@zanii/custody-verdicts 0.1.0 → 0.2.0

package/src/index.ts

@@ -1,1357 +1,1412 @@
-/**
- * @zanii/custody-verdicts: the one verifier. One verifier, two surfaces: the subject
- * page (zanii-id) and `@zanii/cli` both import this package and call `computeVerdicts`.
- * Never two implementations of the verdict logic: two drift, and the drift always
- * favours the vendor.
- *
- * Verdicts are **computed, never stored**. Input is a `SubjectHistory` from
- * `@zanii/subject` (`fetchSubjectHistory`): the subject's receipt slice, each receipt
- * already verified offline (signature + delegation + scope), plus the signed tree
- * head. SpiritWave's custody receipts embed the `@zanii/data-custody` touch payload
- * inside the receipt as a signature-covered `payload` field (the ledger has no
- * payload store); row 1 re-checks every embedded payload with `verifyTouch`, and
- * tolerates the other custody kind this package itself consumes: a `@zanii/retention`
- * crypto-shredding payload (`verifyKeyDestruction`), which row 5 reads as the
- * key-destruction evidence.
- *
- * Four states per line: `proven`, `not covered`, `failed`, `cannot determine`. The
- * last three are as first-class as the first: a missing proof is NOT a clean result
- * ("no declared training runs to check against", never "never"). A bad receipt is a
- * red, not a grey, and a presented-but-broken proof is a red too.
- *
- * The function is pure: no network, no clock (`computeAnchorLag` takes `now` from the
- * caller). It is async for exactly one reason: row 3's coverage attestation is checked
- * through `@zanii/attest`'s `verifyAttestation`, whose injected quote verifier may be
- * async. Verification paths never throw: malformed input yields `cannot determine` /
- * `not covered` / `failed` rows with reasons, per the codebase convention (creation
- * paths throw, verification paths return results).
- *
- * Rows 3–5 consume real producer evidence, checked here, narrowly and offline:
- * row 3 a SIGNED coverage attestation (`@zanii/attest` verifies the embedded
- * attestation with an injected quote verifier; the producer side ships with the
- * enclave phase, so until then `proven` is unreachable, by design), row 4 a declared,
- * anchor-ordered training manifest plus `@zanii/train`'s sorted-Merkle `AbsenceProof`
- * (`verifyAbsence`), row 5 the `@zanii/retention` shred receipts carried by the slice
- * itself (`verifyKeyDestruction`), optionally bound to a published image hash via
- * `@zanii/attest`'s `attestationHash` convention.
- *
- * Rows 6–8 consume the slice the same narrow way: row 6 residency claims
- * (`@zanii/residency`'s `buildResidencyClaim` shape) verified with an injected region
- * verifier against the reader-pinned jurisdiction allow-set, plus `detectCrossings`
- * over the verified touch sequence; row 7 onward transfers (`@zanii/subprocessor`'s
- * `buildTransfer` shape) and custody-touch junctions checked against the
- * reader-pinned declared subprocessor list via `verifyTransfers`; row 8 field-set
- * commitments (`@zanii/minimization`'s `commitFieldSet` records) and access proofs
- * (`buildAccessProof`) checked with `verifyMinimization`. The jurisdiction allow-set
- * and the declared subprocessor list are READER configuration (ExtraEvidence), never
- * producer-supplied: the same trust rule as `coverage.trustedSigners`.
- */
-import { ed25519 } from '@noble/curves/ed25519';
-import { hexToBytes } from '@noble/hashes/utils';
-import {
-  canonicalBytes, publicKeyFromDid, verifySTH,
-  type Receipt, type SignedTreeHead,
-} from '@zanii/core';
-import { verifyTouch } from '@zanii/data-custody';
-import { verifyKeyDestruction } from '@zanii/retention';
-import { verifyAbsence, type AbsenceProof, type TrainingManifest } from '@zanii/train';
-import {
-  attestationHash, verifyAttestation,
-  type Attestation, type AttestCheck, type QuoteVerifier,
-} from '@zanii/attest';
-import {
-  detectCrossings, verifyResidency,
-  type RegionVerifier, type ResidencyClaim,
-} from '@zanii/residency';
-import { verifyTransfers, type Agreement, type Transfer } from '@zanii/subprocessor';
-import { verifyFieldSet, verifyMinimization, type AccessProof } from '@zanii/minimization';
-import type { SubjectHistory, SubjectReceipt } from '@zanii/subject';
-
-export type { AbsenceProof, TrainingManifest } from '@zanii/train';
-export type { Attestation, QuoteVerifier } from '@zanii/attest';
-export type { RegionVerifier, ResidencyClaim } from '@zanii/residency';
-export type { Agreement, Transfer } from '@zanii/subprocessor';
-export type { AccessProof } from '@zanii/minimization';
-
-/**
- * The well-known ledger tag under which declared training manifests are published.
