is a mixed
+    // bundle, and resolving it anyway is how an event silently binds to a
+    // checkpoint nobody meant.
+    const keyField = "checkpoint_ref";
+    const wrongField = "checkpoint_tx_id";
     const inclAsRecord = incl as unknown as Record<string, unknown> | undefined;
     const rawKey = inclAsRecord ? inclAsRecord[keyField] : undefined;
     const strayKey = inclAsRecord ? inclAsRecord[wrongField] : undefined;
@@ -1257,7 +1312,7 @@ async function verifyAnchorTrace(
     }
 
     // Content (raw-log) binding — shared with every other event-carrying body.
-    const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+    const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
     const contentOk = contentRes.contentOk;
     evErrors.push(...contentRes.errors);
 
@@ -1273,7 +1328,7 @@ async function verifyAnchorTrace(
       // present checkpoint, and its disclosed content did not MISMATCH. A
       // withheld record or undisclosed content (binding/content null) does not
       // fail it.
-      ok: envelopeOk && inclusionOk && checkpointBound && contentOk !== false,
+      ok: envelopeOk && inclusionOk && checkpointBound && contentOk !== false && legacyError === null,
       errors: evErrors,
     });
   }
@@ -1281,6 +1336,8 @@ async function verifyAnchorTrace(
   // --- Step 5: optional on-chain re-fetch ------------------------------------
   const fetchImpl = options.fetchImpl ?? (globalThis.fetch as typeof fetch | undefined);
   let gatewayUnavailable = false;
+  let uncheckedKind = false;
+  let uncheckedId = false;
   if (onChainChecked) {
     if (typeof fetchImpl !== "function") {
       gatewayUnavailable = true;
@@ -1308,8 +1365,10 @@ async function verifyAnchorTrace(
         }
         const outcome = await refetchCheckpoint(cp, cpr.anchorRef, gateways, fetchImpl);
         cpr.onChain = outcome.onChain;
-        cpr.onChainOk = outcome.onChain.onChainOk;
+        cpr.onChainOk = outcome.onChain?.onChainOk ?? null;
         if (outcome.unavailable) gatewayUnavailable = true;
+        if (outcome.unchecked === "kind") uncheckedKind = true;
+        if (outcome.unchecked === "id") uncheckedId = true;
         if (outcome.error) cpr.errors.push(outcome.error);
         // Fold the on-chain dimension in: a MISMATCH (false) fails the
         // checkpoint — the proof was not anchored as claimed. An UNREACHABLE
@@ -1341,12 +1400,16 @@ async function verifyAnchorTrace(
   let status: EvidenceStatus;
   if (anyHardFailure) {
     status = "failed";
-  } else if (gatewayUnavailable) {
+  } else if (gatewayUnavailable || uncheckedKind || uncheckedId) {
     // Every offline check passed and nothing MISMATCHED, but a requested
     // on-chain confirmation could not be made — the bundle is offline-sound,
     // its anchored state unconfirmed. "partial" + a note the CLI maps to exit 3.
     status = "partial";
-    errors.push("one or more checkpoints could not be re-fetched from the supplied gateways");
+    pushRefetchGapNotes(errors, "checkpoints", {
+      unavailable: gatewayUnavailable,
+      kind: uncheckedKind,
+      id: uncheckedId,
+    });
   } else if (anyWithheldRecord) {
     // Everything that COULD be checked passed; some record bytes were withheld
     // so their semantic binding is undetermined (not a failure) — "partial".
@@ -1438,7 +1501,7 @@ function isNonNegInt(n: unknown): n is number {
 // ===========================================================================
 // Disclosed-content binding, shared by every body that carries events.
 //
-// Extracted for `sanning.stamp.evidence/v1` (§5.3) rather than copied. The
+// Extracted for `sanning.stamp.evidence/v2` (§5.3) rather than copied. The
 // rawLog -> content_hash link is the one step the chain
 // (content_hash -> record -> payload_hash -> signature -> leaf -> root) does
 // not otherwise cover, and a second copy of it is a second place for the
@@ -1450,7 +1513,7 @@ function isNonNegInt(n: unknown): n is number {
 async function verifyDisclosedContent(
   ev: { envelope?: unknown; content?: unknown },
   eventId: string,
-  recordBytes: Uint8Array | undefined,
+  eventBytes: Uint8Array | undefined,
   sideContent: VerifyEvidenceOptions["content"],
 ): Promise<{ contentOk: boolean | null; errors: string[] }> {
   const evErrors: string[] = [];
@@ -1458,9 +1521,9 @@ async function verifyDisclosedContent(
 
