@sanning/proof 0.9.2 → 0.11.0

package/src/evidence.ts

@@ -1,7 +1,7 @@
 // Evidence-bundle verification (sanning-io/proof specs/evidence-bundle.md).
 //
 // A `sanning.evidence/v1` bundle is a SIGNED wrapper around a producer-specific
-// `body`. This module verifies the `sanning.anchor.trace/v1` body — the
+// `body`. This module verifies the `sanning.anchor.trace/v3` body, the
 // @sanning/anchor SDK trace: a self-verifying serialization of InclusionReceipt[]
 // (per-event signed envelopes + their checkpoints + RFC 9162 inclusion proofs).
 //
@@ -20,6 +20,11 @@ import {
   deriveOperatorAddress,
   ed25519Verify,
   hexToBytes,
+  // The one hex-field test, which lives in `crypto.ts` beside the one hex
+  // reader (proof#146). It was a second copy here until then, with the same
+  // body: two copies of one rule is how two kernels drift apart one edit at a
+  // time, which is the whole defect class this fix is about.
+  isHexField,
   sha256Hex,
   utf8,
   verifyRsaPssSha256,
@@ -30,6 +35,7 @@ import {
   contentHashes,
   exceedsDepth,
   jcs,
+  jcsParse,
   verifyEnvelope,
 } from "./verifier.js";
 import {
@@ -48,37 +54,73 @@ const ACCEPTED_EVIDENCE_MAJORS = ["sanning.evidence/v1"];
 // body_type is not a hard failure of the WRAPPER (the signature + body_hash
 // still verify), but its body cannot be re-derived, so the per-body verdict is
 // "undetermined" rather than "verified".
-export const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v2";
+//
+// The producer-to-agent cut (W-3, DL-73) renamed `record_bytes` to
+// `event_bytes` and moved every body that carries it to a new major. This
+// kernel reads ONLY those majors: `sanning.anchor.trace/v1` and `/v2`,
+// `sanning.stamp.evidence/v1` and `sanning.evidence.export/v1` are unknown body
+// types here and answer `partial`. DL-73 releases evidence made before the cut
+// from any obligation to keep verifying, so there is no second field name to
+// read and no dual-accept path.
+export const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v3";
 
 /**
- * The frozen pre-`anchor_ref` body (evidence-bundle.md §5.1.3).
- *
- * Accepted PERMANENTLY, not for a deprecation window. Every bundle emitted
- * before 2026-09-03 carries this shape, and those bundles are evidence — a
- * reader that stopped accepting them would destroy the record it exists to
- * defend (DL-30). Nothing new emits it.
+ * The name `event_bytes` replaced. Under the new majors a body entry that still
+ * carries it is a hard reject, never an ignored unknown field: ignored, it
+ * would read as a withheld record and the event would verify with nothing
+ * checked, the fail-open the new majors exist to prevent (governance.md §8,
+ * W-3).
+ */
+export const LEGACY_EVENT_BYTES_FIELD = "record_bytes";
+
+/**
+ * Name an envelope the accept-set refused. Without this a bundle whose
+ * envelopes carry a retired profile major (a half-migrated producer still
+ * writing `sanning.events/v1`) fails with no reason at all. Spelled with
+ * `JSON.stringify` so both kernels write the same sentence.
  */
-export const ANCHOR_TRACE_BODY_TYPE_V1 = "sanning.anchor.trace/v1";
+function specVersionFinding(
+  what: "checkpoint" | "event",
+  envelope: unknown,
+  res: { specVersionOk: boolean },
+): string | null {
+  if (!isJsonObject(envelope) || res.specVersionOk) return null;
+  if (!Object.prototype.hasOwnProperty.call(envelope, "spec_version")) {
+    return `${what} envelope has no spec_version`;
+  }
+  const sv = (envelope as Record<string, unknown>).spec_version;
+  return `${what} envelope spec_version ${JSON.stringify(sv)} is not accepted by this kernel`;
+}
 
-/** Every anchor-trace body this kernel verifies. Order is newest-first. */
-export const ANCHOR_TRACE_BODY_TYPES = [
-  ANCHOR_TRACE_BODY_TYPE,
-  ANCHOR_TRACE_BODY_TYPE_V1,
-] as const;
+/**
+ * The reject for an entry that still carries `record_bytes`. One sentence,
+ * spelled the same in both kernels, so a negative vector can assert it.
+ */
+function legacyEventBytesError(
+  entry: object,
+  what: "checkpoint" | "event",
+  bodyType: string,
+): string | null {
+  if (!Object.prototype.hasOwnProperty.call(entry, LEGACY_EVENT_BYTES_FIELD)) return null;
+  return (
+    `${what} carries ${LEGACY_EVENT_BYTES_FIELD} in a ${bodyType} body ` +
+    "(renamed event_bytes) -- one bundle speaks one vocabulary"
+  );
+}
 
 // The issuer-composed attested-evidence-export body (specs/evidence-export.md
 // §2). The wrapper is unchanged (`sanning.evidence/v1`, Ed25519-signed); this body
 // carries a cached verdict + the inline source bundle + embedded RSA-PSS
 // operator attestations. verifyEvidenceBundle dispatches on it to
 // verifyExportBody (§5).
-export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
+export const EXPORT_BODY_TYPE = "sanning.evidence.export/v2";
 
 /**
  * The Sanning-signed interval stamp body (evidence-bundle.md §5.2, DL-58).
  *
  * Its own `body_type` rather than a widened anchor-trace body, and the reason
  * is the whole decision: an anchor-trace checkpoint carries a PRODUCER-signed
- * `sanning.events/v1` envelope, and a stamp has no producer signature at all —
+ * `sanning.events/v2` envelope, and a stamp has no producer signature at all:
  * Sanning places it, under DL-52, for a customer who holds no chain identity.
  * The two rejected options were making `envelope` optional and synthesising an
  * envelope that Sanning signs; the second would have made a Sanning
@@ -86,7 +128,7 @@ export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
  * unrecoverable once witnessed.
  */
 export const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
-export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v1";
+export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v2";
 
 /**
  * The version string INSIDE a witnessed stamp body — a different string from
@@ -107,7 +149,6 @@ export interface EvidenceIssuer {
   kind: string;
   tenant_id?: string;
   agent_id?: string;
-  producer_id?: string;
   [k: string]: unknown;
 }
 
@@ -136,13 +177,12 @@ export interface AnchorRef {
   ref?: Record<string, unknown>;
 }
 
-// `sanning.anchor.trace/v2` body (§5.1). Uint8Array fields ride as lowercase hex.
+// `sanning.anchor.trace/v3` body (§5.1). Uint8Array fields ride as lowercase hex.
 export interface TraceCheckpoint {
   /**
    * The checkpoint's identity and the join key, DERIVED: hex SHA-256 of the
-   * decoded `record_bytes`. Recomputed by the verifier — in v1 this was an
-   * asserted label matched against another asserted label, so a producer could
-   * relabel a checkpoint and the bundle still verified.
+   * decoded `event_bytes`. Recomputed by the verifier, never taken from the
+   * label.
    */
   checkpoint_ref: string;
   /**
@@ -152,32 +192,24 @@ export interface TraceCheckpoint {
    */
   anchor_ref?: AnchorRef;
   envelope: Envelope;
-  record_bytes: string; // hex of JCS(checkpoint record)
+  event_bytes: string; // hex of JCS(checkpoint record)
   merkle_root: string; // hex
 }
 
-/** The frozen `sanning.anchor.trace/v1` checkpoint (§5.1.3). Read, never written. */
-export interface TraceCheckpointV1 {
-  tx_id: string;
-  envelope: Envelope;
-  record_bytes: string;
-  merkle_root: string;
-}
-
 export interface TraceInclusion {
   leaf_hash: string; // hex
   leaf_index: number;
   leaf_count: number;
   audit_path: string[]; // hex[]
-  /** Resolves against `checkpoints[].checkpoint_ref`. v1 spells this `checkpoint_tx_id`. */
+  /** Resolves against `checkpoints[].checkpoint_ref`. */
   checkpoint_ref: string;
 }
 
 export interface TraceEvent {
   envelope: Envelope;
-  record_bytes?: string; // hex of JCS(event record); omitted == record withheld
+  event_bytes?: string; // hex of JCS(event record); omitted == record withheld
   // Opt-in disclosed raw bytes (lowercase hex) whose SHA-256 MUST equal the
-  // committed event.content_hash inside record_bytes (evidence-bundle §5.1).
+  // committed event.content_hash inside event_bytes (evidence-bundle §5.1).
   // Default-absent (minimal disclosure); absent ⇒ undetermined, not failed.
   content?: string;
   inclusion: TraceInclusion;
@@ -246,7 +278,7 @@ export interface StampTraceBody {
   stamps: StampEntry[];
 }
 
-// ---- `sanning.stamp.evidence/v1` wire types (evidence-bundle.md §5.3) -----
+// ---- `sanning.stamp.evidence/v2` wire types (evidence-bundle.md §5.3) -----
 //
 // Both halves of a DL-52 record, bound: the producer signs the envelope, and
 // Sanning signs and witnesses the stamp whose root commits to it. Neither
@@ -266,7 +298,7 @@ export interface StampEvidenceInclusion {
 
 export interface StampEvidenceEvent {
   envelope: Envelope;
-  record_bytes?: string; // hex of JCS(event record); omitted == withheld
+  event_bytes?: string; // hex of JCS(event record); omitted == withheld
   content?: string; // opt-in disclosed raw bytes, lowercase hex
   inclusion: StampEvidenceInclusion;
 }
@@ -327,23 +359,12 @@ export interface OnChainResult {
 }
 
