@sanning/proof 0.9.2 → 0.11.0

package/dist/evidence.js

@@ -1,7 +1,7 @@
 // Evidence-bundle verification (sanning-io/proof specs/evidence-bundle.md).
 //
 // A `sanning.evidence/v1` bundle is a SIGNED wrapper around a producer-specific
-// `body`. This module verifies the `sanning.anchor.trace/v1` body — the
+// `body`. This module verifies the `sanning.anchor.trace/v3` body, the
 // @sanning/anchor SDK trace: a self-verifying serialization of InclusionReceipt[]
 // (per-event signed envelopes + their checkpoints + RFC 9162 inclusion proofs).
 //
@@ -15,9 +15,14 @@
 //
 // Scope: this verifies a SINGLE evidence bundle. Chain walking over
 // `previous_hash` across successive exports is consumer-layer logic above it.
-import { deriveOperatorAddress, ed25519Verify, hexToBytes, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
+import { deriveOperatorAddress, ed25519Verify, hexToBytes, 
+// The one hex-field test, which lives in `crypto.ts` beside the one hex
+// reader (proof#146). It was a second copy here until then, with the same
+// body: two copies of one rule is how two kernels drift apart one edit at a
+// time, which is the whole defect class this fix is about.
+isHexField, sha256Hex, utf8, verifyRsaPssSha256, } from "./crypto.js";
 import { leafHash, verifyInclusion } from "./merkle.js";
-import { MAX_CANONICAL_DEPTH, contentHashes, exceedsDepth, jcs, verifyEnvelope, } from "./verifier.js";
+import { MAX_CANONICAL_DEPTH, contentHashes, exceedsDepth, jcs, jcsParse, verifyEnvelope, } from "./verifier.js";
 import { inBodyContentOffered, sideContentEntry, } from "./side-content.js";
 // Only the evidence-bundle major(s) this kernel verifies. A new major is a
 // deliberate one-entry addition HERE — same fail-closed discipline as the
@@ -27,33 +32,60 @@ const ACCEPTED_EVIDENCE_MAJORS = ["sanning.evidence/v1"];
 // body_type is not a hard failure of the WRAPPER (the signature + body_hash
 // still verify), but its body cannot be re-derived, so the per-body verdict is
 // "undetermined" rather than "verified".
-export const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v2";
+//
+// The producer-to-agent cut (W-3, DL-73) renamed `record_bytes` to
+// `event_bytes` and moved every body that carries it to a new major. This
+// kernel reads ONLY those majors: `sanning.anchor.trace/v1` and `/v2`,
+// `sanning.stamp.evidence/v1` and `sanning.evidence.export/v1` are unknown body
+// types here and answer `partial`. DL-73 releases evidence made before the cut
+// from any obligation to keep verifying, so there is no second field name to
+// read and no dual-accept path.
+export const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v3";
 /**
- * The frozen pre-`anchor_ref` body (evidence-bundle.md §5.1.3).
- *
- * Accepted PERMANENTLY, not for a deprecation window. Every bundle emitted
- * before 2026-09-03 carries this shape, and those bundles are evidence — a
- * reader that stopped accepting them would destroy the record it exists to
- * defend (DL-30). Nothing new emits it.
+ * The name `event_bytes` replaced. Under the new majors a body entry that still
+ * carries it is a hard reject, never an ignored unknown field: ignored, it
+ * would read as a withheld record and the event would verify with nothing
+ * checked, the fail-open the new majors exist to prevent (governance.md §8,
+ * W-3).
  */
-export const ANCHOR_TRACE_BODY_TYPE_V1 = "sanning.anchor.trace/v1";
-/** Every anchor-trace body this kernel verifies. Order is newest-first. */
-export const ANCHOR_TRACE_BODY_TYPES = [
-    ANCHOR_TRACE_BODY_TYPE,
-    ANCHOR_TRACE_BODY_TYPE_V1,
-];
+export const LEGACY_EVENT_BYTES_FIELD = "record_bytes";
+/**
+ * Name an envelope the accept-set refused. Without this a bundle whose
+ * envelopes carry a retired profile major (a half-migrated producer still
+ * writing `sanning.events/v1`) fails with no reason at all. Spelled with
+ * `JSON.stringify` so both kernels write the same sentence.
+ */
+function specVersionFinding(what, envelope, res) {
+    if (!isJsonObject(envelope) || res.specVersionOk)
+        return null;
+    if (!Object.prototype.hasOwnProperty.call(envelope, "spec_version")) {
+        return `${what} envelope has no spec_version`;
+    }
+    const sv = envelope.spec_version;
+    return `${what} envelope spec_version ${JSON.stringify(sv)} is not accepted by this kernel`;
+}
+/**
+ * The reject for an entry that still carries `record_bytes`. One sentence,
+ * spelled the same in both kernels, so a negative vector can assert it.
+ */
+function legacyEventBytesError(entry, what, bodyType) {
+    if (!Object.prototype.hasOwnProperty.call(entry, LEGACY_EVENT_BYTES_FIELD))
+        return null;
+    return (`${what} carries ${LEGACY_EVENT_BYTES_FIELD} in a ${bodyType} body ` +
+        "(renamed event_bytes) -- one bundle speaks one vocabulary");
+}
 // The issuer-composed attested-evidence-export body (specs/evidence-export.md
 // §2). The wrapper is unchanged (`sanning.evidence/v1`, Ed25519-signed); this body
 // carries a cached verdict + the inline source bundle + embedded RSA-PSS
 // operator attestations. verifyEvidenceBundle dispatches on it to
 // verifyExportBody (§5).
-export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
+export const EXPORT_BODY_TYPE = "sanning.evidence.export/v2";
 /**
  * The Sanning-signed interval stamp body (evidence-bundle.md §5.2, DL-58).
  *
  * Its own `body_type` rather than a widened anchor-trace body, and the reason
  * is the whole decision: an anchor-trace checkpoint carries a PRODUCER-signed
- * `sanning.events/v1` envelope, and a stamp has no producer signature at all —
+ * `sanning.events/v2` envelope, and a stamp has no producer signature at all:
  * Sanning places it, under DL-52, for a customer who holds no chain identity.
  * The two rejected options were making `envelope` optional and synthesising an
  * envelope that Sanning signs; the second would have made a Sanning
@@ -61,7 +93,7 @@ export const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
  * unrecoverable once witnessed.
  */
 export const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
-export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v1";
+export const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v2";
 /**
  * The version string INSIDE a witnessed stamp body — a different string from
  * the `body_type` above, and the two are easy to confuse.
@@ -86,12 +118,23 @@ function isEvidenceMajorAccepted(specVersion) {
         return minor.length > 0 && /^[0-9]+$/.test(minor);
     });
 }
-function malformed(error, specVersionOk = false) {
+/**
+ * A bundle this kernel cannot read.
+ *
+ * `wrapperOk` is true only where the wrapper signature and `body_hash` were
+ * CHECKED and held before the body was found unreadable. It is then reported
+ * as held, because it did: `signatureOk` and `bodyHashOk` are statements about
+ * the wrapper, and a body this kernel cannot parse does not unsign it. The
+ * case reader decides whose pack a bundle is on exactly those two fields
+ * (`evidence-bundle.md` 5.5.1), so reporting `false` here let a holder who
+ * broke its own body shape read as a forger.
+ */
+function malformed(error, specVersionOk = false, wrapperOk = false) {
     return {
         status: "malformed",
         specVersionOk,
-        bodyHashOk: false,
-        signatureOk: false,
+        bodyHashOk: wrapperOk,
+        signatureOk: wrapperOk,
         bodyType: null,
         onChainChecked: false,
         checkpoints: [],
@@ -100,8 +143,77 @@ function malformed(error, specVersionOk = false) {
         errors: [error],
     };
 }
-function stringifyErr(e) {
-    return e instanceof Error ? e.message : String(e);
+/**
+ * The prefixes of the exception text this kernel writes ITSELF, in the words
+ * the Python kernel writes too. Anything outside this set comes from the host:
+ * a JSON parser, a codec, a crypto library. See `thrownDetail`.
+ */
+const KERNEL_WORDING = ["hexToBytes: "];
+/**
+ * The detail a finding may append about a caught exception.
+ *
+ * THE RULE: a finding carries the text of a caught exception only where this
+ * kernel wrote that text. A finding travels into a case reading through `case`
+ * `reasons`, and both kernels promise one reading and one rendered sentence for
+ * one set of bytes; a host JSON parser says `Unexpected token 'h', "hello" is
+ * not valid JSON` here and `Expecting value: line 1 column 1 (char 0)` there,
+ * for one pack anyone can build (gate 4 on proof#140, finding 1).
+ *
+ * Returns `": <text>"` for this kernel's own wording and the empty string for
+ * anything else. The label at the call site already names the check that
+ * failed and both kernels agree on it character for character; what is dropped
+ * is the host's parse offset, which no reader can act on and which was never
+ * the same in the two kernels.
+ */
+function thrownDetail(e) {
+    const text = e instanceof Error ? e.message : String(e);
+    return KERNEL_WORDING.some((w) => text.startsWith(w)) ? `: ${text}` : "";
+}
+/**
+ * Decode `bytes` as UTF-8 the way every other kernel does: a byte sequence that
+ * is not valid UTF-8 THROWS, and a leading byte-order mark is kept rather than
+ * eaten.