   const committed: string[] = [];
   let recordContentHash: string | undefined;
-  if (recordBytes !== undefined) {
+  if (eventBytes !== undefined) {
     try {
-      const record = JSON.parse(new TextDecoder().decode(recordBytes)) as {
+      const record = JSON.parse(new TextDecoder().decode(eventBytes)) as {
         event?: { content_hash?: unknown };
       };
       const ch = record.event?.content_hash;
@@ -1775,7 +1838,7 @@ async function verifyStampTrace(
   // other — asks every consumer to remember which wrapper it is holding before
   // it can trust `onChain: null`, and that is exactly the kind of per-body
   // exception a reader eventually gets wrong.
-  const { onChainChecked, gatewayUnavailable } = await refetchStamps(
+  const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(
     stamps,
     witnessed,
     options,
@@ -1795,13 +1858,15 @@ async function verifyStampTrace(
     // does not have.
     status = "partial";
     errors.push(`${STAMP_TRACE_BODY_TYPE} body carries no stamps`);
-  } else if (gatewayUnavailable || anyUnwitnessed) {
+  } else if (gatewayUnavailable || uncheckedKind || uncheckedId || anyUnwitnessed) {
     // Both hold the bundle at `partial`, and both get said — see §5.3's rollup
     // for why one note is not enough when there are two different gaps.
     status = "partial";
-    if (gatewayUnavailable) {
-      errors.push("one or more stamps could not be re-fetched from the supplied gateways");
-    }
+    pushRefetchGapNotes(errors, "stamps", {
+      unavailable: gatewayUnavailable,
+      kind: uncheckedKind,
+      id: uncheckedId,
+    });
     if (anyUnwitnessed) {
       // The honest half of P-10, one layer up. A stamp with no `anchor_ref` is
       // sealed and unwitnessed: `retained-by-sanning`, which is a statement
@@ -1834,7 +1899,7 @@ async function verifyStampTrace(
 }
 
 // ===========================================================================
-// `sanning.stamp.evidence/v1` — the two halves, bound (evidence-bundle.md §5.3)
+// `sanning.stamp.evidence/v2`: the two halves, bound (evidence-bundle.md §5.3)
 //
 // The stamp half is §5.2's code unchanged (`verifyStampEntry`, which carries
 // the sub-tree partition check). The event half reuses the same primitives the
@@ -1912,16 +1977,21 @@ async function verifyStampEvidence(
     let envelopeOk = false;
     let payloadBindingOk: boolean | null = null;
 
-    let recordBytes: Uint8Array | undefined;
+    // A retired field name under this major is a reject, never an ignored
+    // unknown field: ignored, it reads as a withheld record (W-3).
+    const legacyError = legacyEventBytesError(ev, "event", STAMP_EVIDENCE_BODY_TYPE);
+    if (legacyError !== null) evErrors.push(legacyError);
+
+    let eventBytes: Uint8Array | undefined;
     try {
-      if (typeof ev.record_bytes === "string") recordBytes = hexToBytes(ev.record_bytes);
+      if (typeof ev.event_bytes === "string") eventBytes = hexToBytes(ev.event_bytes);
     } catch (e) {
-      evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+      evErrors.push(`event event_bytes is not hex: ${stringifyErr(e)}`);
     }
     try {
       const res = await verifyEnvelope(
         ev.envelope,
-        recordBytes !== undefined ? { payloadBytes: recordBytes } : {},
+        eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
       envelopeOk = res.ok; // tolerates an undetermined binding (withheld record)
       payloadBindingOk = res.payloadHashOk;
@@ -1938,6 +2008,11 @@ async function verifyStampEvidence(
         evErrors.push("event envelope signature failed");
       }
       if (res.payloadHashOk === false) evErrors.push("event record does not bind to payload_hash");
+      // A malformed skeleton field fails the envelope with a valid signature
+      // and binding (proof#95), so without this the event fails with no reason.
+      for (const m of res.errors) if (m.startsWith("malformed ")) evErrors.push(`event envelope ${m}`);
+      const specFinding = specVersionFinding("event", ev.envelope, res);
+      if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
       evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
     }
@@ -2007,7 +2082,7 @@ async function verifyStampEvidence(
       }
     }
 