 export interface CheckpointResult {
-  /**
-   * The checkpoint's join key AS THE BUNDLE SPELLS IT — the derived
-   * `checkpoint_ref` for a v2 body, the legacy `tx_id` for a frozen v1 body.
-   * Never re-derived across forms: a v1 bundle's key is its `tx_id`, because
-   * that is what its own events resolve against and what an attestation
-   * written against it carries.
-   */
+  /** The derived `checkpoint_ref`, empty when it could not be derived. */
   checkpointRef: string;
   /**
-   * Where this checkpoint was witnessed, normalised to one shape.
-   *
-   * `null` when a v2 checkpoint carries no `anchor_ref` — placed but not yet
-   * witnessed, which is a normal state and NOT a deficiency. For a frozen v1
-   * checkpoint this is synthesised as `{ kind: "arweave", id: tx_id }`, which
-   * is exactly what v1's spec said the field was ("the Arweave TX the
-   * checkpoint envelope was anchored as"). The synthesis is reader-side only
-   * and never re-enters a signed artifact or a verdict.
+   * Where this checkpoint was witnessed. `null` when the checkpoint carries no
+   * `anchor_ref`: placed but not yet witnessed, which is a normal state and NOT
+   * a deficiency.
    */
   anchorRef: AnchorRef | null;
   // The checkpoint envelope verified (signature + payload binding to its record).
@@ -351,11 +372,15 @@ export interface CheckpointResult {
   // The committed record's merkle_root equals the checkpoint's claimed merkle_root.
   merkleRootOk: boolean;
   // If gateways were supplied: the on-chain bytes at tx_id matched the envelope.
-  // null when no gateway re-fetch was requested. Derived collapse of `onChain`
-  // (§4.2), retained so existing consumers keep the single-boolean field.
+  // null when no gateway re-fetch was requested, or when `anchor_ref.kind` has
+  // no witness adapter, or its id is not one the adapter accepts; the witness
+  // was not checked. Derived collapse of `onChain` (§4.2), retained so existing
+  // consumers keep the single-boolean field.
   onChainOk: boolean | null;
   // Per-gateway on-chain outcomes (§4.2), ADDITIVE to `onChainOk`. null when no
-  // gateway re-fetch was requested (offline-only verification).
+  // gateway re-fetch was requested (offline-only verification), or when
+  // `anchor_ref.kind` has no witness adapter, or its id is not one the adapter
+  // accepts; the witness was not checked.
   onChain: OnChainResult | null;
   ok: boolean;
   errors: string[];
@@ -373,7 +398,7 @@ export interface EventResult {
   // The inclusion's checkpoint_ref resolved to a checkpoint in the bundle.
   checkpointBound: boolean;
   // Raw-log (content) binding: SHA-256 of the disclosed bytes equals the
-  // committed event.content_hash (in record_bytes) — or, for a promoted
+  // committed event.content_hash (in event_bytes), or, for a promoted
   // envelope, a hash it commits to. true matched, false mismatch (→ event
   // fails), null undetermined (nothing disclosed OR nothing committed OR record
   // withheld — NOT a failure, mirroring payloadBindingOk).
@@ -435,12 +460,14 @@ export interface StampResult {
    * ── The four states, and why none of them collapses ──
    *
    * `null` means not checked — no gateways were supplied, or this stamp names
-   * no witness to check. It is a statement about the RUN, never about the
-   * stamp. The other three are statements about the stamp and live in
-   * `onChain.rollup`: `confirm` (a gateway returned the witnessed bytes),
-   * `mismatch` (a gateway returned DIFFERENT bytes — a finding, and the only
-   * one of the four that fails anything), `unreachable` (we asked and nobody
-   * answered — an availability gap, never an accusation).
+   * no witness to check, or its `anchor_ref.kind` has no witness adapter, or
+   * its id is not one the adapter accepts; the witness was not checked. It is
+   * a statement about the RUN, never about the stamp. The other three are
+   * statements about the stamp and live in `onChain.rollup`: `confirm` (a
+   * gateway returned the witnessed bytes), `mismatch` (a gateway returned
+   * DIFFERENT bytes: a finding, and the only one of the four that fails
+   * anything), `unreachable` (we asked and nobody answered: an availability
+   * gap, never an accusation).
    *
    * Keeping "not checked" distinct from "unreachable" is the whole point. A
    * surface handed a collapsed boolean cannot tell "no gateway could be
@@ -474,7 +501,7 @@ export interface EvidenceBundleResult {
   events: EventResult[];
   // The producer's asserted verdict.status (for display only — never trusted).
   assertedStatus: string | null;
-  // Present ONLY for a `sanning.evidence.export/v1` body (evidence-export.md §5):
+  // Present ONLY for a `sanning.evidence.export/v2` body (evidence-export.md §5):
   // the export-specific dimensions (source linkage, verdict agreement, embedded
   // attestations, recomputed §4 verdict). The top-level `checkpoints`/`events`
   // above are the recomputed SOURCE-bundle results in that case. Absent for a
@@ -494,11 +521,7 @@ export interface EvidenceBundleResult {
 // One embedded operator attestation record (§2.2 / §3). RSA-PSS-SHA-256 over
 // JCS(payload); the operator key is the operator's Arweave RSA wallet.
 export interface AttestationRecord {
-  /**
-   * The source checkpoint this attestation binds to, spelled in the SOURCE
-   * bundle's vocabulary: `checkpoint_ref` for a v2 source, the legacy `tx_id`
-   * for a frozen v1 one. Not re-derived across forms.
-   */
+  /** The source checkpoint's derived `checkpoint_ref` this attestation binds to. */
   checkpoint_ref: string;
   payload: AttestationPayload;
   signature_alg: string; // "rsa-pss-sha256"
@@ -656,12 +679,23 @@ function isEvidenceMajorAccepted(specVersion: unknown): boolean {
   });
 }
 
-function malformed(error: string, specVersionOk = false): EvidenceBundleResult {
+/**
+ * A bundle this kernel cannot read.
+ *
+ * `wrapperOk` is true only where the wrapper signature and `body_hash` were
+ * CHECKED and held before the body was found unreadable. It is then reported
+ * as held, because it did: `signatureOk` and `bodyHashOk` are statements about
+ * the wrapper, and a body this kernel cannot parse does not unsign it. The
+ * case reader decides whose pack a bundle is on exactly those two fields
+ * (`evidence-bundle.md` 5.5.1), so reporting `false` here let a holder who
+ * broke its own body shape read as a forger.
+ */
+function malformed(error: string, specVersionOk = false, wrapperOk = false): EvidenceBundleResult {
   return {
     status: "malformed",
     specVersionOk,
-    bodyHashOk: false,
-    signatureOk: false,
+    bodyHashOk: wrapperOk,
+    signatureOk: wrapperOk,
     bodyType: null,
     onChainChecked: false,
     checkpoints: [],
@@ -671,8 +705,79 @@ function malformed(error: string, specVersionOk = false): EvidenceBundleResult {
   };
 }
 
-function stringifyErr(e: unknown): string {
-  return e instanceof Error ? e.message : String(e);
+/**
+ * The prefixes of the exception text this kernel writes ITSELF, in the words
+ * the Python kernel writes too. Anything outside this set comes from the host:
+ * a JSON parser, a codec, a crypto library. See `thrownDetail`.
+ */
+const KERNEL_WORDING = ["hexToBytes: "];
+
+/**
+ * The detail a finding may append about a caught exception.
+ *
+ * THE RULE: a finding carries the text of a caught exception only where this
+ * kernel wrote that text. A finding travels into a case reading through `case`
+ * `reasons`, and both kernels promise one reading and one rendered sentence for
+ * one set of bytes; a host JSON parser says `Unexpected token 'h', "hello" is
+ * not valid JSON` here and `Expecting value: line 1 column 1 (char 0)` there,
+ * for one pack anyone can build (gate 4 on proof#140, finding 1).
+ *
+ * Returns `": <text>"` for this kernel's own wording and the empty string for
+ * anything else. The label at the call site already names the check that
+ * failed and both kernels agree on it character for character; what is dropped
+ * is the host's parse offset, which no reader can act on and which was never
+ * the same in the two kernels.
+ */
+function thrownDetail(e: unknown): string {
+  const text = e instanceof Error ? e.message : String(e);
+  return KERNEL_WORDING.some((w) => text.startsWith(w)) ? `: ${text}` : "";
+}
+
+/**
+ * Decode `bytes` as UTF-8 the way every other kernel does: a byte sequence that
+ * is not valid UTF-8 THROWS, and a leading byte-order mark is kept rather than
+ * eaten.
+ *
+ * ONE CALLER LEFT, and it is not a parse. `jcsParse` (`verifier.ts`) reads
+ * every set of signed bytes in this kernel now; this function survives only for
+ * the canonicality comparison on the stamp path, which needs the DECODED TEXT
+ * of bytes `jcsParse` has already accepted, to compare against `jcs(body)`. It
+ * performs exactly the decode `jcsParse` performs, so the comparison cannot
+ * read the bytes differently from the parse that produced `body`.
+ *
+ * `new TextDecoder()` alone is neither strict nor BOM-preserving: it replaces
+ * every invalid sequence with U+FFFD and strips a BOM. A stamp body carrying
+ * one raw `0x80` inside a string value read `verified` here and `failed` there
+ * because of it (gate 4 on proof#140). The symmetric claim the first version of
+ * this comment made, that "Python's `json.loads` raises on both", is FALSE and
+ * is what hid gate 5's defect for a round: `json.loads(<bytes>)` strips a BOM
+ * too. Python's strict reader is `jcs_loads`, and the rule both kernels hold to
+ * is stated once, in `jcsParse`.
+ */
+function decodeUtf8Strict(bytes: Uint8Array): string {
+  return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+}
+
+/**
+ * Name an envelope `public_key` or `signature` spelled outside the hex charset
+ * or at the wrong length (proof#142). This kernel's envelope layer already
+ * fails such an envelope, and the Python one's decoder accepts ASCII
+ * whitespace (proof#135), so both bundle verifiers name it here, in the same
+ * words, and the two kernels give one reading. Only a STRING is checked: a
+ * missing or non-string field is the envelope layer's to fail, and it does.
+ */
+function envelopeHexError(what: string, envelope: unknown): string | null {
+  if (!isJsonObject(envelope)) return null;
+  for (const [name, nibbles] of [
+    ["public_key", 64],
+    ["signature", 128],
+  ] as const) {
+    const value = envelope[name];
+    if (typeof value === "string" && !isHexField(value, nibbles)) {
+      return `${what} envelope ${name} is not ${nibbles} hex characters`;
+    }
+  }
+  return null;
 }
 
 /**
@@ -689,7 +794,7 @@ function jsonStr(value: unknown): string {
   return JSON.stringify(value === undefined ? null : value) ?? "null";
 }
 
-// Verify a `sanning.evidence/v1` bundle carrying a `sanning.anchor.trace/v1` body.
+// Verify a `sanning.evidence/v1` bundle and dispatch on its `body_type`.
 //
 // Returns a structured per-checkpoint + per-event result and a recomputed
 // rollup `status`. The producer's asserted `verdict.status` is surfaced
@@ -698,6 +803,16 @@ function jsonStr(value: unknown): string {
 export async function verifyEvidenceBundle(
   bundle: unknown,
   options: VerifyEvidenceOptions = {},
+): Promise<EvidenceBundleResult> {
+  return verifyBundle(bundle, options, false);
+}
+
+// `exportSource`: read the bundle as an export's source (evidence-export.md
+// §2.4), where the only recognised body is `sanning.anchor.trace/v3`.
+async function verifyBundle(
+  bundle: unknown,
+  options: VerifyEvidenceOptions,
+  exportSource: boolean,
 ): Promise<EvidenceBundleResult> {
   // --- Step 1: parse + reject unknown spec_version major ---------------------
   if (bundle === null || typeof bundle !== "object" || Array.isArray(bundle)) {
@@ -737,26 +852,44 @@ export async function verifyEvidenceBundle(
   // --- Step 2: verify the wrapper signature + recompute body_hash ------------
   const errors: string[] = [];
 