+ *
+ * ONE CALLER LEFT, and it is not a parse. `jcsParse` (`verifier.ts`) reads
+ * every set of signed bytes in this kernel now; this function survives only for
+ * the canonicality comparison on the stamp path, which needs the DECODED TEXT
+ * of bytes `jcsParse` has already accepted, to compare against `jcs(body)`. It
+ * performs exactly the decode `jcsParse` performs, so the comparison cannot
+ * read the bytes differently from the parse that produced `body`.
+ *
+ * `new TextDecoder()` alone is neither strict nor BOM-preserving: it replaces
+ * every invalid sequence with U+FFFD and strips a BOM. A stamp body carrying
+ * one raw `0x80` inside a string value read `verified` here and `failed` there
+ * because of it (gate 4 on proof#140). The symmetric claim the first version of
+ * this comment made, that "Python's `json.loads` raises on both", is FALSE and
+ * is what hid gate 5's defect for a round: `json.loads(<bytes>)` strips a BOM
+ * too. Python's strict reader is `jcs_loads`, and the rule both kernels hold to
+ * is stated once, in `jcsParse`.
+ */
+function decodeUtf8Strict(bytes) {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+}
+/**
+ * Name an envelope `public_key` or `signature` spelled outside the hex charset
+ * or at the wrong length (proof#142). This kernel's envelope layer already
+ * fails such an envelope, and the Python one's decoder accepts ASCII
+ * whitespace (proof#135), so both bundle verifiers name it here, in the same
+ * words, and the two kernels give one reading. Only a STRING is checked: a
+ * missing or non-string field is the envelope layer's to fail, and it does.
+ */
+function envelopeHexError(what, envelope) {
+    if (!isJsonObject(envelope))
+        return null;
+    for (const [name, nibbles] of [
+        ["public_key", 64],
+        ["signature", 128],
+    ]) {
+        const value = envelope[name];
+        if (typeof value === "string" && !isHexField(value, nibbles)) {
+            return `${what} envelope ${name} is not ${nibbles} hex characters`;
+        }
+    }
+    return null;
 }
 /**
  * Spell a value inside a finding the way the Python kernel spells it.
@@ -116,13 +228,18 @@ function stringifyErr(e) {
 function jsonStr(value) {
     return JSON.stringify(value === undefined ? null : value) ?? "null";
 }
-// Verify a `sanning.evidence/v1` bundle carrying a `sanning.anchor.trace/v1` body.
+// Verify a `sanning.evidence/v1` bundle and dispatch on its `body_type`.
 //
 // Returns a structured per-checkpoint + per-event result and a recomputed
 // rollup `status`. The producer's asserted `verdict.status` is surfaced
 // (`assertedStatus`) but NEVER trusted — the displayed status is the one this
 // function recomputes (evidence-bundle §1 principle 3 / §4 step 4).
 export async function verifyEvidenceBundle(bundle, options = {}) {
+    return verifyBundle(bundle, options, false);
+}
+// `exportSource`: read the bundle as an export's source (evidence-export.md
+// §2.4), where the only recognised body is `sanning.anchor.trace/v3`.
+async function verifyBundle(bundle, options, exportSource) {
     // --- Step 1: parse + reject unknown spec_version major ---------------------
     if (bundle === null || typeof bundle !== "object" || Array.isArray(bundle)) {
         return malformed("evidence bundle is not a JSON object");
@@ -157,26 +274,47 @@ export async function verifyEvidenceBundle(bundle, options = {}) {
     }
     // --- Step 2: verify the wrapper signature + recompute body_hash ------------
     const errors = [];
+    // Every wrapper hex field is read STRICTLY, before any decoder sees it
+    // (proof#142). The Python decoder skipped ASCII whitespace, and the wrapper
+    // `signature` sits outside the signed scope, so one space in it, added by
+    // anyone and with no key, made a pack verify there and fail here. The same
+    // named failure in both kernels, for each field: `public_key` and
+    // `signature` are 64 and 128 hex characters in either case (proof#135,
+    // option B), and `body_hash` is 64 LOWER-case hex characters, the form it is
+    // recomputed in and compared against.
     let bodyHashOk = false;
-    try {
-        const recomputed = await sha256Hex(utf8(jcs(b.body)));
-        bodyHashOk = recomputed === b.body_hash;
-        if (!bodyHashOk) {
-            errors.push(`body_hash mismatch: bundle=${b.body_hash} recomputed=${recomputed}`);
-        }
+    if (!isHexField(b.body_hash, 64, true)) {
+        errors.push("wrapper body_hash is not 64 lowercase hex characters");
     }
-    catch (e) {
-        errors.push(`body canonicalization failed: ${stringifyErr(e)}`);
+    else {
+        try {
+            const recomputed = await sha256Hex(utf8(jcs(b.body)));
+            bodyHashOk = recomputed === b.body_hash;
+            if (!bodyHashOk) {
+                errors.push(`body_hash mismatch: bundle=${b.body_hash} recomputed=${recomputed}`);
+            }
+        }
+        catch (e) {
+            errors.push(`body canonicalization failed${thrownDetail(e)}`);
+        }
     }
     let signatureOk = false;
-    try {
-        const { signature: _sig, co_signatures: _co, ...bundleForSig } = b;
-        signatureOk = await ed25519Verify(b.signature, utf8(jcs(bundleForSig)), b.public_key);
-        if (!signatureOk)
-            errors.push("wrapper Ed25519 signature verification failed");
-    }
-    catch (e) {
-        errors.push(`wrapper signature verification error: ${stringifyErr(e)}`);
+    const keyFormOk = isHexField(b.public_key, 64);
+    const signatureFormOk = isHexField(b.signature, 128);
+    if (!keyFormOk)
+        errors.push("wrapper public_key is not 64 hex characters");
+    if (!signatureFormOk)
+        errors.push("wrapper signature is not 128 hex characters");
+    if (keyFormOk && signatureFormOk) {
+        try {
+            const { signature: _sig, co_signatures: _co, ...bundleForSig } = b;
+            signatureOk = await ed25519Verify(b.signature, utf8(jcs(bundleForSig)), b.public_key);
+            if (!signatureOk)
+                errors.push("wrapper Ed25519 signature verification failed");
+        }
+        catch (e) {
+            errors.push(`wrapper signature verification error${thrownDetail(e)}`);
+        }
     }
     const assertedStatus = typeof b.verdict?.status === "string" ? b.verdict.status : null;
     // A broken wrapper (bad signature or tampered body) is a hard failure — the
@@ -197,6 +335,25 @@ export async function verifyEvidenceBundle(bundle, options = {}) {
     }
     // --- Body dispatch ---------------------------------------------------------
     const bodyType = typeof b.body_type === "string" ? b.body_type : null;
+    // Read as an export's source (evidence-export.md §2.4), the only body this
+    // kernel recognises is sanning.anchor.trace/v3. Any other body, even one it
+    // verifies on its own, is undetermined here, after the wrapper checks above.
+    if (exportSource && bodyType !== ANCHOR_TRACE_BODY_TYPE) {
+        errors.push(`body_type ${JSON.stringify(bodyType)} is not an export source ` +
+            `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`);
+        return {
+            status: "partial",
+            specVersionOk,
+            bodyHashOk,
+            signatureOk,
+            bodyType,
+            onChainChecked: false,
+            checkpoints: [],
+            events: [],
+            assertedStatus,
+            errors,
+        };
+    }
     // Attested-evidence-export body (evidence-export.md §5). The wrapper is
     // authentic (Ed25519 issuer signature + body_hash verified above, §5 step 2);
     // hand off to the export verifier for steps 3–9.
@@ -213,12 +370,12 @@ export async function verifyEvidenceBundle(bundle, options = {}) {
     if (bodyType === STAMP_EVIDENCE_BODY_TYPE) {
         return verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options);
     }
-    if (bodyType !== ANCHOR_TRACE_BODY_TYPE && bodyType !== ANCHOR_TRACE_BODY_TYPE_V1) {
+    if (bodyType !== ANCHOR_TRACE_BODY_TYPE) {
         // The wrapper is authentic but we don't know this body's structure. Per
         // wrap-don't-merge, that is "partial" (cryptographically sound wrapper,
         // body verdict undetermined) — not a failure.
         errors.push(`body_type ${JSON.stringify(bodyType)} is not verifiable by this kernel ` +
-            `(only ${ANCHOR_TRACE_BODY_TYPES.join(", ")}); wrapper verified, body undetermined`);
+            `(only ${ANCHOR_TRACE_BODY_TYPE}); wrapper verified, body undetermined`);
         return {
             status: "partial",
             specVersionOk,
@@ -232,99 +389,101 @@ export async function verifyEvidenceBundle(bundle, options = {}) {
             errors,
         };
     }
-    return verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, errors, options);
+    return verifyAnchorTrace(b, specVersionOk, assertedStatus, errors, options);
 }
 /**
- * Index a source bundle's checkpoints by the key its attestations will use.
+ * Recompute an export's source verdict (evidence-export.md §5 step 4).