-    const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+    const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
     const contentOk = contentRes.contentOk;
     evErrors.push(...contentRes.errors);
 
@@ -2019,13 +2094,13 @@ async function verifyStampEvidence(
       // Named for §5.1's join; here it reports whether `stamp_ref` resolved.
       checkpointBound: stampBound,
       contentOk,
-      ok: envelopeOk && inclusionOk && stampBound && contentOk !== false,
+      ok: envelopeOk && inclusionOk && stampBound && contentOk !== false && legacyError === null,
       errors: evErrors,
     });
   }
 
   // --- The optional on-chain re-fetch (§5.2.4's "online act") ---------------
-  const { onChainChecked, gatewayUnavailable } = await refetchStamps(
+  const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(
     stamps,
     witnessed,
     options,
@@ -2045,16 +2120,31 @@ async function verifyStampEvidence(
   } else if (stamps.length === 0 && eventResults.length === 0) {
     status = "partial";
     errors.push(`${STAMP_EVIDENCE_BODY_TYPE} body carries no stamps and no events`);
-  } else if (gatewayUnavailable || anyUnwitnessed) {
-    // Both hold the bundle at `partial`, and BOTH get said. A stamp nobody
-    // witnessed and a witness we could not reach are different gaps with
-    // different fixes — one waits for the interval, the other for the network —
-    // and an auditor told only about the second would read the first as fine.
-    // The order is fixed so the two kernels emit the same list.
+  } else if (
+    eventResults.length === 0 ||
+    gatewayUnavailable ||
+    uncheckedKind ||
+    uncheckedId ||
+    anyUnwitnessed
+  ) {
+    // Each holds the bundle at `partial`, and EACH gets said. A pack with no
+    // events, a stamp nobody witnessed and a witness we could not reach are
+    // different gaps with different fixes, and an auditor told only about one
+    // would read the others as fine. The order is fixed so the two kernels
+    // emit the same list.
     status = "partial";
-    if (gatewayUnavailable) {
-      errors.push("one or more stamps could not be re-fetched from the supplied gateways");
+    if (eventResults.length === 0) {
+      // §5.3.2: an events-empty body is exactly a §5.2 stamp trace, and is
+      // partial, never verified. It says nothing about any event.
+      errors.push(
+        `${STAMP_EVIDENCE_BODY_TYPE} body carries no events -- it evidences no event, only its stamps`,
+      );
     }
+    pushRefetchGapNotes(errors, "stamps", {
+      unavailable: gatewayUnavailable,
+      kind: uncheckedKind,
+      id: uncheckedId,
+    });
     if (anyUnwitnessed) {
       // §5.3.3 rule 6, inherited whole from §5.2.4: for a stamp the witness IS
       // the independent part, so the events resting on it inherit `partial`.
@@ -2120,18 +2210,21 @@ async function refetchStamps(
   witnessed: (string | undefined)[],
   options: VerifyEvidenceOptions,
   errors: string[],
-): Promise<{ onChainChecked: boolean; gatewayUnavailable: boolean }> {
+): Promise<StampRefetchSummary> {
   const gateways = options.gateways ?? [];
   const onChainChecked = gateways.length > 0;
-  if (!onChainChecked) return { onChainChecked, gatewayUnavailable: false };
+  const none = { gatewayUnavailable: false, uncheckedKind: false, uncheckedId: false };
+  if (!onChainChecked) return { onChainChecked, ...none };
 
   const fetchImpl = options.fetchImpl ?? (globalThis.fetch as typeof fetch | undefined);
   if (typeof fetchImpl !== "function") {
     errors.push("on-chain re-fetch requested but no fetch implementation is available");
-    return { onChainChecked, gatewayUnavailable: true };
+    return { onChainChecked, ...none, gatewayUnavailable: true };
   }
 
   let gatewayUnavailable = false;
+  let uncheckedKind = false;
+  let uncheckedId = false;
   for (let i = 0; i < stamps.length; i++) {
     const st = stamps[i]!;
     const witnessedHex = witnessed[i];
@@ -2141,8 +2234,10 @@ async function refetchStamps(
 