+  // Every wrapper hex field is read STRICTLY, before any decoder sees it
+  // (proof#142). The Python decoder skipped ASCII whitespace, and the wrapper
+  // `signature` sits outside the signed scope, so one space in it, added by
+  // anyone and with no key, made a pack verify there and fail here. The same
+  // named failure in both kernels, for each field: `public_key` and
+  // `signature` are 64 and 128 hex characters in either case (proof#135,
+  // option B), and `body_hash` is 64 LOWER-case hex characters, the form it is
+  // recomputed in and compared against.
   let bodyHashOk = false;
-  try {
-    const recomputed = await sha256Hex(utf8(jcs(b.body)));
-    bodyHashOk = recomputed === b.body_hash;
-    if (!bodyHashOk) {
-      errors.push(`body_hash mismatch: bundle=${b.body_hash} recomputed=${recomputed}`);
+  if (!isHexField(b.body_hash, 64, true)) {
+    errors.push("wrapper body_hash is not 64 lowercase hex characters");
+  } else {
+    try {
+      const recomputed = await sha256Hex(utf8(jcs(b.body)));
+      bodyHashOk = recomputed === b.body_hash;
+      if (!bodyHashOk) {
+        errors.push(`body_hash mismatch: bundle=${b.body_hash} recomputed=${recomputed}`);
+      }
+    } catch (e) {
+      errors.push(`body canonicalization failed${thrownDetail(e)}`);
     }
-  } catch (e) {
-    errors.push(`body canonicalization failed: ${stringifyErr(e)}`);
   }
 
   let signatureOk = false;
-  try {
-    const { signature: _sig, co_signatures: _co, ...bundleForSig } = b as EvidenceBundle & {
-      co_signatures?: unknown;
-    };
-    signatureOk = await ed25519Verify(b.signature, utf8(jcs(bundleForSig)), b.public_key);
-    if (!signatureOk) errors.push("wrapper Ed25519 signature verification failed");
-  } catch (e) {
-    errors.push(`wrapper signature verification error: ${stringifyErr(e)}`);
+  const keyFormOk = isHexField(b.public_key, 64);
+  const signatureFormOk = isHexField(b.signature, 128);
+  if (!keyFormOk) errors.push("wrapper public_key is not 64 hex characters");
+  if (!signatureFormOk) errors.push("wrapper signature is not 128 hex characters");
+  if (keyFormOk && signatureFormOk) {
+    try {
+      const { signature: _sig, co_signatures: _co, ...bundleForSig } = b as EvidenceBundle & {
+        co_signatures?: unknown;
+      };
+      signatureOk = await ed25519Verify(b.signature, utf8(jcs(bundleForSig)), b.public_key);
+      if (!signatureOk) errors.push("wrapper Ed25519 signature verification failed");
+    } catch (e) {
+      errors.push(`wrapper signature verification error${thrownDetail(e)}`);
+    }
   }
 
   const assertedStatus = typeof b.verdict?.status === "string" ? b.verdict.status : null;
@@ -781,6 +914,28 @@ export async function verifyEvidenceBundle(
   // --- Body dispatch ---------------------------------------------------------
   const bodyType = typeof b.body_type === "string" ? b.body_type : null;
 
+  // Read as an export's source (evidence-export.md §2.4), the only body this
+  // kernel recognises is sanning.anchor.trace/v3. Any other body, even one it
+  // verifies on its own, is undetermined here, after the wrapper checks above.
+  if (exportSource && bodyType !== ANCHOR_TRACE_BODY_TYPE) {
+    errors.push(
+      `body_type ${JSON.stringify(bodyType)} is not an export source ` +
+        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`,
+    );
+    return {
+      status: "partial",
+      specVersionOk,
+      bodyHashOk,
+      signatureOk,
+      bodyType,
+      onChainChecked: false,
+      checkpoints: [],
+      events: [],
+      assertedStatus,
+      errors,
+    };
+  }
+
   // Attested-evidence-export body (evidence-export.md §5). The wrapper is
   // authentic (Ed25519 issuer signature + body_hash verified above, §5 step 2);
   // hand off to the export verifier for steps 3–9.
@@ -800,13 +955,13 @@ export async function verifyEvidenceBundle(
     return verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options);
   }
 
-  if (bodyType !== ANCHOR_TRACE_BODY_TYPE && bodyType !== ANCHOR_TRACE_BODY_TYPE_V1) {
+  if (bodyType !== ANCHOR_TRACE_BODY_TYPE) {
     // The wrapper is authentic but we don't know this body's structure. Per
     // wrap-don't-merge, that is "partial" (cryptographically sound wrapper,
     // body verdict undetermined) — not a failure.
     errors.push(
       `body_type ${JSON.stringify(bodyType)} is not verifiable by this kernel ` +
-        `(only ${ANCHOR_TRACE_BODY_TYPES.join(", ")}); wrapper verified, body undetermined`,
+        `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`,
     );
     return {
       status: "partial",
@@ -822,114 +977,120 @@ export async function verifyEvidenceBundle(
     };
   }
 
-  return verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, errors, options);
+  return verifyAnchorTrace(b, specVersionOk, assertedStatus, errors, options);
 }
 
 /**
- * Index a source bundle's checkpoints by the key its attestations will use.
+ * Recompute an export's source verdict (evidence-export.md §5 step 4).
  *
- * The attestation join key follows the SOURCE bundle's own vocabulary — a
- * v2 source is keyed by `checkpoint_ref`, a frozen v1 source by `tx_id`. The
- * alternative (always deriving a v2-style key) would silently un-resolve every
- * attestation ever written against a v1 export: `data_hash_bound` would go
- * false, the export would stop reaching `verified`, and nothing would say why.
+ * The only export source is `sanning.anchor.trace/v3` (§2.2, §2.4). Any other
+ * inline source body is unrecognised *as a source*, even one this kernel
+ * verifies on its own, such as a `sanning.stamp.evidence/v2` pack: §2.4 makes
+ * its source verdict undetermined, so the export cannot reach `verified`. The
+ * source wrapper is still checked first, because a forged source is a failure
+ * whatever its body.
+ */
+async function verifyExportSource(
+  source: unknown,
+  options: VerifyEvidenceOptions,
+): Promise<EvidenceBundleResult> {
+  return verifyBundle(source, options, true);
+}
+
+/**
+ * Index a source bundle's checkpoints by the key its attestations use: the
+ * derived `checkpoint_ref`. Only a `sanning.anchor.trace/v3` source has
+ * checkpoints an attestation can resolve (evidence-export.md §2.4).
  */
 async function indexSourceCheckpoints(
   bundle: EvidenceBundle,
 ): Promise<Map<string, AnyTraceCheckpoint>> {
   const out = new Map<string, AnyTraceCheckpoint>();
+  if (!isJsonObject(bundle) || bundle.body_type !== ANCHOR_TRACE_BODY_TYPE) return out;
   const sb = bundle.body as AnchorTraceBody | undefined;
-  const isV1 = bundle.body_type === ANCHOR_TRACE_BODY_TYPE_V1;
   if (!sb || typeof sb !== "object" || !Array.isArray(sb.checkpoints)) return out;
   for (const cp of sb.checkpoints as AnyTraceCheckpoint[]) {
     if (!cp || typeof cp !== "object") continue;
-    let recordBytes: Uint8Array | undefined;
+    let eventBytes: Uint8Array | undefined;
     try {
-      if (typeof cp.record_bytes === "string") recordBytes = hexToBytes(cp.record_bytes);
+      if (typeof cp.event_bytes === "string") eventBytes = hexToBytes(cp.event_bytes);
     } catch {
-      recordBytes = undefined;
+      eventBytes = undefined;
     }
-    const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
+    const keyed = await resolveCheckpointKey(cp, eventBytes);
     if (keyed.key !== null && !out.has(keyed.key)) out.set(keyed.key, cp);
   }
   return out;
 }
 
-/** Either shape of checkpoint, before the form is resolved. */
-type AnyTraceCheckpoint = Partial<TraceCheckpoint> & Partial<TraceCheckpointV1>;
+/** A checkpoint as it arrives, before any field is trusted. */
+type AnyTraceCheckpoint = Partial<TraceCheckpoint> & { tx_id?: unknown };
 
 /**
- * Resolve a checkpoint's join key and its witness reference, for whichever
- * body form we are reading.
+ * Resolve a checkpoint's join key and its witness reference.
  *
- * ── The rule that matters, and why it is a reject rather than a preference ──
+ * ── Why a retired spelling is a reject rather than a preference ──
  *
- * A checkpoint carrying BOTH vocabularies is two answers to one question
- * inside one signature. A reader that silently prefers one gives a different
- * answer from a reader that prefers the other, over the same signed bytes —
- * and both look like they verified. So a v2 body carrying `tx_id`, or a v1
- * body carrying `anchor_ref`/`checkpoint_ref`, is rejected rather than
- * resolved. This is cheap to enforce here and impossible to enforce later.
+ * A checkpoint carrying a retired spelling beside the current one is two
+ * answers to one question inside one signature. A reader that silently prefers
+ * one gives a different answer from a reader that prefers the other, over the
+ * same signed bytes, and both look like they verified. So `tx_id` and
+ * `record_bytes` are rejected rather than resolved.
  *
- * ── Why v2's key is recomputed ──
+ * ── Why the key is recomputed ──
  *
- * In v1 the key was an asserted label matched against another asserted label;
- * nothing tied either to the bytes, so relabelling a checkpoint and every
- * event pointing at it left a bundle that still verified. In v2 the key IS the
- * bytes, so the same relabel fails here. v1's behaviour is preserved exactly
- * as it was — deliberately, because those bundles are already signed and
- * re-interpreting them is not backwards compatibility.
+ * The key IS the bytes: relabelling a checkpoint and every event pointing at it
+ * fails here, because nothing is taken from the label.
  */
 async function resolveCheckpointKey(
   cp: AnyTraceCheckpoint,
-  recordBytes: Uint8Array | undefined,
-  isV1: boolean,
-): Promise<{ key: string | null; anchorRef: AnchorRef | null; errors: string[] }> {
+  eventBytes: Uint8Array | undefined,
+): Promise<{
+  key: string | null;
+  anchorRef: AnchorRef | null;
+  anchorRefMalformed: boolean;
+  errors: string[];
+}> {
   const errors: string[] = [];
-
-  if (isV1) {
-    if (cp.checkpoint_ref !== undefined || cp.anchor_ref !== undefined) {
-      errors.push(
-        "sanning.anchor.trace/v1 checkpoint carries v2 fields (checkpoint_ref/anchor_ref) -- " +
-          "one bundle speaks one vocabulary",
-      );
-      return { key: null, anchorRef: null, errors };
-    }
-    if (typeof cp.tx_id !== "string" || cp.tx_id === "") {
-      errors.push("checkpoint missing tx_id");
-      return { key: null, anchorRef: null, errors };
-    }
-    // v1's tx_id IS an Arweave transaction — its own spec said so. Surfacing it
-    // through the same shape as v2 gives ONE reader-side vocabulary without
-    // touching a byte of the signed bundle.
-    return { key: cp.tx_id, anchorRef: { kind: "arweave", id: cp.tx_id }, errors };
-  }
+  // Every early return below leaves before `anchor_ref` is ever looked at, so
+  // nothing there is "malformed": it is unexamined, which is not the same claim.
+  const unexamined = { key: null, anchorRef: null, anchorRefMalformed: false, errors };
 