  *
- * The attestation join key follows the SOURCE bundle's own vocabulary — a
- * v2 source is keyed by `checkpoint_ref`, a frozen v1 source by `tx_id`. The
- * alternative (always deriving a v2-style key) would silently un-resolve every
- * attestation ever written against a v1 export: `data_hash_bound` would go
- * false, the export would stop reaching `verified`, and nothing would say why.
+ * The only export source is `sanning.anchor.trace/v3` (§2.2, §2.4). Any other
+ * inline source body is unrecognised *as a source*, even one this kernel
+ * verifies on its own, such as a `sanning.stamp.evidence/v2` pack: §2.4 makes
+ * its source verdict undetermined, so the export cannot reach `verified`. The
+ * source wrapper is still checked first, because a forged source is a failure
+ * whatever its body.
+ */
+async function verifyExportSource(source, options) {
+    return verifyBundle(source, options, true);
+}
+/**
+ * Index a source bundle's checkpoints by the key its attestations use: the
+ * derived `checkpoint_ref`. Only a `sanning.anchor.trace/v3` source has
+ * checkpoints an attestation can resolve (evidence-export.md §2.4).
  */
 async function indexSourceCheckpoints(bundle) {
     const out = new Map();
+    if (!isJsonObject(bundle) || bundle.body_type !== ANCHOR_TRACE_BODY_TYPE)
+        return out;
     const sb = bundle.body;
-    const isV1 = bundle.body_type === ANCHOR_TRACE_BODY_TYPE_V1;
     if (!sb || typeof sb !== "object" || !Array.isArray(sb.checkpoints))
         return out;
     for (const cp of sb.checkpoints) {
         if (!cp || typeof cp !== "object")
             continue;
-        let recordBytes;
+        let eventBytes;
         try {
-            if (typeof cp.record_bytes === "string")
-                recordBytes = hexToBytes(cp.record_bytes);
+            if (typeof cp.event_bytes === "string")
+                eventBytes = hexToBytes(cp.event_bytes);
         }
         catch {
-            recordBytes = undefined;
+            eventBytes = undefined;
         }
-        const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
+        const keyed = await resolveCheckpointKey(cp, eventBytes);
         if (keyed.key !== null && !out.has(keyed.key))
             out.set(keyed.key, cp);
     }
     return out;
 }
 /**
- * Resolve a checkpoint's join key and its witness reference, for whichever
- * body form we are reading.
+ * Resolve a checkpoint's join key and its witness reference.
  *
- * ── The rule that matters, and why it is a reject rather than a preference ──
+ * ── Why a retired spelling is a reject rather than a preference ──
  *
- * A checkpoint carrying BOTH vocabularies is two answers to one question
- * inside one signature. A reader that silently prefers one gives a different
- * answer from a reader that prefers the other, over the same signed bytes —
- * and both look like they verified. So a v2 body carrying `tx_id`, or a v1
- * body carrying `anchor_ref`/`checkpoint_ref`, is rejected rather than
- * resolved. This is cheap to enforce here and impossible to enforce later.
+ * A checkpoint carrying a retired spelling beside the current one is two
+ * answers to one question inside one signature. A reader that silently prefers
+ * one gives a different answer from a reader that prefers the other, over the
+ * same signed bytes, and both look like they verified. So `tx_id` and
+ * `record_bytes` are rejected rather than resolved.
  *
- * ── Why v2's key is recomputed ──
+ * ── Why the key is recomputed ──
  *
- * In v1 the key was an asserted label matched against another asserted label;
- * nothing tied either to the bytes, so relabelling a checkpoint and every
- * event pointing at it left a bundle that still verified. In v2 the key IS the
- * bytes, so the same relabel fails here. v1's behaviour is preserved exactly
- * as it was — deliberately, because those bundles are already signed and
- * re-interpreting them is not backwards compatibility.
+ * The key IS the bytes: relabelling a checkpoint and every event pointing at it
+ * fails here, because nothing is taken from the label.
  */
-async function resolveCheckpointKey(cp, recordBytes, isV1) {
+async function resolveCheckpointKey(cp, eventBytes) {
     const errors = [];
-    if (isV1) {
-        if (cp.checkpoint_ref !== undefined || cp.anchor_ref !== undefined) {
-            errors.push("sanning.anchor.trace/v1 checkpoint carries v2 fields (checkpoint_ref/anchor_ref) -- " +
-                "one bundle speaks one vocabulary");
-            return { key: null, anchorRef: null, errors };
-        }
-        if (typeof cp.tx_id !== "string" || cp.tx_id === "") {
-            errors.push("checkpoint missing tx_id");
-            return { key: null, anchorRef: null, errors };
-        }
-        // v1's tx_id IS an Arweave transaction — its own spec said so. Surfacing it
-        // through the same shape as v2 gives ONE reader-side vocabulary without
-        // touching a byte of the signed bundle.
-        return { key: cp.tx_id, anchorRef: { kind: "arweave", id: cp.tx_id }, errors };
-    }
+    // Every early return below leaves before `anchor_ref` is ever looked at, so
+    // nothing there is "malformed": it is unexamined, which is not the same claim.
+    const unexamined = { key: null, anchorRef: null, anchorRefMalformed: false, errors };
     if (cp.tx_id !== undefined) {
-        errors.push("sanning.anchor.trace/v2 checkpoint carries legacy tx_id -- one bundle speaks one vocabulary");
-        return { key: null, anchorRef: null, errors };
+        errors.push(`${ANCHOR_TRACE_BODY_TYPE} checkpoint carries legacy tx_id -- one bundle speaks one vocabulary`);
+        return unexamined;
+    }
+    const legacy = legacyEventBytesError(cp, "checkpoint", ANCHOR_TRACE_BODY_TYPE);
+    if (legacy !== null) {
+        errors.push(legacy);
+        return unexamined;
     }
     if (typeof cp.checkpoint_ref !== "string" || cp.checkpoint_ref === "") {
         errors.push("checkpoint missing checkpoint_ref");
-        return { key: null, anchorRef: null, errors };
+        return unexamined;
     }
-    if (recordBytes === undefined) {
+    if (eventBytes === undefined) {
         // Without the bytes the key cannot be recomputed, so it cannot be trusted.
-        errors.push("checkpoint_ref cannot be verified -- record_bytes missing or not hex");
-        return { key: null, anchorRef: null, errors };
+        errors.push("checkpoint_ref cannot be verified -- event_bytes missing or not hex");
+        return unexamined;
     }
-    const derived = await sha256Hex(recordBytes);
+    const derived = await sha256Hex(eventBytes);
     if (derived !== cp.checkpoint_ref.toLowerCase()) {
-        errors.push(`checkpoint_ref does not match SHA-256(record_bytes): claimed=${cp.checkpoint_ref} derived=${derived}`);
-        return { key: null, anchorRef: null, errors };
+        errors.push(`checkpoint_ref does not match SHA-256(event_bytes): claimed=${cp.checkpoint_ref} derived=${derived}`);
+        return unexamined;
     }
-    const anchorRef = parseAnchorRef(cp.anchor_ref, errors);
-    return { key: derived, anchorRef, errors };
+    const parsed = parseAnchorRef(cp.anchor_ref, errors);
+    return {
+        key: derived,
+        anchorRef: parsed.ref,
+        anchorRefMalformed: parsed.malformed,
+        errors,
+    };
 }
 /**
  * Validate an optional `anchor_ref` (§5.1.1).
@@ -343,39 +502,54 @@ async function resolveCheckpointKey(cp, recordBytes, isV1) {
  * So this validates the SHAPE and never the vocabulary. A malformed
  * `anchor_ref` is a defect in the bundle; an unknown `kind` is a defect in
  * the reader, and only the first is the bundle's fault.
+ *
+ * ── Absent and malformed are not the same null (proof#120) ──
+ *
+ * Both leave no `AnchorRef` to re-fetch, and both used to be reported the same
+ * way downstream: an all-`unreachable` on-chain result, although no gateway was
+ * asked in either case. For the ABSENT case that is at least the note
+ * `evidence-bundle.md` §5.1.1 reserves for "a checkpoint with no `anchor_ref`".
+ * For the MALFORMED case it is a manufactured outage: the bundle named a
+ * witness, the name was unreadable, and the reader was told the public record
+ * could not be reached. So the two come back as different facts, and `malformed`
+ * carries the difference.