     const outcome = await refetchStamp(witnessedHex, st.anchorRef, gateways, fetchImpl);
     st.onChain = outcome.onChain;
-    st.onChainOk = outcome.onChain.onChainOk;
+    st.onChainOk = outcome.onChain?.onChainOk ?? null;
     if (outcome.unavailable) gatewayUnavailable = true;
+    if (outcome.unchecked === "kind") uncheckedKind = true;
+    if (outcome.unchecked === "id") uncheckedId = true;
     if (outcome.error) st.errors.push(outcome.error);
     // Fold the on-chain dimension in exactly as a checkpoint does: a MISMATCH
     // (false) fails the stamp — the chain does not hold what the bundle says
@@ -2155,7 +2250,14 @@ async function refetchStamps(
     // unreachable note would fail a stamp for a gateway being down.
     st.ok = st.ok && st.onChainOk !== false;
   }
-  return { onChainChecked, gatewayUnavailable };
+  return { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId };
+}
+
+interface StampRefetchSummary {
+  onChainChecked: boolean;
+  gatewayUnavailable: boolean;
+  uncheckedKind: boolean;
+  uncheckedId: boolean;
 }
 
 // ===========================================================================
@@ -2211,7 +2313,7 @@ export interface DisclosedContentResult {
   errors: string[];
 }
 
-// How many `sanning.evidence.export/v1` wrappers deep the source bundle may be
+// How many `sanning.evidence.export/v2` wrappers deep the source bundle may be
 // nested before this path gives up. verifyEvidenceBundle's canonicalization
 // depth bound already rejects a pathological bundle, but the unwrap must be
 // independently bounded rather than trusting that it ran first.
@@ -2250,7 +2352,7 @@ export async function disclosedContent(
   const traceEvents = resolveTraceEvents(bundle);
   if (traceEvents === undefined) {
     errors.push(
-      `no ${[...ANCHOR_TRACE_BODY_TYPES, STAMP_EVIDENCE_BODY_TYPE].join(" / ")} ` +
+      `no ${ANCHOR_TRACE_BODY_TYPE} / ${STAMP_EVIDENCE_BODY_TYPE} ` +
         `body to materialize content from ` +
         `(body_type ${JSON.stringify(verification.bodyType)})`,
     );
@@ -2351,7 +2453,7 @@ export async function disclosedContent(
 // a caller must distinguish from a body that has events and no links.
 //
 // BOTH event-carrying bodies, not just anchor-trace (proof#73): §5.3's
-// `sanning.stamp.evidence/v1` is the hand-over pack, and it presents the same
+// `sanning.stamp.evidence/v2` is the hand-over pack, and it presents the same
 // event shape.
 //
 // Exported for `chain.ts`, which needs the same descent and must not derive it
@@ -2366,8 +2468,8 @@ export function resolveTraceEvents(bundle: unknown): TraceEvent[] | undefined {
     const b = cur as EvidenceBundle;
     const bodyType = typeof b.body_type === "string" ? b.body_type : null;
     // Both event-carrying bodies, not just anchor-trace (proof#73). §5.3's
-    // `sanning.stamp.evidence/v1` presents the SAME event shape (a
-    // producer-signed envelope, optional `record_bytes`, an inclusion proof),
+    // `sanning.stamp.evidence/v2` presents the SAME event shape (a
+    // producer-signed envelope, optional `event_bytes`, an inclusion proof),
     // and it is the HAND-OVER PACK: the only artifact an auditor is ever
     // handed. Dispatching on anchor-trace alone meant `readChains` reported
     // zero chains on every pack, however well-formed the links inside its
@@ -2375,7 +2477,6 @@ export function resolveTraceEvents(bundle: unknown): TraceEvent[] | undefined {
     // that matters. The writers have been emitting those links the whole time.
     if (
       bodyType === ANCHOR_TRACE_BODY_TYPE ||
-      bodyType === ANCHOR_TRACE_BODY_TYPE_V1 ||
       bodyType === STAMP_EVIDENCE_BODY_TYPE
     ) {
       const body = b.body as AnchorTraceBody | null | undefined;
@@ -2480,7 +2581,7 @@ async function verifyExportBody(
   // The existing evidence path over the inline source bundle — same primitives
   // (Ed25519 envelopes, payload binding, RFC 9162 inclusion, merkle roots,
   // content_ok, and the optional per-gateway on-chain re-fetch, §4.2 / step 7).
-  const sourceResult = await verifyEvidenceBundle(inline, options);
+  const sourceResult = await verifyExportSource(inline, options);
 