   if (cp.tx_id !== undefined) {
     errors.push(
-      "sanning.anchor.trace/v2 checkpoint carries legacy tx_id -- one bundle speaks one vocabulary",
+      `${ANCHOR_TRACE_BODY_TYPE} checkpoint carries legacy tx_id -- one bundle speaks one vocabulary`,
     );
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
+  }
+  const legacy = legacyEventBytesError(cp, "checkpoint", ANCHOR_TRACE_BODY_TYPE);
+  if (legacy !== null) {
+    errors.push(legacy);
+    return unexamined;
   }
   if (typeof cp.checkpoint_ref !== "string" || cp.checkpoint_ref === "") {
     errors.push("checkpoint missing checkpoint_ref");
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
   }
-  if (recordBytes === undefined) {
+  if (eventBytes === undefined) {
     // Without the bytes the key cannot be recomputed, so it cannot be trusted.
-    errors.push("checkpoint_ref cannot be verified -- record_bytes missing or not hex");
-    return { key: null, anchorRef: null, errors };
+    errors.push("checkpoint_ref cannot be verified -- event_bytes missing or not hex");
+    return unexamined;
   }
-  const derived = await sha256Hex(recordBytes);
+  const derived = await sha256Hex(eventBytes);
   if (derived !== cp.checkpoint_ref.toLowerCase()) {
     errors.push(
-      `checkpoint_ref does not match SHA-256(record_bytes): claimed=${cp.checkpoint_ref} derived=${derived}`,
+      `checkpoint_ref does not match SHA-256(event_bytes): claimed=${cp.checkpoint_ref} derived=${derived}`,
     );
-    return { key: null, anchorRef: null, errors };
+    return unexamined;
   }
 
-  const anchorRef = parseAnchorRef(cp.anchor_ref, errors);
-  return { key: derived, anchorRef, errors };
+  const parsed = parseAnchorRef(cp.anchor_ref, errors);
+  return {
+    key: derived,
+    anchorRef: parsed.ref,
+    anchorRefMalformed: parsed.malformed,
+    errors,
+  };
 }
 
 /**
@@ -949,46 +1110,64 @@ async function resolveCheckpointKey(
  * So this validates the SHAPE and never the vocabulary. A malformed
  * `anchor_ref` is a defect in the bundle; an unknown `kind` is a defect in
  * the reader, and only the first is the bundle's fault.
+ *
+ * ── Absent and malformed are not the same null (proof#120) ──
+ *
+ * Both leave no `AnchorRef` to re-fetch, and both used to be reported the same
+ * way downstream: an all-`unreachable` on-chain result, although no gateway was
+ * asked in either case. For the ABSENT case that is at least the note
+ * `evidence-bundle.md` §5.1.1 reserves for "a checkpoint with no `anchor_ref`".
+ * For the MALFORMED case it is a manufactured outage: the bundle named a
+ * witness, the name was unreadable, and the reader was told the public record
+ * could not be reached. So the two come back as different facts, and `malformed`
+ * carries the difference.
  */
-function parseAnchorRef(raw: unknown, errors: string[]): AnchorRef | null {
-  if (raw === undefined || raw === null) return null; // placed, not yet witnessed
+function parseAnchorRef(
+  raw: unknown,
+  errors: string[],
+): { ref: AnchorRef | null; malformed: boolean } {
+  if (raw === undefined || raw === null) {
+    return { ref: null, malformed: false }; // placed, not yet witnessed
+  }
   if (typeof raw !== "object" || Array.isArray(raw)) {
     errors.push("anchor_ref must be an object");
-    return null;
+    return { ref: null, malformed: true };
   }
   const o = raw as Record<string, unknown>;
   if (typeof o.kind !== "string" || !/^[a-z0-9][a-z0-9._-]*$/.test(o.kind)) {
     errors.push(`anchor_ref.kind is missing or malformed: ${JSON.stringify(o.kind)}`);
-    return null;
+    return { ref: null, malformed: true };
   }
   if (typeof o.id !== "string" || o.id === "") {
     errors.push("anchor_ref.id is missing or empty");
-    return null;
+    return { ref: null, malformed: true };
   }
   const ref = o.ref;
   if (ref !== undefined && (typeof ref !== "object" || ref === null || Array.isArray(ref))) {
     errors.push("anchor_ref.ref must be an object when present");
-    return null;
+    return { ref: null, malformed: true };
   }
   return {
-    kind: o.kind,
-    id: o.id,
-    ...(ref === undefined ? {} : { ref: ref as Record<string, unknown> }),
+    ref: {
+      kind: o.kind,
+      id: o.id,
+      ...(ref === undefined ? {} : { ref: ref as Record<string, unknown> }),
+    },
+    malformed: false,
   };
 }
 
 async function verifyAnchorTrace(
   b: EvidenceBundle,
-  bodyType: string,
   specVersionOk: boolean,
   assertedStatus: string | null,
   errors: string[],
   options: VerifyEvidenceOptions,
 ): Promise<EvidenceBundleResult> {
   const body = b.body as AnchorTraceBody;
-  const isV1 = bodyType === ANCHOR_TRACE_BODY_TYPE_V1;
+  const bodyType = ANCHOR_TRACE_BODY_TYPE;
   if (!Array.isArray(body.checkpoints) || !Array.isArray(body.events)) {
-    return malformed(`${bodyType} body must have checkpoints[] and events[]`, true);
+    return malformed(`${bodyType} body must have checkpoints[] and events[]`, true, true);
   }
 
   const gateways = options.gateways ?? [];
@@ -1005,6 +1184,11 @@ async function verifyAnchorTrace(
   const byKey = new Map<string, AnyTraceCheckpoint>();
   const anchorByKey = new Map<string, AnchorRef | null>();
   const checkpointResults: CheckpointResult[] = [];
+  // proof#120. Kept beside the results rather than on them: "the bundle named
+  // a witness we could not read" is an input defect the checkpoint's own
+  // `errors` already states, not a new dimension of the published verdict, and
+  // `CheckpointResult` is a shape downstream surfaces render.
+  const malformedAnchorRef = new Set<CheckpointResult>();
   for (const rawCp of body.checkpoints as unknown[]) {
     // `checkpoints[]` is attacker-shaped, and a verifier must never raise on
     // adversarial input: a null entry used to reach `cp.tx_id` and hand the
@@ -1032,16 +1216,16 @@ async function verifyAnchorTrace(
     let envelopeOk = false;
     let merkleRootOk = false;
 
-    // Decode record_bytes first: in v2 the join key is DERIVED from it, so it
+    // Decode event_bytes first: in v2 the join key is DERIVED from it, so it
     // is an input to identity, not just to the payload binding below.
-    let recordBytes: Uint8Array | undefined;
+    let eventBytes: Uint8Array | undefined;
     try {
-      if (typeof cp.record_bytes === "string") recordBytes = hexToBytes(cp.record_bytes);
+      if (typeof cp.event_bytes === "string") eventBytes = hexToBytes(cp.event_bytes);
     } catch (e) {
-      cpErrors.push(`checkpoint record_bytes is not hex: ${stringifyErr(e)}`);
+      cpErrors.push(`checkpoint event_bytes is not hex${thrownDetail(e)}`);
     }
 
-    const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
+    const keyed = await resolveCheckpointKey(cp, eventBytes);
     cpErrors.push(...keyed.errors);
     // A duplicate key is a HARD failure, not a note. `byKey` below keeps the
     // FIRST occurrence, so a second checkpoint claiming the same key is
@@ -1055,7 +1239,7 @@ async function verifyAnchorTrace(
     let duplicateKey = false;
     if (keyed.key !== null) {
       if (byKey.has(keyed.key)) {
-        cpErrors.push(`duplicate checkpoint ${isV1 ? "tx_id" : "checkpoint_ref"} ${keyed.key}`);
+        cpErrors.push(`duplicate checkpoint checkpoint_ref ${keyed.key}`);
         duplicateKey = true;
       } else {
         byKey.set(keyed.key, cp);
@@ -1068,16 +1252,19 @@ async function verifyAnchorTrace(
     try {
       const res = await verifyEnvelope(
         cp.envelope as Envelope,
-        recordBytes !== undefined ? { payloadBytes: recordBytes } : {},
+        eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
       // A checkpoint must fully bind: signature + the committed record matching
       // payload_hash. An undetermined binding (no record) is not enough to
       // anchor the events' inclusion claims to a trustworthy root.
-      envelopeOk = res.ok && res.payloadHashOk === true;
+      const hexError = envelopeHexError("checkpoint", cp.envelope);
+      envelopeOk = res.ok && res.payloadHashOk === true && hexError === null;
       // See the event loop below: a degenerate envelope is a malformed input,
       // not a failed check (proof#76).
       if (!isJsonObject(cp.envelope)) {
         cpErrors.push("checkpoint envelope is not a JSON object");
+      } else if (hexError !== null) {
+        cpErrors.push(hexError);
       } else if (!res.signatureOk) {
         cpErrors.push("checkpoint envelope signature failed");
       }
@@ -1085,27 +1272,29 @@ async function verifyAnchorTrace(
       // proof#95: a malformed skeleton field fails the envelope with a valid
       // signature and binding; name it rather than fail with no reason.
       for (const m of res.errors) if (m.startsWith("malformed ")) cpErrors.push(`checkpoint envelope ${m}`);
+      const specFinding = specVersionFinding("checkpoint", cp.envelope, res);
+      if (specFinding !== null) cpErrors.push(specFinding);
       // WHY the binding is undetermined decides which sentence is true.
-      // record_bytes really absent is one thing; record_bytes present and
+      // event_bytes really absent is one thing; event_bytes present and
       // unbindable (a degenerate envelope, unreadable hex) is another, and
       // naming the wrong cause sends a reader to look for a field that is
       // sitting right there (proof#76).
       if (res.payloadHashOk === null) {
         cpErrors.push(
-          recordBytes === undefined
-            ? "checkpoint record_bytes missing -- root untrusted"
+          eventBytes === undefined
+            ? "checkpoint event_bytes missing -- root untrusted"
             : "checkpoint record binding not checked: root untrusted",
         );
       }
     } catch (e) {
-      cpErrors.push(`checkpoint envelope verify error: ${stringifyErr(e)}`);
+      cpErrors.push(`checkpoint envelope verify error${thrownDetail(e)}`);
     }
 