  */
 function parseAnchorRef(raw, errors) {
-    if (raw === undefined || raw === null)
-        return null; // placed, not yet witnessed
+    if (raw === undefined || raw === null) {
+        return { ref: null, malformed: false }; // placed, not yet witnessed
+    }
     if (typeof raw !== "object" || Array.isArray(raw)) {
         errors.push("anchor_ref must be an object");
-        return null;
+        return { ref: null, malformed: true };
     }
     const o = raw;
     if (typeof o.kind !== "string" || !/^[a-z0-9][a-z0-9._-]*$/.test(o.kind)) {
         errors.push(`anchor_ref.kind is missing or malformed: ${JSON.stringify(o.kind)}`);
-        return null;
+        return { ref: null, malformed: true };
     }
     if (typeof o.id !== "string" || o.id === "") {
         errors.push("anchor_ref.id is missing or empty");
-        return null;
+        return { ref: null, malformed: true };
     }
     const ref = o.ref;
     if (ref !== undefined && (typeof ref !== "object" || ref === null || Array.isArray(ref))) {
         errors.push("anchor_ref.ref must be an object when present");
-        return null;
+        return { ref: null, malformed: true };
     }
     return {
-        kind: o.kind,
-        id: o.id,
-        ...(ref === undefined ? {} : { ref: ref }),
+        ref: {
+            kind: o.kind,
+            id: o.id,
+            ...(ref === undefined ? {} : { ref: ref }),
+        },
+        malformed: false,
     };
 }
-async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, errors, options) {
+async function verifyAnchorTrace(b, specVersionOk, assertedStatus, errors, options) {
     const body = b.body;
-    const isV1 = bodyType === ANCHOR_TRACE_BODY_TYPE_V1;
+    const bodyType = ANCHOR_TRACE_BODY_TYPE;
     if (!Array.isArray(body.checkpoints) || !Array.isArray(body.events)) {
-        return malformed(`${bodyType} body must have checkpoints[] and events[]`, true);
+        return malformed(`${bodyType} body must have checkpoints[] and events[]`, true, true);
     }
     const gateways = options.gateways ?? [];
     const onChainChecked = gateways.length > 0;
@@ -390,6 +564,11 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
     const byKey = new Map();
     const anchorByKey = new Map();
     const checkpointResults = [];
+    // proof#120. Kept beside the results rather than on them: "the bundle named
+    // a witness we could not read" is an input defect the checkpoint's own
+    // `errors` already states, not a new dimension of the published verdict, and
+    // `CheckpointResult` is a shape downstream surfaces render.
+    const malformedAnchorRef = new Set();
     for (const rawCp of body.checkpoints) {
         // `checkpoints[]` is attacker-shaped, and a verifier must never raise on
         // adversarial input: a null entry used to reach `cp.tx_id` and hand the
@@ -416,17 +595,17 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
         const cpErrors = [];
         let envelopeOk = false;
         let merkleRootOk = false;
-        // Decode record_bytes first: in v2 the join key is DERIVED from it, so it
+        // Decode event_bytes first: in v2 the join key is DERIVED from it, so it
         // is an input to identity, not just to the payload binding below.
-        let recordBytes;
+        let eventBytes;
         try {
-            if (typeof cp.record_bytes === "string")
-                recordBytes = hexToBytes(cp.record_bytes);
+            if (typeof cp.event_bytes === "string")
+                eventBytes = hexToBytes(cp.event_bytes);
         }
         catch (e) {
-            cpErrors.push(`checkpoint record_bytes is not hex: ${stringifyErr(e)}`);
+            cpErrors.push(`checkpoint event_bytes is not hex${thrownDetail(e)}`);
         }
-        const keyed = await resolveCheckpointKey(cp, recordBytes, isV1);
+        const keyed = await resolveCheckpointKey(cp, eventBytes);
         cpErrors.push(...keyed.errors);
         // A duplicate key is a HARD failure, not a note. `byKey` below keeps the
         // FIRST occurrence, so a second checkpoint claiming the same key is
@@ -440,7 +619,7 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
         let duplicateKey = false;
         if (keyed.key !== null) {
             if (byKey.has(keyed.key)) {
-                cpErrors.push(`duplicate checkpoint ${isV1 ? "tx_id" : "checkpoint_ref"} ${keyed.key}`);
+                cpErrors.push(`duplicate checkpoint checkpoint_ref ${keyed.key}`);
                 duplicateKey = true;
             }
             else {
@@ -451,16 +630,20 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
         // Verify the checkpoint envelope against its committed record (external
         // commitment — the record is the payload these external envelopes bind to).
         try {
-            const res = await verifyEnvelope(cp.envelope, recordBytes !== undefined ? { payloadBytes: recordBytes } : {});
+            const res = await verifyEnvelope(cp.envelope, eventBytes !== undefined ? { payloadBytes: eventBytes } : {});
             // A checkpoint must fully bind: signature + the committed record matching
             // payload_hash. An undetermined binding (no record) is not enough to
             // anchor the events' inclusion claims to a trustworthy root.
-            envelopeOk = res.ok && res.payloadHashOk === true;
+            const hexError = envelopeHexError("checkpoint", cp.envelope);
+            envelopeOk = res.ok && res.payloadHashOk === true && hexError === null;
             // See the event loop below: a degenerate envelope is a malformed input,
             // not a failed check (proof#76).
             if (!isJsonObject(cp.envelope)) {
                 cpErrors.push("checkpoint envelope is not a JSON object");
             }
+            else if (hexError !== null) {
+                cpErrors.push(hexError);
+            }
             else if (!res.signatureOk) {
                 cpErrors.push("checkpoint envelope signature failed");
             }
@@ -471,25 +654,28 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
             for (const m of res.errors)
                 if (m.startsWith("malformed "))
                     cpErrors.push(`checkpoint envelope ${m}`);
+            const specFinding = specVersionFinding("checkpoint", cp.envelope, res);
+            if (specFinding !== null)
+                cpErrors.push(specFinding);
             // WHY the binding is undetermined decides which sentence is true.
-            // record_bytes really absent is one thing; record_bytes present and
+            // event_bytes really absent is one thing; event_bytes present and
             // unbindable (a degenerate envelope, unreadable hex) is another, and
             // naming the wrong cause sends a reader to look for a field that is
             // sitting right there (proof#76).
             if (res.payloadHashOk === null) {
-                cpErrors.push(recordBytes === undefined
-                    ? "checkpoint record_bytes missing -- root untrusted"
+                cpErrors.push(eventBytes === undefined
+                    ? "checkpoint event_bytes missing -- root untrusted"
                     : "checkpoint record binding not checked: root untrusted");
             }
         }
         catch (e) {
-            cpErrors.push(`checkpoint envelope verify error: ${stringifyErr(e)}`);
+            cpErrors.push(`checkpoint envelope verify error${thrownDetail(e)}`);
         }
         // The committed record's merkle_root must equal the checkpoint's claimed
         // merkle_root (recompute, don't trust the bundle's top-level claim).
-        if (recordBytes !== undefined) {
+        if (eventBytes !== undefined) {
             try {
-                const record = JSON.parse(new TextDecoder().decode(recordBytes));
+                const record = jcsParse(eventBytes);
                 const committedRoot = record.event?.merkle_root;
                 merkleRootOk = typeof committedRoot === "string" && committedRoot === cp.merkle_root;
                 if (!merkleRootOk) {
@@ -498,7 +684,7 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
                 }
             }
             catch (e) {
-                cpErrors.push(`checkpoint record is not JSON: ${stringifyErr(e)}`);
+                cpErrors.push(`checkpoint record is not JSON${thrownDetail(e)}`);
             }
         }
         checkpointResults.push({
@@ -517,6 +703,9 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
             ok: envelopeOk && merkleRootOk && keyed.errors.length === 0 && !duplicateKey,
             errors: cpErrors,
         });
+        if (keyed.anchorRefMalformed) {
+            malformedAnchorRef.add(checkpointResults[checkpointResults.length - 1]);
+        }
     }
     // --- Step 4: per-event ------------------------------------------------------
     const eventResults = [];
@@ -542,17 +731,41 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
         const eventId = getEventId(ev.envelope);
         let envelopeOk = false;
         let payloadBindingOk = null;
-        let recordBytes;
+        // A retired field name under this major is a reject, never an ignored
+        // unknown field: ignored, it reads as a withheld record (W-3).
+        const legacyError = legacyEventBytesError(ev, "event", bodyType);
+        if (legacyError !== null)
+            evErrors.push(legacyError);
+        // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
+        //
+        // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
+        // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
+        // line down. So an event carrying garbage in place of its record used to
+        // reach the same tri-state as an event carrying nothing: `payloadHashOk`
+        // null, `ok` true, a leading tick on the line, and a `verified` rollup over
+        // a record nobody could read. The only thing wrong with the pack was the
+        // bytes, and it was the one thing the verdict did not say.
+        //
+        // A record the producer chose not to disclose is the customer exercising
+        // minimum disclosure. A record that is present and unreadable is a defect
+        // in the artifact, and this kernel's standing rule (the same one
+        // `checkpoints[]` already applies through `keyed.errors`) is that a defect
+        // we can see fails.