- * The subject page and the CLI fetch that slice to build the row-4 training evidence
- * bag (`ExtraEvidence.training`).
- */
-export const TRAINING_MANIFEST_TAG = 'zanii:training-manifests';
-
-/** The four verdict states. The last three are as loud as the first. */
-export type VerdictState = 'proven' | 'not covered' | 'failed' | 'cannot determine';
-
-export type VerdictId =
-  | 'purpose' | 'self_sovereign' | 'human_read' | 'trained_on' | 'copy_kept'
-  | 'residency' | 'subprocessor' | 'minimization';
-
-export interface VerdictRow {
-  id: VerdictId;
-  label: string;
-  state: VerdictState;
-  /** Plain-language working: which receipts were computed over, why this state. Rendered verbatim. */
-  detail: string;
-}
-
-/**
- * Coverage attestation for the "nobody read it" line: a SIGNED record asserting that
- * every egress path to the data was receipt-gated (the `@zanii/broker` invariant) for
- * the whole window, bound to the attested image whose code enforced it. The signature
- * covers every field but `sig`; `imageHash` must equal `attestationHash(attestation)`
- * (`@zanii/attest`'s convention), and the embedded attestation is verified through
- * `verifyAttestation` with the caller's injected quote verifier. Anything unsigned or
- * malformed is never `proven`. The producer side ships with the enclave phase
- * (`@zanii/attest` + `@zanii/broker`); until then this evidence does not exist and the
- * row answers `not covered`, by design.
- */
-export interface CoverageEvidence {
-  v: 1;
-  type: 'coverage.attestation';
-  /** Every egress path was receipt-gated; partial coverage is no coverage. */
-  allPathsGated: boolean;
-  /** ISO timestamp: start of the gated window. */
-  windowStart: string;
-  /** ISO timestamp: end of the gated window. */
-  windowEnd: string;
-  /** `attestationHash` of the embedded attestation: the image the claim is bound to. */
-  imageHash: string;
-  /** The full attestation record (`@zanii/attest`'s `Attestation`). */
-  attestation: Attestation;
-  /** did:key of the platform key that signed this attestation. */
-  signer: string;
-  /** `ed25519:<hex>` over the canonical record minus `sig`. */
-  sig: string;
-  /**
-   * Optional trust root: the deployment's pinned coverage-signing DIDs. The reader
-   * (subject page / CLI) sets this from its OWN configuration, never from
-   * producer-supplied data; otherwise an attacker could attest with their own key and
-   * name it trusted. Not part of the signed record (excluded from the signature
-   * preimage). When present, a signer not in the list is `failed`; an empty list
-   * trusts no one. When absent, any well-formed did:key signer is accepted.
-   */
-  trustedSigners?: string[];
-}
-
-/**
- * A declared, anchored training run plus `@zanii/train`'s absence proof. Ordering is
- * the whole claim: the manifest anchor must PRECEDE the run attestation. A manifest
- * anchored afterwards could have been written to exclude the subject.
- */
-export interface TrainingEvidence {
-  /** The run's sorted-Merkle training manifest (`@zanii/train`'s `TrainingManifest`). */
-  manifest: TrainingManifest;
-  /** ISO timestamp when the manifest root was anchored. */
-  anchoredAt: string;
-  /** ISO timestamp of the run attestation. */
-  runAttestedAt: string;
-  /** `@zanii/train`'s `AbsenceProof` for this subject's tag, verified against the manifest. */
-  absenceProof: AbsenceProof;
-}
-
-/**
- * Optional image evidence for the "no copy was kept" line: a CLAIMED destruction-image
- * attestation plus the image hash the operator published for it. What is checked here
- * is bag-internal consistency only, via `@zanii/attest`'s `attestationHash` convention
- * (the published image hash is `attestationHash` of the published attestation record):
- * a mismatch is `failed`. A match does NOT by itself prove the destruction ran under
- * that image: nothing yet binds the shred receipt to the attestation, and the
- * attestation's quote is not verified on this path. Full binding ships with the
- * enclave phase.