     // The committed record's merkle_root must equal the checkpoint's claimed
     // merkle_root (recompute, don't trust the bundle's top-level claim).
-    if (recordBytes !== undefined) {
+    if (eventBytes !== undefined) {
       try {
-        const record = JSON.parse(new TextDecoder().decode(recordBytes)) as {
+        const record = jcsParse(eventBytes) as {
           event?: { merkle_root?: unknown };
         };
         const committedRoot = record.event?.merkle_root;
@@ -1117,7 +1306,7 @@ async function verifyAnchorTrace(
           );
         }
       } catch (e) {
-        cpErrors.push(`checkpoint record is not JSON: ${stringifyErr(e)}`);
+        cpErrors.push(`checkpoint record is not JSON${thrownDetail(e)}`);
       }
     }
 
@@ -1137,6 +1326,9 @@ async function verifyAnchorTrace(
       ok: envelopeOk && merkleRootOk && keyed.errors.length === 0 && !duplicateKey,
       errors: cpErrors,
     });
+    if (keyed.anchorRefMalformed) {
+      malformedAnchorRef.add(checkpointResults[checkpointResults.length - 1]);
+    }
   }
 
   // --- Step 4: per-event ------------------------------------------------------
@@ -1164,18 +1356,42 @@ async function verifyAnchorTrace(
     let envelopeOk = false;
     let payloadBindingOk: boolean | null = null;
 
-    let recordBytes: Uint8Array | undefined;
+    // A retired field name under this major is a reject, never an ignored
+    // unknown field: ignored, it reads as a withheld record (W-3).
+    const legacyError = legacyEventBytesError(ev, "event", bodyType);
+    if (legacyError !== null) evErrors.push(legacyError);
+
+    // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
+    //
+    // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
+    // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
+    // line down. So an event carrying garbage in place of its record used to
+    // reach the same tri-state as an event carrying nothing: `payloadHashOk`
+    // null, `ok` true, a leading tick on the line, and a `verified` rollup over
+    // a record nobody could read. The only thing wrong with the pack was the
+    // bytes, and it was the one thing the verdict did not say.
+    //
+    // A record the producer chose not to disclose is the customer exercising
+    // minimum disclosure. A record that is present and unreadable is a defect
+    // in the artifact, and this kernel's standing rule (the same one
+    // `checkpoints[]` already applies through `keyed.errors`) is that a defect
+    // we can see fails.
+    let eventBytes: Uint8Array | undefined;
+    let eventBytesMalformed = false;
     try {
-      if (typeof ev.record_bytes === "string") recordBytes = hexToBytes(ev.record_bytes);
+      if (typeof ev.event_bytes === "string") eventBytes = hexToBytes(ev.event_bytes);
     } catch (e) {
-      evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+      eventBytesMalformed = true;
+      evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
     }
     try {
       const res = await verifyEnvelope(
         ev.envelope,
-        recordBytes !== undefined ? { payloadBytes: recordBytes } : {},
+        eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
-      envelopeOk = res.ok; // ok tolerates an undetermined binding (withheld record)
+      const hexError = envelopeHexError("event", ev.envelope);
+      // ok tolerates an undetermined binding (withheld record)
+      envelopeOk = res.ok && hexError === null;
       payloadBindingOk = res.payloadHashOk;
       // P-10: report what could not be determined, never a fault that was never
       // observed. There is no envelope here, so no signature was checked and no
@@ -1186,6 +1402,8 @@ async function verifyAnchorTrace(
       // the producer at all (proof#76).
       if (!isJsonObject(ev.envelope)) {
         evErrors.push("event envelope is not a JSON object");
+      } else if (hexError !== null) {
+        evErrors.push(hexError);
       } else if (!res.signatureOk) {
         evErrors.push("event envelope signature failed");
       }
@@ -1193,19 +1411,20 @@ async function verifyAnchorTrace(
       // A malformed skeleton field fails the envelope with a valid signature
       // and binding (proof#95), so without this the event fails with no reason.
       for (const m of res.errors) if (m.startsWith("malformed ")) evErrors.push(`event envelope ${m}`);
+      const specFinding = specVersionFinding("event", ev.envelope, res);
+      if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
-      evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+      evErrors.push(`event envelope verify error${thrownDetail(e)}`);
     }
 
     // Bind the event to exactly one checkpoint in the bundle, then verify
     // RFC 9162 inclusion against THAT checkpoint's merkle_root.
     const incl = ev.inclusion as (TraceInclusion & { checkpoint_tx_id?: unknown }) | undefined;
-    // The join key is spelled differently in the two forms and MUST NOT be read
-    // from the other one: an inclusion carrying v1's spelling inside a v2 body
-    // is a mixed bundle, and resolving it anyway is how an event silently binds
-    // to a checkpoint nobody meant.
-    const keyField = isV1 ? "checkpoint_tx_id" : "checkpoint_ref";
-    const wrongField = isV1 ? "checkpoint_ref" : "checkpoint_tx_id";
+    // An inclusion carrying the retired `checkpoint_tx_id` spelling is a mixed
+    // bundle, and resolving it anyway is how an event silently binds to a
+    // checkpoint nobody meant.
+    const keyField = "checkpoint_ref";
+    const wrongField = "checkpoint_tx_id";
     const inclAsRecord = incl as unknown as Record<string, unknown> | undefined;
     const rawKey = inclAsRecord ? inclAsRecord[keyField] : undefined;
     const strayKey = inclAsRecord ? inclAsRecord[wrongField] : undefined;
@@ -1258,12 +1477,12 @@ async function verifyAnchorTrace(
           );
         }
       } catch (e) {
-        evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+        evErrors.push(`inclusion verify error${thrownDetail(e)}`);
       }
     }
 
     // Content (raw-log) binding — shared with every other event-carrying body.
-    const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+    const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
     const contentOk = contentRes.contentOk;
     evErrors.push(...contentRes.errors);
 
@@ -1279,7 +1498,15 @@ async function verifyAnchorTrace(
       // present checkpoint, and its disclosed content did not MISMATCH. A
       // withheld record or undisclosed content (binding/content null) does not
       // fail it.
-      ok: envelopeOk && inclusionOk && checkpointBound && contentOk !== false,
+      // `!eventBytesMalformed`: present-and-unreadable record bytes are a
+      // defect in the artifact, never a disclosure choice (proof#85).
+      ok:
+        envelopeOk &&
+        inclusionOk &&
+        checkpointBound &&
+        contentOk !== false &&
+        legacyError === null &&
+        !eventBytesMalformed,
       errors: evErrors,
     });
   }
@@ -1287,6 +1514,8 @@ async function verifyAnchorTrace(
   // --- Step 5: optional on-chain re-fetch ------------------------------------
   const fetchImpl = options.fetchImpl ?? (globalThis.fetch as typeof fetch | undefined);
   let gatewayUnavailable = false;
+  let uncheckedKind = false;
+  let uncheckedId = false;
   if (onChainChecked) {
     if (typeof fetchImpl !== "function") {
       gatewayUnavailable = true;
@@ -1301,6 +1530,20 @@ async function verifyAnchorTrace(
         // the run to partial) and NEVER as a mismatch. Treating "we never
         // anchored it yet" as "the chain disagrees" would be the same false
         // accusation this whole change is removing.
+        // proof#120. An `anchor_ref` that failed structural validation is not
+        // an absent one. Nothing was fetched, so the witness dimension is NOT
+        // CHECKED — `onChain: null`, exactly as when the caller supplied no
+        // adapter — and it must not raise `gatewayUnavailable`, which is what
+        // puts "could not be re-fetched from the supplied gateways" on the
+        // bundle. Reporting an outage nobody observed is a claim about the
+        // public record made out of a defect in the artifact, and verify-page
+        // renders it word for word. The run still fails: the structural error
+        // is already in `cpr.errors` and already in `ok` above.
+        if (cpr.anchorRef === null && malformedAnchorRef.has(cpr)) {
+          cpr.onChain = null;
+          cpr.onChainOk = null;
+          continue;
+        }
         if (cpr.anchorRef === null) {
           gatewayUnavailable = true;
           cpr.onChain = {
@@ -1314,8 +1557,10 @@ async function verifyAnchorTrace(
         }
         const outcome = await refetchCheckpoint(cp, cpr.anchorRef, gateways, fetchImpl);
         cpr.onChain = outcome.onChain;
-        cpr.onChainOk = outcome.onChain.onChainOk;
+        cpr.onChainOk = outcome.onChain?.onChainOk ?? null;
         if (outcome.unavailable) gatewayUnavailable = true;
+        if (outcome.unchecked === "kind") uncheckedKind = true;
+        if (outcome.unchecked === "id") uncheckedId = true;
         if (outcome.error) cpr.errors.push(outcome.error);
         // Fold the on-chain dimension in: a MISMATCH (false) fails the
         // checkpoint — the proof was not anchored as claimed. An UNREACHABLE
@@ -1347,12 +1592,16 @@ async function verifyAnchorTrace(
   let status: EvidenceStatus;
   if (anyHardFailure) {
     status = "failed";
-  } else if (gatewayUnavailable) {
+  } else if (gatewayUnavailable || uncheckedKind || uncheckedId) {
     // Every offline check passed and nothing MISMATCHED, but a requested
     // on-chain confirmation could not be made — the bundle is offline-sound,
     // its anchored state unconfirmed. "partial" + a note the CLI maps to exit 3.
     status = "partial";
-    errors.push("one or more checkpoints could not be re-fetched from the supplied gateways");
+    pushRefetchGapNotes(errors, "checkpoints", {
+      unavailable: gatewayUnavailable,
+      kind: uncheckedKind,
+      id: uncheckedId,
+    });
   } else if (anyWithheldRecord) {
     // Everything that COULD be checked passed; some record bytes were withheld
     // so their semantic binding is undetermined (not a failure) — "partial".
@@ -1444,7 +1693,7 @@ function isNonNegInt(n: unknown): n is number {
 // ===========================================================================
 // Disclosed-content binding, shared by every body that carries events.
 //
-// Extracted for `sanning.stamp.evidence/v1` (§5.3) rather than copied. The
+// Extracted for `sanning.stamp.evidence/v2` (§5.3) rather than copied. The
 // rawLog -> content_hash link is the one step the chain
 // (content_hash -> record -> payload_hash -> signature -> leaf -> root) does
 // not otherwise cover, and a second copy of it is a second place for the
@@ -1456,7 +1705,7 @@ function isNonNegInt(n: unknown): n is number {
 async function verifyDisclosedContent(
   ev: { envelope?: unknown; content?: unknown },
   eventId: string,
-  recordBytes: Uint8Array | undefined,
+  eventBytes: Uint8Array | undefined,
   sideContent: VerifyEvidenceOptions["content"],
 ): Promise<{ contentOk: boolean | null; errors: string[] }> {
   const evErrors: string[] = [];
@@ -1464,9 +1713,9 @@ async function verifyDisclosedContent(
 