+        let eventBytes;
+        let eventBytesMalformed = false;
         try {
-            if (typeof ev.record_bytes === "string")
-                recordBytes = hexToBytes(ev.record_bytes);
+            if (typeof ev.event_bytes === "string")
+                eventBytes = hexToBytes(ev.event_bytes);
         }
         catch (e) {
-            evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+            eventBytesMalformed = true;
+            evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
         }
         try {
-            const res = await verifyEnvelope(ev.envelope, recordBytes !== undefined ? { payloadBytes: recordBytes } : {});
-            envelopeOk = res.ok; // ok tolerates an undetermined binding (withheld record)
+            const res = await verifyEnvelope(ev.envelope, eventBytes !== undefined ? { payloadBytes: eventBytes } : {});
+            const hexError = envelopeHexError("event", ev.envelope);
+            // ok tolerates an undetermined binding (withheld record)
+            envelopeOk = res.ok && hexError === null;
             payloadBindingOk = res.payloadHashOk;
             // P-10: report what could not be determined, never a fault that was never
             // observed. There is no envelope here, so no signature was checked and no
@@ -564,6 +777,9 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
             if (!isJsonObject(ev.envelope)) {
                 evErrors.push("event envelope is not a JSON object");
             }
+            else if (hexError !== null) {
+                evErrors.push(hexError);
+            }
             else if (!res.signatureOk) {
                 evErrors.push("event envelope signature failed");
             }
@@ -574,19 +790,21 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
             for (const m of res.errors)
                 if (m.startsWith("malformed "))
                     evErrors.push(`event envelope ${m}`);
+            const specFinding = specVersionFinding("event", ev.envelope, res);
+            if (specFinding !== null)
+                evErrors.push(specFinding);
         }
         catch (e) {
-            evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+            evErrors.push(`event envelope verify error${thrownDetail(e)}`);
         }
         // Bind the event to exactly one checkpoint in the bundle, then verify
         // RFC 9162 inclusion against THAT checkpoint's merkle_root.
         const incl = ev.inclusion;
-        // The join key is spelled differently in the two forms and MUST NOT be read
-        // from the other one: an inclusion carrying v1's spelling inside a v2 body
-        // is a mixed bundle, and resolving it anyway is how an event silently binds
-        // to a checkpoint nobody meant.
-        const keyField = isV1 ? "checkpoint_tx_id" : "checkpoint_ref";
-        const wrongField = isV1 ? "checkpoint_ref" : "checkpoint_tx_id";
+        // An inclusion carrying the retired `checkpoint_tx_id` spelling is a mixed
+        // bundle, and resolving it anyway is how an event silently binds to a
+        // checkpoint nobody meant.
+        const keyField = "checkpoint_ref";
+        const wrongField = "checkpoint_tx_id";
         const inclAsRecord = incl;
         const rawKey = inclAsRecord ? inclAsRecord[keyField] : undefined;
         const strayKey = inclAsRecord ? inclAsRecord[wrongField] : undefined;
@@ -631,11 +849,11 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
                 }
             }
             catch (e) {
-                evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+                evErrors.push(`inclusion verify error${thrownDetail(e)}`);
             }
         }
         // Content (raw-log) binding — shared with every other event-carrying body.
-        const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+        const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
         const contentOk = contentRes.contentOk;
         evErrors.push(...contentRes.errors);
         eventResults.push({
@@ -650,13 +868,22 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
             // present checkpoint, and its disclosed content did not MISMATCH. A
             // withheld record or undisclosed content (binding/content null) does not
             // fail it.
-            ok: envelopeOk && inclusionOk && checkpointBound && contentOk !== false,
+            // `!eventBytesMalformed`: present-and-unreadable record bytes are a
+            // defect in the artifact, never a disclosure choice (proof#85).
+            ok: envelopeOk &&
+                inclusionOk &&
+                checkpointBound &&
+                contentOk !== false &&
+                legacyError === null &&
+                !eventBytesMalformed,
             errors: evErrors,
         });
     }
     // --- Step 5: optional on-chain re-fetch ------------------------------------
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
     let gatewayUnavailable = false;
+    let uncheckedKind = false;
+    let uncheckedId = false;
     if (onChainChecked) {
         if (typeof fetchImpl !== "function") {
             gatewayUnavailable = true;
@@ -673,6 +900,20 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
                 // the run to partial) and NEVER as a mismatch. Treating "we never
                 // anchored it yet" as "the chain disagrees" would be the same false
                 // accusation this whole change is removing.
+                // proof#120. An `anchor_ref` that failed structural validation is not
+                // an absent one. Nothing was fetched, so the witness dimension is NOT
+                // CHECKED — `onChain: null`, exactly as when the caller supplied no
+                // adapter — and it must not raise `gatewayUnavailable`, which is what
+                // puts "could not be re-fetched from the supplied gateways" on the
+                // bundle. Reporting an outage nobody observed is a claim about the
+                // public record made out of a defect in the artifact, and verify-page
+                // renders it word for word. The run still fails: the structural error
+                // is already in `cpr.errors` and already in `ok` above.
+                if (cpr.anchorRef === null && malformedAnchorRef.has(cpr)) {
+                    cpr.onChain = null;
+                    cpr.onChainOk = null;
+                    continue;
+                }
                 if (cpr.anchorRef === null) {
                     gatewayUnavailable = true;
                     cpr.onChain = {
@@ -686,9 +927,13 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
                 }
                 const outcome = await refetchCheckpoint(cp, cpr.anchorRef, gateways, fetchImpl);
                 cpr.onChain = outcome.onChain;
-                cpr.onChainOk = outcome.onChain.onChainOk;
+                cpr.onChainOk = outcome.onChain?.onChainOk ?? null;
                 if (outcome.unavailable)
                     gatewayUnavailable = true;
+                if (outcome.unchecked === "kind")
+                    uncheckedKind = true;
+                if (outcome.unchecked === "id")
+                    uncheckedId = true;
                 if (outcome.error)
                     cpr.errors.push(outcome.error);
                 // Fold the on-chain dimension in: a MISMATCH (false) fails the
@@ -719,12 +964,16 @@ async function verifyAnchorTrace(b, bodyType, specVersionOk, assertedStatus, err
     if (anyHardFailure) {
         status = "failed";
     }
-    else if (gatewayUnavailable) {
+    else if (gatewayUnavailable || uncheckedKind || uncheckedId) {
         // Every offline check passed and nothing MISMATCHED, but a requested
         // on-chain confirmation could not be made — the bundle is offline-sound,
         // its anchored state unconfirmed. "partial" + a note the CLI maps to exit 3.
         status = "partial";
-        errors.push("one or more checkpoints could not be re-fetched from the supplied gateways");
+        pushRefetchGapNotes(errors, "checkpoints", {
+            unavailable: gatewayUnavailable,
+            kind: uncheckedKind,
+            id: uncheckedId,
+        });
     }
     else if (anyWithheldRecord) {
         // Everything that COULD be checked passed; some record bytes were withheld
@@ -815,7 +1064,7 @@ function isNonNegInt(n) {
 // ===========================================================================
 // Disclosed-content binding, shared by every body that carries events.
 //
-// Extracted for `sanning.stamp.evidence/v1` (§5.3) rather than copied. The
+// Extracted for `sanning.stamp.evidence/v2` (§5.3) rather than copied. The
 // rawLog -> content_hash link is the one step the chain
 // (content_hash -> record -> payload_hash -> signature -> leaf -> root) does
 // not otherwise cover, and a second copy of it is a second place for the
@@ -824,14 +1073,14 @@ function isNonNegInt(n) {
 // disclosed or nothing is committed; false ONLY on a real mismatch or an
 // in-body vs side-input disagreement.
 // ===========================================================================
-async function verifyDisclosedContent(ev, eventId, recordBytes, sideContent) {
+async function verifyDisclosedContent(ev, eventId, eventBytes, sideContent) {
     const evErrors = [];
     let contentOk = null;
     const committed = [];
     let recordContentHash;
-    if (recordBytes !== undefined) {
+    if (eventBytes !== undefined) {
         try {
-            const record = JSON.parse(new TextDecoder().decode(recordBytes));
+            const record = jcsParse(eventBytes);
             const ch = record.event?.content_hash;
             if (typeof ch === "string" && ch)
                 recordContentHash = ch.toLowerCase();
@@ -912,7 +1161,7 @@ async function verifyStampEntry(raw, seen) {
         bytes = hexToBytes(e.stamp_bytes);
     }
     catch (err) {
-        errors.push(`stamp_bytes is not hex: ${stringifyErr(err)}`);
+        errors.push(`stamp_bytes is not hex${thrownDetail(err)}`);
         return { result: base };
     }
     // Gated by `isLowerHex` above, so this is already the exact lowercase hex of
@@ -944,7 +1193,7 @@ async function verifyStampEntry(raw, seen) {
     // --- the body itself ------------------------------------------------------
     let body;
     try {
-        const parsed = JSON.parse(new TextDecoder().decode(bytes));
+        const parsed = jcsParse(bytes);
         if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
             errors.push("stamp body is not a JSON object");
             return { result: base, witnessedHex };
@@ -954,13 +1203,13 @@ async function verifyStampEntry(raw, seen) {
         // every submit attempt for exactly this reason: a non-canonical body makes
         // a retry a DIFFERENT submission, and makes every independent re-derivation
         // of the stamp disagree with the one that was witnessed.
-        if (jcs(body) !== new TextDecoder().decode(bytes)) {
+        if (jcs(body) !== decodeUtf8Strict(bytes)) {
             errors.push("stamp_bytes are not JCS-canonical (RFC 8785)");
             return { result: base, witnessedHex };
         }
     }
     catch (err) {
-        errors.push(`stamp body is not JSON: ${stringifyErr(err)}`);
+        errors.push(`stamp body is not JSON${thrownDetail(err)}`);
         return { result: base, witnessedHex };
     }
     if (body.stamp_version !== STAMP_BODY_VERSION) {
@@ -998,7 +1247,10 @@ async function verifyStampEntry(raw, seen) {
     }
     // --- the sub-tree ranges --------------------------------------------------
     base.subtreesOk = checkSubtrees(body, base, errors);
-    base.anchorRef = parseAnchorRef(e.anchor_ref, errors);
+    // A stamp needs no malformed/absent split: the §5.2 re-fetch path already
+    // leaves `onChain` null whenever there is no `AnchorRef`, so it never
+    // synthesised the outage proof#120 is about.