   // Attestation data_hash binding (§5 6c).
   const sourceCheckpoints = await indexSourceCheckpoints(inline);
@@ -2613,7 +2714,7 @@ export async function recomputeExportVerdict(
   generatedAt: string,
   options: VerifyEvidenceOptions = {},
 ): Promise<ComposeVerdictResult> {
-  const sourceResult = await verifyEvidenceBundle(sourceBundle, options);
+  const sourceResult = await verifyExportSource(sourceBundle, options);
 
   // Attestation data_hash binding (§5 6c) — the SAME index construction as
   // verifyExportBody, deliberately shared rather than restated.
@@ -2659,6 +2760,52 @@ export async function recomputeExportVerdict(
 // field; otherwise a per-dimension AttestationResult whose `ok` gates on the
 // three binding checks (sig / operator-address / data_hash). subject_ref is
 // undetermined-tolerant and never gates.
+// The attestation payload fields evidence-export.md §3.1 marks Required, with
+// the type it gives each. A record whose payload lacks one, or carries another
+// type (null included), is malformed: §5 step 9 and §4.5 make "a missing
+// required field" an export the verifier cannot render (exit 2). §5 step 6
+// gates a WELL-FORMED record on signature, operator and data_hash only; these
+// checks decide whether the record is well-formed at all. `level` is the §3.1
+// enum 1 | 2 | 3. The integers are non-negative and within 2**53 - 1 (the
+// §3.1 clarification).
+const PAYLOAD_REQUIRED: readonly (readonly [string, "string" | "boolean" | "integer" | "level"])[] = [
+  ["attested_at", "string"],
+  ["tx_id", "string"],
+  ["data_hash", "string"],
+  ["data_size", "integer"],
+  ["block_height", "integer"],
+  ["block_timestamp", "integer"],
+  ["operator", "string"],
+  ["owner_address", "string"],
+  ["gateway", "string"],
+  ["signature_verified", "boolean"],
+  ["level", "level"],
+];
+
+function payloadFieldError(payload: Record<string, unknown>): string | null {
+  for (const [name, kind] of PAYLOAD_REQUIRED) {
+    const v = Object.prototype.hasOwnProperty.call(payload, name) ? payload[name] : undefined;
+    let ok: boolean;
+    let want: string;
+    if (kind === "string") {
+      ok = typeof v === "string";
+      want = "a string";
+    } else if (kind === "boolean") {
+      ok = typeof v === "boolean";
+      want = "a boolean";
+    } else if (kind === "integer") {
+      // §3.1 (clarified): a non-negative integer no larger than 2**53 - 1.
+      ok = typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+      want = "a non-negative integer";
+    } else {
+      ok = v === 1 || v === 2 || v === 3;
+      want = "1, 2 or 3";
+    }
+    if (!ok) return `attestation payload field ${JSON.stringify(name)} is missing or not ${want}`;
+  }
+  return null;
+}
+
 async function verifyAttestation(
   rec: AttestationRecord,
   sourceCheckpoints: Map<string, AnyTraceCheckpoint>,
@@ -2705,6 +2852,8 @@ async function verifyAttestation(
   if (typeof rec.signature !== "string") {
     return { result, malformed: "attestation record missing signature" };
   }
+  const fieldError = payloadFieldError(payload as unknown as Record<string, unknown>);
+  if (fieldError !== null) return { result, malformed: fieldError };
   const rsaKey = { kty: "RSA" as const, n: pub.n, e: pub.e };
 
   result.operator = typeof payload.operator === "string" ? payload.operator : "";
@@ -2944,7 +3093,7 @@ async function refetchCheckpoint(
   anchorRef: AnchorRef,
   gateways: string[],
   fetchImpl: typeof fetch,
-): Promise<{ onChain: OnChainResult; unavailable: boolean; error?: string }> {
+): Promise<RefetchOutcome> {
   let expectedHex: string | undefined;
   try {
     // A checkpoint's witnessed bytes are its envelope RE-CANONICALIZED. The
@@ -2990,7 +3139,7 @@ async function refetchStamp(
   anchorRef: AnchorRef,
   gateways: string[],
   fetchImpl: typeof fetch,
-): Promise<{ onChain: OnChainResult; unavailable: boolean; error?: string }> {
+): Promise<RefetchOutcome> {
   return refetchAnchored("stamp", witnessedHex, anchorRef, gateways, fetchImpl);
 }
 