   const committed: string[] = [];
   let recordContentHash: string | undefined;
-  if (recordBytes !== undefined) {
+  if (eventBytes !== undefined) {
     try {
-      const record = JSON.parse(new TextDecoder().decode(recordBytes)) as {
+      const record = jcsParse(eventBytes) as {
         event?: { content_hash?: unknown };
       };
       const ch = record.event?.content_hash;
@@ -1575,7 +1824,7 @@ async function verifyStampEntry(
   try {
     bytes = hexToBytes(e.stamp_bytes);
   } catch (err) {
-    errors.push(`stamp_bytes is not hex: ${stringifyErr(err)}`);
+    errors.push(`stamp_bytes is not hex${thrownDetail(err)}`);
     return { result: base };
   }
   // Gated by `isLowerHex` above, so this is already the exact lowercase hex of
@@ -1608,7 +1857,7 @@ async function verifyStampEntry(
   // --- the body itself ------------------------------------------------------
   let body: StampBody;
   try {
-    const parsed: unknown = JSON.parse(new TextDecoder().decode(bytes));
+    const parsed: unknown = jcsParse(bytes);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       errors.push("stamp body is not a JSON object");
       return { result: base, witnessedHex };
@@ -1618,12 +1867,12 @@ async function verifyStampEntry(
     // every submit attempt for exactly this reason: a non-canonical body makes
     // a retry a DIFFERENT submission, and makes every independent re-derivation
     // of the stamp disagree with the one that was witnessed.
-    if (jcs(body as unknown as Record<string, unknown>) !== new TextDecoder().decode(bytes)) {
+    if (jcs(body as unknown as Record<string, unknown>) !== decodeUtf8Strict(bytes)) {
       errors.push("stamp_bytes are not JCS-canonical (RFC 8785)");
       return { result: base, witnessedHex };
     }
   } catch (err) {
-    errors.push(`stamp body is not JSON: ${stringifyErr(err)}`);
+    errors.push(`stamp body is not JSON${thrownDetail(err)}`);
     return { result: base, witnessedHex };
   }
 
@@ -1666,7 +1915,10 @@ async function verifyStampEntry(
   // --- the sub-tree ranges --------------------------------------------------
   base.subtreesOk = checkSubtrees(body, base, errors);
 
-  base.anchorRef = parseAnchorRef(e.anchor_ref, errors);
+  // A stamp needs no malformed/absent split: the §5.2 re-fetch path already
+  // leaves `onChain` null whenever there is no `AnchorRef`, so it never
+  // synthesised the outage proof#120 is about.
+  base.anchorRef = parseAnchorRef(e.anchor_ref, errors).ref;
 
   base.ok =
     base.stampRefOk && base.bodyOk && base.subtreesOk && errors.length === 0;
@@ -1762,7 +2014,7 @@ async function verifyStampTrace(
 ): Promise<EvidenceBundleResult> {
   const body = b.body as StampTraceBody;
   if (!Array.isArray(body?.stamps)) {
-    return malformed(`${STAMP_TRACE_BODY_TYPE} body must have stamps[]`, true);
+    return malformed(`${STAMP_TRACE_BODY_TYPE} body must have stamps[]`, true, true);
   }
 
   const seen = new Set<string>();
@@ -1781,7 +2033,7 @@ async function verifyStampTrace(
   // other — asks every consumer to remember which wrapper it is holding before
   // it can trust `onChain: null`, and that is exactly the kind of per-body
   // exception a reader eventually gets wrong.
-  const { onChainChecked, gatewayUnavailable } = await refetchStamps(
+  const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(
     stamps,
     witnessed,
     options,
@@ -1801,13 +2053,15 @@ async function verifyStampTrace(
     // does not have.
     status = "partial";
     errors.push(`${STAMP_TRACE_BODY_TYPE} body carries no stamps`);
-  } else if (gatewayUnavailable || anyUnwitnessed) {
+  } else if (gatewayUnavailable || uncheckedKind || uncheckedId || anyUnwitnessed) {
     // Both hold the bundle at `partial`, and both get said — see §5.3's rollup
     // for why one note is not enough when there are two different gaps.
     status = "partial";
-    if (gatewayUnavailable) {
-      errors.push("one or more stamps could not be re-fetched from the supplied gateways");
-    }
+    pushRefetchGapNotes(errors, "stamps", {
+      unavailable: gatewayUnavailable,
+      kind: uncheckedKind,
+      id: uncheckedId,
+    });
     if (anyUnwitnessed) {
       // The honest half of P-10, one layer up. A stamp with no `anchor_ref` is
       // sealed and unwitnessed: `retained-by-sanning`, which is a statement
@@ -1840,7 +2094,7 @@ async function verifyStampTrace(
 }
 
 // ===========================================================================
-// `sanning.stamp.evidence/v1` — the two halves, bound (evidence-bundle.md §5.3)
+// `sanning.stamp.evidence/v2`: the two halves, bound (evidence-bundle.md §5.3)
 //
 // The stamp half is §5.2's code unchanged (`verifyStampEntry`, which carries
 // the sub-tree partition check). The event half reuses the same primitives the
@@ -1863,7 +2117,11 @@ async function verifyStampEvidence(
 ): Promise<EvidenceBundleResult> {
   const body = b.body as StampEvidenceBody;
   if (!Array.isArray(body?.stamps) || !Array.isArray(body?.events)) {
-    return malformed(`${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`, true);
+    return malformed(
+      `${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`,
+      true,
+      true,
+    );
   }
 
   // --- The stamp half: §5.2's rules, §5.2's code ----------------------------
@@ -1918,18 +2176,42 @@ async function verifyStampEvidence(
     let envelopeOk = false;
     let payloadBindingOk: boolean | null = null;
 
-    let recordBytes: Uint8Array | undefined;
+    // A retired field name under this major is a reject, never an ignored
+    // unknown field: ignored, it reads as a withheld record (W-3).
+    const legacyError = legacyEventBytesError(ev, "event", STAMP_EVIDENCE_BODY_TYPE);
+    if (legacyError !== null) evErrors.push(legacyError);
+
+    // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
+    //
+    // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
+    // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
+    // line down. So an event carrying garbage in place of its record used to
+    // reach the same tri-state as an event carrying nothing: `payloadHashOk`
+    // null, `ok` true, a leading tick on the line, and a `verified` rollup over
+    // a record nobody could read. The only thing wrong with the pack was the
+    // bytes, and it was the one thing the verdict did not say.
+    //
+    // A record the producer chose not to disclose is the customer exercising
+    // minimum disclosure. A record that is present and unreadable is a defect
+    // in the artifact, and this kernel's standing rule (the same one
+    // `checkpoints[]` already applies through `keyed.errors`) is that a defect
+    // we can see fails.
+    let eventBytes: Uint8Array | undefined;
+    let eventBytesMalformed = false;
     try {
-      if (typeof ev.record_bytes === "string") recordBytes = hexToBytes(ev.record_bytes);
+      if (typeof ev.event_bytes === "string") eventBytes = hexToBytes(ev.event_bytes);
     } catch (e) {
-      evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+      eventBytesMalformed = true;
+      evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
     }
     try {
       const res = await verifyEnvelope(
         ev.envelope,
-        recordBytes !== undefined ? { payloadBytes: recordBytes } : {},
+        eventBytes !== undefined ? { payloadBytes: eventBytes } : {},
       );
-      envelopeOk = res.ok; // tolerates an undetermined binding (withheld record)
+      const hexError = envelopeHexError("event", ev.envelope);
+      // tolerates an undetermined binding (withheld record)
+      envelopeOk = res.ok && hexError === null;
       payloadBindingOk = res.payloadHashOk;
       // P-10: report what could not be determined, never a fault that was never
       // observed. There is no envelope here, so no signature was checked and no
@@ -1940,6 +2222,8 @@ async function verifyStampEvidence(
       // the producer at all (proof#76).
       if (!isJsonObject(ev.envelope)) {
         evErrors.push("event envelope is not a JSON object");
+      } else if (hexError !== null) {
+        evErrors.push(hexError);
       } else if (!res.signatureOk) {
         evErrors.push("event envelope signature failed");
       }
@@ -1947,8 +2231,10 @@ async function verifyStampEvidence(
       // A malformed skeleton field fails the envelope with a valid signature
       // and binding (proof#95), so without this the event fails with no reason.
       for (const m of res.errors) if (m.startsWith("malformed ")) evErrors.push(`event envelope ${m}`);
+      const specFinding = specVersionFinding("event", ev.envelope, res);
+      if (specFinding !== null) evErrors.push(specFinding);
     } catch (e) {
-      evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+      evErrors.push(`event envelope verify error${thrownDetail(e)}`);
     }
 
     // --- The join (§5.3.3 rule 1) -------------------------------------------
@@ -2011,12 +2297,12 @@ async function verifyStampEvidence(
             );
           }
         } catch (e) {
-          evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+          evErrors.push(`inclusion verify error${thrownDetail(e)}`);
         }
       }
     }
 