+    base.anchorRef = parseAnchorRef(e.anchor_ref, errors).ref;
     base.ok =
         base.stampRefOk && base.bodyOk && base.subtreesOk && errors.length === 0;
     return { result: base, witnessedHex };
@@ -1080,7 +1332,7 @@ function checkSubtrees(body, out, errors) {
 async function verifyStampTrace(b, specVersionOk, assertedStatus, errors, options) {
     const body = b.body;
     if (!Array.isArray(body?.stamps)) {
-        return malformed(`${STAMP_TRACE_BODY_TYPE} body must have stamps[]`, true);
+        return malformed(`${STAMP_TRACE_BODY_TYPE} body must have stamps[]`, true, true);
     }
     const seen = new Set();
     const stamps = [];
@@ -1097,7 +1349,7 @@ async function verifyStampTrace(b, specVersionOk, assertedStatus, errors, option
     // other — asks every consumer to remember which wrapper it is holding before
     // it can trust `onChain: null`, and that is exactly the kind of per-body
     // exception a reader eventually gets wrong.
-    const { onChainChecked, gatewayUnavailable } = await refetchStamps(stamps, witnessed, options, errors);
+    const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(stamps, witnessed, options, errors);
     // --- Rollup ----------------------------------------------------------------
     const anyHardFailure = stamps.some((s) => !s.ok);
     const anyUnwitnessed = stamps.some((s) => s.anchorRef === null);
@@ -1112,13 +1364,15 @@ async function verifyStampTrace(b, specVersionOk, assertedStatus, errors, option
         status = "partial";
         errors.push(`${STAMP_TRACE_BODY_TYPE} body carries no stamps`);
     }
-    else if (gatewayUnavailable || anyUnwitnessed) {
+    else if (gatewayUnavailable || uncheckedKind || uncheckedId || anyUnwitnessed) {
         // Both hold the bundle at `partial`, and both get said — see §5.3's rollup
         // for why one note is not enough when there are two different gaps.
         status = "partial";
-        if (gatewayUnavailable) {
-            errors.push("one or more stamps could not be re-fetched from the supplied gateways");
-        }
+        pushRefetchGapNotes(errors, "stamps", {
+            unavailable: gatewayUnavailable,
+            kind: uncheckedKind,
+            id: uncheckedId,
+        });
         if (anyUnwitnessed) {
             // The honest half of P-10, one layer up. A stamp with no `anchor_ref` is
             // sealed and unwitnessed: `retained-by-sanning`, which is a statement
@@ -1148,7 +1402,7 @@ async function verifyStampTrace(b, specVersionOk, assertedStatus, errors, option
     };
 }
 // ===========================================================================
-// `sanning.stamp.evidence/v1` — the two halves, bound (evidence-bundle.md §5.3)
+// `sanning.stamp.evidence/v2`: the two halves, bound (evidence-bundle.md §5.3)
 //
 // The stamp half is §5.2's code unchanged (`verifyStampEntry`, which carries
 // the sub-tree partition check). The event half reuses the same primitives the
@@ -1165,7 +1419,7 @@ async function verifyStampTrace(b, specVersionOk, assertedStatus, errors, option
 async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, options) {
     const body = b.body;
     if (!Array.isArray(body?.stamps) || !Array.isArray(body?.events)) {
-        return malformed(`${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`, true);
+        return malformed(`${STAMP_EVIDENCE_BODY_TYPE} body must have stamps[] and events[]`, true, true);
     }
     // --- The stamp half: §5.2's rules, §5.2's code ----------------------------
     const seen = new Set();
@@ -1217,17 +1471,41 @@ async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, opt
         const eventId = getEventId(ev.envelope);
         let envelopeOk = false;
         let payloadBindingOk = null;
-        let recordBytes;
+        // A retired field name under this major is a reject, never an ignored
+        // unknown field: ignored, it reads as a withheld record (W-3).
+        const legacyError = legacyEventBytesError(ev, "event", STAMP_EVIDENCE_BODY_TYPE);
+        if (legacyError !== null)
+            evErrors.push(legacyError);
+        // MALFORMED IS A FAILURE; ABSENT IS UNDETERMINED (proof#85).
+        //
+        // `event_bytes` that will not decode leaves `eventBytes` undefined, and an
+        // undefined `eventBytes` is exactly how a WITHHELD record is spelled one
+        // line down. So an event carrying garbage in place of its record used to
+        // reach the same tri-state as an event carrying nothing: `payloadHashOk`
+        // null, `ok` true, a leading tick on the line, and a `verified` rollup over
+        // a record nobody could read. The only thing wrong with the pack was the
+        // bytes, and it was the one thing the verdict did not say.
+        //
+        // A record the producer chose not to disclose is the customer exercising
+        // minimum disclosure. A record that is present and unreadable is a defect
+        // in the artifact, and this kernel's standing rule (the same one
+        // `checkpoints[]` already applies through `keyed.errors`) is that a defect
+        // we can see fails.
+        let eventBytes;
+        let eventBytesMalformed = false;
         try {
-            if (typeof ev.record_bytes === "string")
-                recordBytes = hexToBytes(ev.record_bytes);
+            if (typeof ev.event_bytes === "string")
+                eventBytes = hexToBytes(ev.event_bytes);
         }
         catch (e) {
-            evErrors.push(`event record_bytes is not hex: ${stringifyErr(e)}`);
+            eventBytesMalformed = true;
+            evErrors.push(`event event_bytes is not hex${thrownDetail(e)}`);
         }
         try {
-            const res = await verifyEnvelope(ev.envelope, recordBytes !== undefined ? { payloadBytes: recordBytes } : {});
-            envelopeOk = res.ok; // tolerates an undetermined binding (withheld record)
+            const res = await verifyEnvelope(ev.envelope, eventBytes !== undefined ? { payloadBytes: eventBytes } : {});
+            const hexError = envelopeHexError("event", ev.envelope);
+            // tolerates an undetermined binding (withheld record)
+            envelopeOk = res.ok && hexError === null;
             payloadBindingOk = res.payloadHashOk;
             // P-10: report what could not be determined, never a fault that was never
             // observed. There is no envelope here, so no signature was checked and no
@@ -1239,6 +1517,9 @@ async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, opt
             if (!isJsonObject(ev.envelope)) {
                 evErrors.push("event envelope is not a JSON object");
             }
+            else if (hexError !== null) {
+                evErrors.push(hexError);
+            }
             else if (!res.signatureOk) {
                 evErrors.push("event envelope signature failed");
             }
@@ -1249,9 +1530,12 @@ async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, opt
             for (const m of res.errors)
                 if (m.startsWith("malformed "))
                     evErrors.push(`event envelope ${m}`);
+            const specFinding = specVersionFinding("event", ev.envelope, res);
+            if (specFinding !== null)
+                evErrors.push(specFinding);
         }
         catch (e) {
-            evErrors.push(`event envelope verify error: ${stringifyErr(e)}`);
+            evErrors.push(`event envelope verify error${thrownDetail(e)}`);
         }
         // --- The join (§5.3.3 rule 1) -------------------------------------------
         const incl = ev.inclusion;
@@ -1302,11 +1586,11 @@ async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, opt
                     }
                 }
                 catch (e) {
-                    evErrors.push(`inclusion verify error: ${stringifyErr(e)}`);
+                    evErrors.push(`inclusion verify error${thrownDetail(e)}`);
                 }
             }
         }
-        const contentRes = await verifyDisclosedContent(ev, eventId, recordBytes, options.content);
+        const contentRes = await verifyDisclosedContent(ev, eventId, eventBytes, options.content);
         const contentOk = contentRes.contentOk;
         evErrors.push(...contentRes.errors);
         eventResults.push({
@@ -1317,12 +1601,19 @@ async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, opt
             // Named for §5.1's join; here it reports whether `stamp_ref` resolved.
             checkpointBound: stampBound,
             contentOk,
-            ok: envelopeOk && inclusionOk && stampBound && contentOk !== false,
+            // `!eventBytesMalformed`: present-and-unreadable record bytes are a
+            // defect in the artifact, never a disclosure choice (proof#85).
+            ok: envelopeOk &&
+                inclusionOk &&
+                stampBound &&
+                contentOk !== false &&
+                legacyError === null &&
+                !eventBytesMalformed,
             errors: evErrors,
         });
     }
     // --- The optional on-chain re-fetch (§5.2.4's "online act") ---------------
-    const { onChainChecked, gatewayUnavailable } = await refetchStamps(stamps, witnessed, options, errors);
+    const { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId } = await refetchStamps(stamps, witnessed, options, errors);
     // --- Rollup ---------------------------------------------------------------
     // Rule 4: a declared event MUST be checked. `events[]` present and unverified
     // is the false green this body exists to prevent, so an event that did not
@@ -1337,16 +1628,27 @@ async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, opt
         status = "partial";
         errors.push(`${STAMP_EVIDENCE_BODY_TYPE} body carries no stamps and no events`);
     }
-    else if (gatewayUnavailable || anyUnwitnessed) {
-        // Both hold the bundle at `partial`, and BOTH get said. A stamp nobody
-        // witnessed and a witness we could not reach are different gaps with
-        // different fixes — one waits for the interval, the other for the network —
-        // and an auditor told only about the second would read the first as fine.