@@ -3005,7 +3154,36 @@ async function refetchAnchored(
   anchorRef: AnchorRef,
   gateways: string[],
   fetchImpl: typeof fetch,
-): Promise<{ onChain: OnChainResult; unavailable: boolean; error?: string }> {
+): Promise<RefetchOutcome> {
+  // Only a `kind` this kernel has a witness adapter for is re-fetched
+  // (evidence-bundle.md §5.1: "where the verifier has an adapter for its
+  // `kind`"; §5.1.1: an unrecognised kind MUST NOT fail verification). An `id`
+  // of any other kind is not an Arweave id, so whatever a gateway serves at
+  // that path says nothing about the witness, and comparing it would turn an
+  // unrelated 200 into a false mismatch. No fetch, `onChain: null`, and the
+  // run goes `partial`: the caller asked for the witness check and it was not
+  // made.
+  if (!WITNESS_ADAPTER_KINDS.has(anchorRef.kind)) {
+    return {
+      onChain: null,
+      unavailable: false,
+      unchecked: "kind",
+      error: `no witness adapter for kind '${anchorRef.kind}'; the witness was not checked`,
+    };
+  }
+  // The id becomes a URL path segment. Anything but a 43-character base64url
+  // transaction id can leave the gateway's base path once URL parsing
+  // normalises it (`../x`, `%2e%2e/x`), or drop part of the path (`a#b`,
+  // `a?b`), and the two kernels would then request different URLs. Such an id
+  // is never fetched and never failed: the witness is not checked.
+  if (!ARWEAVE_ID_RE.test(anchorRef.id)) {
+    return {
+      onChain: null,
+      unavailable: false,
+      unchecked: "id",
+      error: "arweave witness id is not a 43-character base64url transaction id; the witness was not checked",
+    };
+  }
   const perGateway: PerGatewayOutcome[] = [];
   for (const gw of gateways) {
     perGateway.push({
@@ -3024,7 +3202,51 @@ async function refetchAnchored(
   } else if (onChain.rollup === "unreachable") {
     error = `${subject} ${anchorRef.id} unreachable on all gateways`;
   }
-  return { onChain, unavailable: onChain.rollup === "unreachable", error };
+  return { onChain, unavailable: onChain.rollup === "unreachable", unchecked: null, error };
+}
+
+// The `anchor_ref.kind` values this kernel can re-fetch from a gateway
+// (evidence-bundle.md §5.1.1 registers exactly `arweave`). Any other kind is
+// left unchecked by `refetchAnchored`, never probed.
+const WITNESS_ADAPTER_KINDS: ReadonlySet<string> = new Set(["arweave"]);
+
+// The only `arweave` ids the adapter looks up: a 43-character base64url
+// transaction or data-item id.
+const ARWEAVE_ID_RE = /^[A-Za-z0-9_-]{43}$/;
+
+// Why a re-fetch was not made: `kind` (no adapter for the witness kind) or
+// `id` (an arweave id the adapter cannot look up). null when it was made.
+type Unchecked = "kind" | "id" | null;
+
+interface RefetchOutcome {
+  onChain: OnChainResult | null;
+  // Every gateway was unreachable.
+  unavailable: boolean;
+  unchecked: Unchecked;
+  error?: string;
+}
+
+// The bundle-level notes for a run where requested re-fetches were not made.
+// Each note keeps the phrase "could not be re-fetched", which is what both
+// CLIs map to exit 3. The order is fixed so the two kernels emit the same list.
+function pushRefetchGapNotes(
+  errors: string[],
+  subject: "stamps" | "checkpoints",
+  gaps: { unavailable: boolean; kind: boolean; id: boolean },
+): void {
+  if (gaps.unavailable) {
+    errors.push(`one or more ${subject} could not be re-fetched from the supplied gateways`);
+  }
+  if (gaps.kind) {
+    errors.push(
+      `one or more ${subject} name a witness kind this verifier has no adapter for, so it could not be re-fetched`,
+    );
+  }
+  if (gaps.id) {
+    errors.push(
+      `one or more ${subject} name an Arweave witness id this verifier cannot look up, so it could not be re-fetched`,
+    );
+  }
 }
 
 // One gateway's outcome for one checkpoint tx: confirm (bytes match), mismatch