-    const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+    const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
     const contentOk = contentRes.contentOk;
     evErrors.push(...contentRes.errors);
 
@@ -2028,13 +2314,21 @@ async function verifyStampEvidence(
       // Named for §5.1's join; here it reports whether `stamp_ref` resolved.
       checkpointBound: stampBound,
       contentOk,
-      ok: envelopeOk && inclusionOk && stampBound && contentOk !== false,
+      // `!eventBytesMalformed`: present-and-unreadable record bytes are a
+      // defect in the artifact, never a disclosure choice (proof#85).
+      ok:
+        envelopeOk &&
+        inclusionOk &&
+        stampBound &&
+        contentOk !== false &&
+        legacyError === null &&
+        !eventBytesMalformed,
       errors: evErrors,
     });
   }
 
   // --- The optional on-chain re-fetch (§5.2.4's "online act") ---------------
-  const { onChainChecked, gatewayUnavailable } = await refetchStamps(
+  const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(
     stamps,
     witnessed,
     options,
@@ -2054,16 +2348,31 @@ async function verifyStampEvidence(
   } else if (stamps.length === 0 && eventResults.length === 0) {
     status = "partial";
     errors.push(`${STAMP_EVIDENCE_BODY_TYPE} body carries no stamps and no events`);
-  } else if (gatewayUnavailable || anyUnwitnessed) {
-    // Both hold the bundle at `partial`, and BOTH get said. A stamp nobody
-    // witnessed and a witness we could not reach are different gaps with
-    // different fixes — one waits for the interval, the other for the network —
-    // and an auditor told only about the second would read the first as fine.
-    // The order is fixed so the two kernels emit the same list.
+  } else if (
+    eventResults.length === 0 ||
+    gatewayUnavailable ||
+    uncheckedKind ||
+    uncheckedId ||
+    anyUnwitnessed
+  ) {
+    // Each holds the bundle at `partial`, and EACH gets said. A pack with no
+    // events, a stamp nobody witnessed and a witness we could not reach are
+    // different gaps with different fixes, and an auditor told only about one
+    // would read the others as fine. The order is fixed so the two kernels
+    // emit the same list.
     status = "partial";
-    if (gatewayUnavailable) {
-      errors.push("one or more stamps could not be re-fetched from the supplied gateways");
+    if (eventResults.length === 0) {
+      // §5.3.2: an events-empty body is exactly a §5.2 stamp trace, and is
+      // partial, never verified. It says nothing about any event.
+      errors.push(
+        `${STAMP_EVIDENCE_BODY_TYPE} body carries no events -- it evidences no event, only its stamps`,
+      );
     }
+    pushRefetchGapNotes(errors, "stamps", {
+      unavailable: gatewayUnavailable,
+      kind: uncheckedKind,
+      id: uncheckedId,
+    });
     if (anyUnwitnessed) {
       // §5.3.3 rule 6, inherited whole from §5.2.4: for a stamp the witness IS
       // the independent part, so the events resting on it inherit `partial`.
@@ -2129,18 +2438,21 @@ async function refetchStamps(
   witnessed: (string | undefined)[],
   options: VerifyEvidenceOptions,
   errors: string[],
-): Promise<{ onChainChecked: boolean; gatewayUnavailable: boolean }> {
+): Promise<StampRefetchSummary> {
   const gateways = options.gateways ?? [];
   const onChainChecked = gateways.length > 0;
-  if (!onChainChecked) return { onChainChecked, gatewayUnavailable: false };
+  const none = { gatewayUnavailable: false, uncheckedKind: false, uncheckedId: false };
+  if (!onChainChecked) return { onChainChecked, ...none };
 
   const fetchImpl = options.fetchImpl ?? (globalThis.fetch as typeof fetch | undefined);
   if (typeof fetchImpl !== "function") {
     errors.push("on-chain re-fetch requested but no fetch implementation is available");
-    return { onChainChecked, gatewayUnavailable: true };
+    return { onChainChecked, ...none, gatewayUnavailable: true };
   }
 
   let gatewayUnavailable = false;
+  let uncheckedKind = false;
+  let uncheckedId = false;
   for (let i = 0; i < stamps.length; i++) {
     const st = stamps[i]!;
     const witnessedHex = witnessed[i];
@@ -2150,8 +2462,10 @@ async function refetchStamps(
 
     const outcome = await refetchStamp(witnessedHex, st.anchorRef, gateways, fetchImpl);
     st.onChain = outcome.onChain;
-    st.onChainOk = outcome.onChain.onChainOk;
+    st.onChainOk = outcome.onChain?.onChainOk ?? null;
     if (outcome.unavailable) gatewayUnavailable = true;
+    if (outcome.unchecked === "kind") uncheckedKind = true;
+    if (outcome.unchecked === "id") uncheckedId = true;
     if (outcome.error) st.errors.push(outcome.error);
     // Fold the on-chain dimension in exactly as a checkpoint does: a MISMATCH
     // (false) fails the stamp — the chain does not hold what the bundle says
@@ -2164,7 +2478,14 @@ async function refetchStamps(
     // unreachable note would fail a stamp for a gateway being down.
     st.ok = st.ok && st.onChainOk !== false;
   }
-  return { onChainChecked, gatewayUnavailable };
+  return { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId };
+}
+
+interface StampRefetchSummary {
+  onChainChecked: boolean;
+  gatewayUnavailable: boolean;
+  uncheckedKind: boolean;
+  uncheckedId: boolean;
 }
 
 // ===========================================================================
@@ -2220,7 +2541,7 @@ export interface DisclosedContentResult {
   errors: string[];
 }
 
-// How many `sanning.evidence.export/v1` wrappers deep the source bundle may be
+// How many `sanning.evidence.export/v2` wrappers deep the source bundle may be
 // nested before this path gives up. verifyEvidenceBundle's canonicalization
 // depth bound already rejects a pathological bundle, but the unwrap must be
 // independently bounded rather than trusting that it ran first.
@@ -2259,7 +2580,7 @@ export async function disclosedContent(
   const traceEvents = resolveTraceEvents(bundle);
   if (traceEvents === undefined) {
     errors.push(
-      `no ${[...ANCHOR_TRACE_BODY_TYPES, STAMP_EVIDENCE_BODY_TYPE].join(" / ")} ` +
+      `no ${ANCHOR_TRACE_BODY_TYPE} / ${STAMP_EVIDENCE_BODY_TYPE} ` +
         `body to materialize content from ` +
         `(body_type ${JSON.stringify(verification.bodyType)})`,
     );
@@ -2360,7 +2681,7 @@ export async function disclosedContent(
 // a caller must distinguish from a body that has events and no links.
 //
 // BOTH event-carrying bodies, not just anchor-trace (proof#73): §5.3's
-// `sanning.stamp.evidence/v1` is the hand-over pack, and it presents the same
+// `sanning.stamp.evidence/v2` is the hand-over pack, and it presents the same
 // event shape.
 //
 // Exported for `chain.ts`, which needs the same descent and must not derive it
@@ -2375,8 +2696,8 @@ export function resolveTraceEvents(bundle: unknown): TraceEvent[] | undefined {
     const b = cur as EvidenceBundle;
     const bodyType = typeof b.body_type === "string" ? b.body_type : null;
     // Both event-carrying bodies, not just anchor-trace (proof#73). §5.3's
-    // `sanning.stamp.evidence/v1` presents the SAME event shape (a
-    // producer-signed envelope, optional `record_bytes`, an inclusion proof),
+    // `sanning.stamp.evidence/v2` presents the SAME event shape (a
+    // producer-signed envelope, optional `event_bytes`, an inclusion proof),
     // and it is the HAND-OVER PACK: the only artifact an auditor is ever
     // handed. Dispatching on anchor-trace alone meant `readChains` reported
     // zero chains on every pack, however well-formed the links inside its
@@ -2384,7 +2705,6 @@ export function resolveTraceEvents(bundle: unknown): TraceEvent[] | undefined {
     // that matters. The writers have been emitting those links the whole time.
     if (
       bodyType === ANCHOR_TRACE_BODY_TYPE ||
-      bodyType === ANCHOR_TRACE_BODY_TYPE_V1 ||
       bodyType === STAMP_EVIDENCE_BODY_TYPE
     ) {
       const body = b.body as AnchorTraceBody | null | undefined;
@@ -2482,14 +2802,14 @@ async function verifyExportBody(
       );
     }
   } catch (e) {
-    errors.push(`source_bundle canonicalization failed: ${stringifyErr(e)}`);
+    errors.push(`source_bundle canonicalization failed${thrownDetail(e)}`);
   }
 
   // --- Step 4: recompute the source verdict ---------------------------------
   // The existing evidence path over the inline source bundle — same primitives
   // (Ed25519 envelopes, payload binding, RFC 9162 inclusion, merkle roots,
   // content_ok, and the optional per-gateway on-chain re-fetch, §4.2 / step 7).
-  const sourceResult = await verifyEvidenceBundle(inline, options);
+  const sourceResult = await verifyExportSource(inline, options);
 
   // Attestation data_hash binding (§5 6c).
   const sourceCheckpoints = await indexSourceCheckpoints(inline);
@@ -2530,7 +2850,7 @@ async function verifyExportBody(
       );
     }
   } catch (e) {
-    errors.push(`verdict agreement comparison failed: ${stringifyErr(e)}`);
+    errors.push(`verdict agreement comparison failed${thrownDetail(e)}`);
   }
 
   // --- Step 7 already folded in by the source recompute ---------------------
@@ -2622,7 +2942,7 @@ export async function recomputeExportVerdict(
   generatedAt: string,
   options: VerifyEvidenceOptions = {},
 ): Promise<ComposeVerdictResult> {
-  const sourceResult = await verifyEvidenceBundle(sourceBundle, options);
+  const sourceResult = await verifyExportSource(sourceBundle, options);
 