-        // The order is fixed so the two kernels emit the same list.
+    else if (eventResults.length === 0 ||
+        gatewayUnavailable ||
+        uncheckedKind ||
+        uncheckedId ||
+        anyUnwitnessed) {
+        // Each holds the bundle at `partial`, and EACH gets said. A pack with no
+        // events, a stamp nobody witnessed and a witness we could not reach are
+        // different gaps with different fixes, and an auditor told only about one
+        // would read the others as fine. The order is fixed so the two kernels
+        // emit the same list.
         status = "partial";
-        if (gatewayUnavailable) {
-            errors.push("one or more stamps could not be re-fetched from the supplied gateways");
-        }
+        if (eventResults.length === 0) {
+            // §5.3.2: an events-empty body is exactly a §5.2 stamp trace, and is
+            // partial, never verified. It says nothing about any event.
+            errors.push(`${STAMP_EVIDENCE_BODY_TYPE} body carries no events -- it evidences no event, only its stamps`);
+        }
+        pushRefetchGapNotes(errors, "stamps", {
+            unavailable: gatewayUnavailable,
+            kind: uncheckedKind,
+            id: uncheckedId,
+        });
         if (anyUnwitnessed) {
             // §5.3.3 rule 6, inherited whole from §5.2.4: for a stamp the witness IS
             // the independent part, so the events resting on it inherit `partial`.
@@ -1407,14 +1709,17 @@ async function verifyStampEvidence(b, specVersionOk, assertedStatus, errors, opt
 async function refetchStamps(stamps, witnessed, options, errors) {
     const gateways = options.gateways ?? [];
     const onChainChecked = gateways.length > 0;
+    const none = { gatewayUnavailable: false, uncheckedKind: false, uncheckedId: false };
     if (!onChainChecked)
-        return { onChainChecked, gatewayUnavailable: false };
+        return { onChainChecked, ...none };
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
     if (typeof fetchImpl !== "function") {
         errors.push("on-chain re-fetch requested but no fetch implementation is available");
-        return { onChainChecked, gatewayUnavailable: true };
+        return { onChainChecked, ...none, gatewayUnavailable: true };
     }
     let gatewayUnavailable = false;
+    let uncheckedKind = false;
+    let uncheckedId = false;
     for (let i = 0; i < stamps.length; i++) {
         const st = stamps[i];
         const witnessedHex = witnessed[i];
@@ -1424,9 +1729,13 @@ async function refetchStamps(stamps, witnessed, options, errors) {
             continue;
         const outcome = await refetchStamp(witnessedHex, st.anchorRef, gateways, fetchImpl);
         st.onChain = outcome.onChain;
-        st.onChainOk = outcome.onChain.onChainOk;
+        st.onChainOk = outcome.onChain?.onChainOk ?? null;
         if (outcome.unavailable)
             gatewayUnavailable = true;
+        if (outcome.unchecked === "kind")
+            uncheckedKind = true;
+        if (outcome.unchecked === "id")
+            uncheckedId = true;
         if (outcome.error)
             st.errors.push(outcome.error);
         // Fold the on-chain dimension in exactly as a checkpoint does: a MISMATCH
@@ -1440,9 +1749,9 @@ async function refetchStamps(stamps, witnessed, options, errors) {
         // unreachable note would fail a stamp for a gateway being down.
         st.ok = st.ok && st.onChainOk !== false;
     }
-    return { onChainChecked, gatewayUnavailable };
+    return { onChainChecked, gatewayUnavailable, uncheckedKind, uncheckedId };
 }
-// How many `sanning.evidence.export/v1` wrappers deep the source bundle may be
+// How many `sanning.evidence.export/v2` wrappers deep the source bundle may be
 // nested before this path gives up. verifyEvidenceBundle's canonicalization
 // depth bound already rejects a pathological bundle, but the unwrap must be
 // independently bounded rather than trusting that it ran first.
@@ -1475,7 +1784,7 @@ export async function disclosedContent(bundle, options = {}) {
     });
     const traceEvents = resolveTraceEvents(bundle);
     if (traceEvents === undefined) {
-        errors.push(`no ${[...ANCHOR_TRACE_BODY_TYPES, STAMP_EVIDENCE_BODY_TYPE].join(" / ")} ` +
+        errors.push(`no ${ANCHOR_TRACE_BODY_TYPE} / ${STAMP_EVIDENCE_BODY_TYPE} ` +
             `body to materialize content from ` +
             `(body_type ${JSON.stringify(verification.bodyType)})`);
         return empty();
@@ -1562,7 +1871,7 @@ export async function disclosedContent(bundle, options = {}) {
 // a caller must distinguish from a body that has events and no links.
 //
 // BOTH event-carrying bodies, not just anchor-trace (proof#73): §5.3's
-// `sanning.stamp.evidence/v1` is the hand-over pack, and it presents the same
+// `sanning.stamp.evidence/v2` is the hand-over pack, and it presents the same
 // event shape.
 //
 // Exported for `chain.ts`, which needs the same descent and must not derive it
@@ -1578,15 +1887,14 @@ export function resolveTraceEvents(bundle) {
         const b = cur;
         const bodyType = typeof b.body_type === "string" ? b.body_type : null;
         // Both event-carrying bodies, not just anchor-trace (proof#73). §5.3's
-        // `sanning.stamp.evidence/v1` presents the SAME event shape (a
-        // producer-signed envelope, optional `record_bytes`, an inclusion proof),
+        // `sanning.stamp.evidence/v2` presents the SAME event shape (a
+        // producer-signed envelope, optional `event_bytes`, an inclusion proof),
         // and it is the HAND-OVER PACK: the only artifact an auditor is ever
         // handed. Dispatching on anchor-trace alone meant `readChains` reported
         // zero chains on every pack, however well-formed the links inside its
         // records were, so "is it in order?" read as NOT CHECKED on the one shape
         // that matters. The writers have been emitting those links the whole time.
         if (bodyType === ANCHOR_TRACE_BODY_TYPE ||
-            bodyType === ANCHOR_TRACE_BODY_TYPE_V1 ||
             bodyType === STAMP_EVIDENCE_BODY_TYPE) {
             const body = b.body;
             if (body === null || typeof body !== "object" || !Array.isArray(body.events))
@@ -1673,13 +1981,13 @@ async function verifyExportBody(b, specVersionOk, assertedStatus, errors, option
         }
     }
     catch (e) {
-        errors.push(`source_bundle canonicalization failed: ${stringifyErr(e)}`);
+        errors.push(`source_bundle canonicalization failed${thrownDetail(e)}`);
     }
     // --- Step 4: recompute the source verdict ---------------------------------
     // The existing evidence path over the inline source bundle — same primitives
     // (Ed25519 envelopes, payload binding, RFC 9162 inclusion, merkle roots,
     // content_ok, and the optional per-gateway on-chain re-fetch, §4.2 / step 7).
-    const sourceResult = await verifyEvidenceBundle(inline, options);
+    const sourceResult = await verifyExportSource(inline, options);
     // Attestation data_hash binding (§5 6c).
     const sourceCheckpoints = await indexSourceCheckpoints(inline);
     // --- Step 6: embedded attestation records ---------------------------------
@@ -1717,7 +2025,7 @@ async function verifyExportBody(b, specVersionOk, assertedStatus, errors, option
         }
     }
     catch (e) {
-        errors.push(`verdict agreement comparison failed: ${stringifyErr(e)}`);
+        errors.push(`verdict agreement comparison failed${thrownDetail(e)}`);
     }
     // --- Step 7 already folded in by the source recompute ---------------------
     // (verifyEvidenceBundle merged per-gateway outcomes into sourceResult.status:
@@ -1772,7 +2080,7 @@ async function verifyExportBody(b, specVersionOk, assertedStatus, errors, option
     };
 }
 export async function recomputeExportVerdict(sourceBundle, attestationRecords, generatedAt, options = {}) {
-    const sourceResult = await verifyEvidenceBundle(sourceBundle, options);
+    const sourceResult = await verifyExportSource(sourceBundle, options);
     // Attestation data_hash binding (§5 6c) — the SAME index construction as
     // verifyExportBody, deliberately shared rather than restated.
     const sourceCheckpoints = await indexSourceCheckpoints(sourceBundle);
@@ -1812,6 +2120,54 @@ export async function recomputeExportVerdict(sourceBundle, attestationRecords, g
 // field; otherwise a per-dimension AttestationResult whose `ok` gates on the
 // three binding checks (sig / operator-address / data_hash). subject_ref is
 // undetermined-tolerant and never gates.
+// The attestation payload fields evidence-export.md §3.1 marks Required, with
+// the type it gives each. A record whose payload lacks one, or carries another
+// type (null included), is malformed: §5 step 9 and §4.5 make "a missing
+// required field" an export the verifier cannot render (exit 2). §5 step 6
+// gates a WELL-FORMED record on signature, operator and data_hash only; these
+// checks decide whether the record is well-formed at all. `level` is the §3.1
+// enum 1 | 2 | 3. The integers are non-negative and within 2**53 - 1 (the
+// §3.1 clarification).
+const PAYLOAD_REQUIRED = [
+    ["attested_at", "string"],
+    ["tx_id", "string"],
+    ["data_hash", "string"],
+    ["data_size", "integer"],
+    ["block_height", "integer"],
+    ["block_timestamp", "integer"],
+    ["operator", "string"],
+    ["owner_address", "string"],
+    ["gateway", "string"],
+    ["signature_verified", "boolean"],
+    ["level", "level"],
+];
+function payloadFieldError(payload) {
+    for (const [name, kind] of PAYLOAD_REQUIRED) {
+        const v = Object.prototype.hasOwnProperty.call(payload, name) ? payload[name] : undefined;
+        let ok;
+        let want;
+        if (kind === "string") {
+            ok = typeof v === "string";
+            want = "a string";
+        }
+        else if (kind === "boolean") {
+            ok = typeof v === "boolean";
+            want = "a boolean";
+        }
+        else if (kind === "integer") {
+            // §3.1 (clarified): a non-negative integer no larger than 2**53 - 1.
+            ok = typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+            want = "a non-negative integer";
+        }
+        else {
+            ok = v === 1 || v === 2 || v === 3;
+            want = "1, 2 or 3";
+        }
+        if (!ok)
+            return `attestation payload field ${JSON.stringify(name)} is missing or not ${want}`;
+    }
+    return null;
+}
 async function verifyAttestation(rec, sourceCheckpoints) {
     const errs = [];
     const result = {
@@ -1851,6 +2207,9 @@ async function verifyAttestation(rec, sourceCheckpoints) {
     if (typeof rec.signature !== "string") {
         return { result, malformed: "attestation record missing signature" };
     }
+    const fieldError = payloadFieldError(payload);
+    if (fieldError !== null)
+        return { result, malformed: fieldError };
     const rsaKey = { kty: "RSA", n: pub.n, e: pub.e };
     result.operator = typeof payload.operator === "string" ? payload.operator : "";
     result.gateway = typeof payload.gateway === "string" ? payload.gateway : null;
@@ -1863,15 +2222,22 @@ async function verifyAttestation(rec, sourceCheckpoints) {
         payloadBytes = utf8(jcs(payload));
     }
     catch (e) {
-        return { result, malformed: `attestation payload canonicalization failed: ${stringifyErr(e)}` };
+        return { result, malformed: `attestation payload canonicalization failed${thrownDetail(e)}` };
     }
     try {
         result.signatureOk = await verifyRsaPssSha256(payloadBytes, rec.signature, rsaKey);
         if (!result.signatureOk)
             errs.push("attestation RSA-PSS signature verification failed");
     }
-    catch (e) {
-        return { result, malformed: `attestation ${stringifyErr(e)}` };
+    catch {
+        // A FIXED sentence, not the library's. This kernel throws
+        // `verifyRsaPssSha256: malformed signature hex: ...` and the Python kernel
+        // raises `malformed signature hex: ...`, so quoting either one split the
+        // two kernels on a finding a holder can put in an export body it signs,
+        // and an export pack's findings reach a case reading through `reasons`
+        // (gate 4 on proof#140, finding 1). Callers of `verifyRsaPssSha256` still
+        // get this kernel's own words.
+        return { result, malformed: "attestation signature or key is malformed" };
     }
     // (b) operator-address binding: base64url(SHA-256(modulus)) == payload.operator.
     try {
@@ -1882,7 +2248,7 @@ async function verifyAttestation(rec, sourceCheckpoints) {
         }
     }
     catch (e) {
-        return { result, malformed: `attestation operator key: ${stringifyErr(e)}` };
+        return { result, malformed: `attestation operator key${thrownDetail(e)}` };
     }
     // (c) checkpoint resolution + data_hash binding. The checkpoint tx data IS the
     // uploaded JCS(envelope) bytes (the same bytes the on-chain re-fetch compares
@@ -1904,7 +2270,7 @@ async function verifyAttestation(rec, sourceCheckpoints) {
             }
         }
         catch (e) {
-            errs.push(`cannot recompute checkpoint content hash: ${stringifyErr(e)}`);
+            errs.push(`cannot recompute checkpoint content hash${thrownDetail(e)}`);
         }
     }
     // (d) subject_ref (§3.2) — well-formedness only (no side-input subject channel
@@ -2116,6 +2482,35 @@ async function refetchStamp(witnessedHex, anchorRef, gateways, fetchImpl) {
 // beats unreachable" to drift, and the drifted copy is the one nobody reads.
 // The subject only ever selects wording; it never changes a verdict.
 async function refetchAnchored(subject, expectedHex, anchorRef, gateways, fetchImpl) {
+    // Only a `kind` this kernel has a witness adapter for is re-fetched
+    // (evidence-bundle.md §5.1: "where the verifier has an adapter for its
+    // `kind`"; §5.1.1: an unrecognised kind MUST NOT fail verification). An `id`
+    // of any other kind is not an Arweave id, so whatever a gateway serves at
+    // that path says nothing about the witness, and comparing it would turn an
+    // unrelated 200 into a false mismatch. No fetch, `onChain: null`, and the
+    // run goes `partial`: the caller asked for the witness check and it was not
+    // made.
+    if (!WITNESS_ADAPTER_KINDS.has(anchorRef.kind)) {
+        return {
+            onChain: null,
+            unavailable: false,
+            unchecked: "kind",
+            error: `no witness adapter for kind '${anchorRef.kind}'; the witness was not checked`,
+        };
+    }
+    // The id becomes a URL path segment. Anything but a 43-character base64url
+    // transaction id can leave the gateway's base path once URL parsing
+    // normalises it (`../x`, `%2e%2e/x`), or drop part of the path (`a#b`,
+    // `a?b`), and the two kernels would then request different URLs. Such an id
+    // is never fetched and never failed: the witness is not checked.
+    if (!ARWEAVE_ID_RE.test(anchorRef.id)) {
+        return {
+            onChain: null,
+            unavailable: false,
+            unchecked: "id",
+            error: "arweave witness id is not a 43-character base64url transaction id; the witness was not checked",
+        };
+    }
     const perGateway = [];
     for (const gw of gateways) {
         perGateway.push({
@@ -2134,7 +2529,28 @@ async function refetchAnchored(subject, expectedHex, anchorRef, gateways, fetchI
     else if (onChain.rollup === "unreachable") {
         error = `${subject} ${anchorRef.id} unreachable on all gateways`;
     }
-    return { onChain, unavailable: onChain.rollup === "unreachable", error };
+    return { onChain, unavailable: onChain.rollup === "unreachable", unchecked: null, error };
+}
+// The `anchor_ref.kind` values this kernel can re-fetch from a gateway
+// (evidence-bundle.md §5.1.1 registers exactly `arweave`). Any other kind is
+// left unchecked by `refetchAnchored`, never probed.
+const WITNESS_ADAPTER_KINDS = new Set(["arweave"]);
+// The only `arweave` ids the adapter looks up: a 43-character base64url
+// transaction or data-item id.
+const ARWEAVE_ID_RE = /^[A-Za-z0-9_-]{43}$/;
+// The bundle-level notes for a run where requested re-fetches were not made.
+// Each note keeps the phrase "could not be re-fetched", which is what both
+// CLIs map to exit 3. The order is fixed so the two kernels emit the same list.
+function pushRefetchGapNotes(errors, subject, gaps) {
+    if (gaps.unavailable) {
+        errors.push(`one or more ${subject} could not be re-fetched from the supplied gateways`);
+    }
+    if (gaps.kind) {
+        errors.push(`one or more ${subject} name a witness kind this verifier has no adapter for, so it could not be re-fetched`);
+    }
+    if (gaps.id) {
+        errors.push(`one or more ${subject} name an Arweave witness id this verifier cannot look up, so it could not be re-fetched`);
+    }
 }
 // One gateway's outcome for one checkpoint tx: confirm (bytes match), mismatch
 // (bytes disagree), or unreachable (no response / !ok / network error).
@@ -2165,7 +2581,7 @@ async function probeGateway(anchorRef, gateway, expectedHex, fetchImpl) {
     if (toHex(onChainBytes) === expectedHex)
         return "confirm";
     try {
-        const parsed = JSON.parse(new TextDecoder().decode(onChainBytes));
+        const parsed = jcsParse(onChainBytes);
         if (toHex(utf8(jcs(parsed))) === expectedHex)
             return "confirm";
     }
@@ -2209,7 +2625,7 @@ function selectDisclosedBytes(ev, eventId, sideContent) {
             inBody = hexToBytes(ev.content);
         }
         catch (e) {
-            errors.push(`event content is not hex: ${stringifyErr(e)}`);
+            errors.push(`event content is not hex${thrownDetail(e)}`);
         }
     }
     let side;
@@ -2222,7 +2638,7 @@ function selectDisclosedBytes(ev, eventId, sideContent) {
             side = hexToBytes(sideEntry.value);
         }
         catch (e) {
-            errors.push(`supplied content for ${eventId} is not hex: ${stringifyErr(e)}`);
+            errors.push(`supplied content for ${eventId} is not hex${thrownDetail(e)}`);
         }
     }
     // `offered` comes from the SAME test that produced the value, never from