   // Attestation data_hash binding (§5 6c) — the SAME index construction as
   // verifyExportBody, deliberately shared rather than restated.
@@ -2668,6 +2988,52 @@ export async function recomputeExportVerdict(
 // field; otherwise a per-dimension AttestationResult whose `ok` gates on the
 // three binding checks (sig / operator-address / data_hash). subject_ref is
 // undetermined-tolerant and never gates.
+// The attestation payload fields evidence-export.md §3.1 marks Required, with
+// the type it gives each. A record whose payload lacks one, or carries another
+// type (null included), is malformed: §5 step 9 and §4.5 make "a missing
+// required field" an export the verifier cannot render (exit 2). §5 step 6
+// gates a WELL-FORMED record on signature, operator and data_hash only; these
+// checks decide whether the record is well-formed at all. `level` is the §3.1
+// enum 1 | 2 | 3. The integers are non-negative and within 2**53 - 1 (the
+// §3.1 clarification).
+const PAYLOAD_REQUIRED: readonly (readonly [string, "string" | "boolean" | "integer" | "level"])[] = [
+  ["attested_at", "string"],
+  ["tx_id", "string"],
+  ["data_hash", "string"],
+  ["data_size", "integer"],
+  ["block_height", "integer"],
+  ["block_timestamp", "integer"],
+  ["operator", "string"],
+  ["owner_address", "string"],
+  ["gateway", "string"],
+  ["signature_verified", "boolean"],
+  ["level", "level"],
+];
+
+function payloadFieldError(payload: Record<string, unknown>): string | null {
+  for (const [name, kind] of PAYLOAD_REQUIRED) {
+    const v = Object.prototype.hasOwnProperty.call(payload, name) ? payload[name] : undefined;
+    let ok: boolean;
+    let want: string;
+    if (kind === "string") {
+      ok = typeof v === "string";
+      want = "a string";
+    } else if (kind === "boolean") {
+      ok = typeof v === "boolean";
+      want = "a boolean";
+    } else if (kind === "integer") {
+      // §3.1 (clarified): a non-negative integer no larger than 2**53 - 1.
+      ok = typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+      want = "a non-negative integer";
+    } else {
+      ok = v === 1 || v === 2 || v === 3;
+      want = "1, 2 or 3";
+    }
+    if (!ok) return `attestation payload field ${JSON.stringify(name)} is missing or not ${want}`;
+  }
+  return null;
+}
+
 async function verifyAttestation(
   rec: AttestationRecord,
   sourceCheckpoints: Map<string, AnyTraceCheckpoint>,
@@ -2714,6 +3080,8 @@ async function verifyAttestation(
   if (typeof rec.signature !== "string") {
     return { result, malformed: "attestation record missing signature" };
   }
+  const fieldError = payloadFieldError(payload as unknown as Record<string, unknown>);
+  if (fieldError !== null) return { result, malformed: fieldError };
   const rsaKey = { kty: "RSA" as const, n: pub.n, e: pub.e };
 
   result.operator = typeof payload.operator === "string" ? payload.operator : "";
@@ -2727,13 +3095,20 @@ async function verifyAttestation(
   try {
     payloadBytes = utf8(jcs(payload));
   } catch (e) {
-    return { result, malformed: `attestation payload canonicalization failed: ${stringifyErr(e)}` };
+    return { result, malformed: `attestation payload canonicalization failed${thrownDetail(e)}` };
   }
   try {
     result.signatureOk = await verifyRsaPssSha256(payloadBytes, rec.signature, rsaKey);
     if (!result.signatureOk) errs.push("attestation RSA-PSS signature verification failed");
-  } catch (e) {
-    return { result, malformed: `attestation ${stringifyErr(e)}` };
+  } catch {
+    // A FIXED sentence, not the library's. This kernel throws
+    // `verifyRsaPssSha256: malformed signature hex: ...` and the Python kernel
+    // raises `malformed signature hex: ...`, so quoting either one split the
+    // two kernels on a finding a holder can put in an export body it signs,
+    // and an export pack's findings reach a case reading through `reasons`
+    // (gate 4 on proof#140, finding 1). Callers of `verifyRsaPssSha256` still
+    // get this kernel's own words.
+    return { result, malformed: "attestation signature or key is malformed" };
   }
 
   // (b) operator-address binding: base64url(SHA-256(modulus)) == payload.operator.
@@ -2746,7 +3121,7 @@ async function verifyAttestation(
       );
     }
   } catch (e) {
-    return { result, malformed: `attestation operator key: ${stringifyErr(e)}` };
+    return { result, malformed: `attestation operator key${thrownDetail(e)}` };
   }
 
   // (c) checkpoint resolution + data_hash binding. The checkpoint tx data IS the
@@ -2771,7 +3146,7 @@ async function verifyAttestation(
         );
       }
     } catch (e) {
-      errs.push(`cannot recompute checkpoint content hash: ${stringifyErr(e)}`);
+      errs.push(`cannot recompute checkpoint content hash${thrownDetail(e)}`);
     }
   }
 
@@ -2953,7 +3328,7 @@ async function refetchCheckpoint(
   anchorRef: AnchorRef,
   gateways: string[],
   fetchImpl: typeof fetch,
-): Promise<{ onChain: OnChainResult; unavailable: boolean; error?: string }> {
+): Promise<RefetchOutcome> {
   let expectedHex: string | undefined;
   try {
     // A checkpoint's witnessed bytes are its envelope RE-CANONICALIZED. The
@@ -2999,7 +3374,7 @@ async function refetchStamp(
   anchorRef: AnchorRef,
   gateways: string[],
   fetchImpl: typeof fetch,
-): Promise<{ onChain: OnChainResult; unavailable: boolean; error?: string }> {
+): Promise<RefetchOutcome> {
   return refetchAnchored("stamp", witnessedHex, anchorRef, gateways, fetchImpl);
 }
 
@@ -3014,7 +3389,36 @@ async function refetchAnchored(
   anchorRef: AnchorRef,
   gateways: string[],
   fetchImpl: typeof fetch,
-): Promise<{ onChain: OnChainResult; unavailable: boolean; error?: string }> {
+): Promise<RefetchOutcome> {
+  // Only a `kind` this kernel has a witness adapter for is re-fetched
+  // (evidence-bundle.md §5.1: "where the verifier has an adapter for its
+  // `kind`"; §5.1.1: an unrecognised kind MUST NOT fail verification). An `id`
+  // of any other kind is not an Arweave id, so whatever a gateway serves at
+  // that path says nothing about the witness, and comparing it would turn an
+  // unrelated 200 into a false mismatch. No fetch, `onChain: null`, and the
+  // run goes `partial`: the caller asked for the witness check and it was not
+  // made.
+  if (!WITNESS_ADAPTER_KINDS.has(anchorRef.kind)) {
+    return {
+      onChain: null,
+      unavailable: false,
+      unchecked: "kind",
+      error: `no witness adapter for kind '${anchorRef.kind}'; the witness was not checked`,
+    };
+  }
+  // The id becomes a URL path segment. Anything but a 43-character base64url
+  // transaction id can leave the gateway's base path once URL parsing
+  // normalises it (`../x`, `%2e%2e/x`), or drop part of the path (`a#b`,
+  // `a?b`), and the two kernels would then request different URLs. Such an id
+  // is never fetched and never failed: the witness is not checked.
+  if (!ARWEAVE_ID_RE.test(anchorRef.id)) {
+    return {
+      onChain: null,
+      unavailable: false,
+      unchecked: "id",
+      error: "arweave witness id is not a 43-character base64url transaction id; the witness was not checked",
+    };
+  }
   const perGateway: PerGatewayOutcome[] = [];
   for (const gw of gateways) {
     perGateway.push({
@@ -3033,7 +3437,51 @@ async function refetchAnchored(
   } else if (onChain.rollup === "unreachable") {
     error = `${subject} ${anchorRef.id} unreachable on all gateways`;
   }
-  return { onChain, unavailable: onChain.rollup === "unreachable", error };
+  return { onChain, unavailable: onChain.rollup === "unreachable", unchecked: null, error };
+}
+
+// The `anchor_ref.kind` values this kernel can re-fetch from a gateway
+// (evidence-bundle.md §5.1.1 registers exactly `arweave`). Any other kind is
+// left unchecked by `refetchAnchored`, never probed.
+const WITNESS_ADAPTER_KINDS: ReadonlySet<string> = new Set(["arweave"]);
+
+// The only `arweave` ids the adapter looks up: a 43-character base64url
+// transaction or data-item id.
+const ARWEAVE_ID_RE = /^[A-Za-z0-9_-]{43}$/;
+
+// Why a re-fetch was not made: `kind` (no adapter for the witness kind) or
+// `id` (an arweave id the adapter cannot look up). null when it was made.
+type Unchecked = "kind" | "id" | null;
+
+interface RefetchOutcome {
+  onChain: OnChainResult | null;
+  // Every gateway was unreachable.
+  unavailable: boolean;
+  unchecked: Unchecked;
+  error?: string;
+}
+
+// The bundle-level notes for a run where requested re-fetches were not made.
+// Each note keeps the phrase "could not be re-fetched", which is what both
+// CLIs map to exit 3. The order is fixed so the two kernels emit the same list.
+function pushRefetchGapNotes(
+  errors: string[],
+  subject: "stamps" | "checkpoints",
+  gaps: { unavailable: boolean; kind: boolean; id: boolean },
+): void {
+  if (gaps.unavailable) {
+    errors.push(`one or more ${subject} could not be re-fetched from the supplied gateways`);
+  }
+  if (gaps.kind) {
+    errors.push(
+      `one or more ${subject} name a witness kind this verifier has no adapter for, so it could not be re-fetched`,
+    );
+  }
+  if (gaps.id) {
+    errors.push(
+      `one or more ${subject} name an Arweave witness id this verifier cannot look up, so it could not be re-fetched`,
+    );
+  }
 }
 
 // One gateway's outcome for one checkpoint tx: confirm (bytes match), mismatch
@@ -3065,7 +3513,7 @@ async function probeGateway(
   // the load-bearing check.
   if (toHex(onChainBytes) === expectedHex) return "confirm";
   try {
-    const parsed = JSON.parse(new TextDecoder().decode(onChainBytes));
+    const parsed = jcsParse(onChainBytes);
     if (toHex(utf8(jcs(parsed))) === expectedHex) return "confirm";
   } catch {
     // not JSON / not parseable — a genuine mismatch
@@ -3131,7 +3579,7 @@ function selectDisclosedBytes(
     try {
       inBody = hexToBytes(ev.content);
     } catch (e) {
-      errors.push(`event content is not hex: ${stringifyErr(e)}`);
+      errors.push(`event content is not hex${thrownDetail(e)}`);
     }
   }
   let side: Uint8Array | undefined;
@@ -3142,7 +3590,7 @@ function selectDisclosedBytes(
     try {
       side = hexToBytes(sideEntry.value);
     } catch (e) {
-      errors.push(`supplied content for ${eventId} is not hex: ${stringifyErr(e)}`);
+      errors.push(`supplied content for ${eventId} is not hex${thrownDetail(e)}`);
     }
   }
   // `offered` comes from the SAME test that produced the value, never from