- */
-export interface DestructionImageEvidence {
-  /** The attestation (`@zanii/attest`'s `Attestation`) claimed for the destruction image. */
-  attestation: Attestation;
-  /** The published image hash: `attestationHash` of the published attestation record. */
-  publishedImageHash: string;
-}
-
-/**
- * Optional evidence bag for rows 3–5. Row 5 needs no bag entry for the destruction
- * record itself: the shred receipts are read from the subject's slice, each already
- * signature-covered and offline-verified. `destructionImage` only checks a claimed
- * destruction-image attestation against the published image hash.
- */
-export interface ExtraEvidence {
-  coverage?: CoverageEvidence;
-  training?: TrainingEvidence;
-  destructionImage?: DestructionImageEvidence;
-  /**
-   * Row 6 trust root: the declared jurisdiction as an allow-set of region codes
-   * (`@zanii/residency`'s `allowedRegions`, e.g. `['AE', 'me-central-1']`). READER
-   * configuration (deployment-side), never producer-supplied: the same trust rule as
-   * `coverage.trustedSigners`, or a producer could declare the whole world in bounds.
-   * When absent, residency claims can reach `cannot determine`, never `proven`. An
-   * empty array allows no region: every verified claim is a crossing.
-   */
-  jurisdiction?: string[];
-  /**
-   * Row 7 trust root: the declared subprocessor list (the parties onward transfers
-   * may name). READER configuration, never producer-supplied, same trust rule as
-   * `coverage.trustedSigners`. When absent, transfers or junctions on record reach
-   * `cannot determine`, never `proven`. An empty array declares no one.
-   */
-  declaredSubprocessors?: string[];
-}
-
-/** Caller-injected verifiers: the enclave quote verifier for row 3, the region
- *  signal verifier for row 6. */
-export interface VerdictOptions {
-  /**
-   * Platform-specific enclave quote verifier (`@zanii/attest`'s `QuoteVerifier`).
-   * Without it a signed coverage attestation can reach `cannot determine`, never
-   * `proven`: the quote stays unknown, and unknown is not verified.
-   */
-  verifyQuote?: QuoteVerifier;
-  /**
-   * Region signal verifier (`@zanii/residency`'s `RegionVerifier`): authenticates a
-   * claim's region attestation (a cloud provider identity document, a TEE geo
-   * signal) and returns the trusted region. Without it residency claims can reach
-   * `cannot determine`, never `proven`.
-   */
-  verifyRegion?: RegionVerifier;
-}
-
-const LABELS: Record<VerdictId, string> = {
-  purpose: 'Used only for its declared purpose',
-  self_sovereign: 'You can check this yourself',
-  human_read: 'Nobody read it',
-  trained_on: 'Never used to train a model',
-  copy_kept: 'No copy was kept',
-  residency: 'Data stayed in its declared region',
-  subprocessor: 'Only declared third parties touched it',
-  minimization: 'Only what was needed was taken',
-};
-
-/** A receipt as served by the ledger: core fields plus the operator-revealed,
- *  signature-covered embedded payload (the ledger has no payload store). */
-type ReceiptWithPayload = Receipt & { payload?: unknown };
-
-function touchPayloadOf(sr: SubjectReceipt): unknown {
-  return (sr?.receipt as ReceiptWithPayload | undefined)?.payload;
-}
-
-function asPayload(p: unknown): Record<string, unknown> | undefined {
-  return p !== null && typeof p === 'object' && !Array.isArray(p)
-    ? (p as Record<string, unknown>)
-    : undefined;
-}
-
-const plural = (n: number, word: string, pluralForm?: string) => `${n} ${n === 1 ? word : (pluralForm ?? `${word}s`)}`;
-
-function parseTime(ts: unknown): number | null {
-  if (typeof ts !== 'string') return null;
-  const ms = Date.parse(ts);
-  return Number.isNaN(ms) ? null : ms;
-}
-
-/** `sha256:<64 hex>` → bytes, null on any other shape. */
-function parseHash(s: unknown): Uint8Array | null {
-  if (typeof s !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(s)) return null;
-  return hexToBytes(s.slice('sha256:'.length));
-}
-
-// ---------------------------------------------------------------------------
-// Row 1 (purpose): "Used only for its declared purpose"
-// ---------------------------------------------------------------------------
-
-// Structural validators for the evidence payloads rows 6-8 consume, shared with row
-// 1's closed world. Creation paths throw, verification paths return reasons.
-
-/** Structural check of a `@zanii/residency` claim (`buildResidencyClaim`'s shape). */
-function residencyClaimReasons(p: Record<string, unknown>): string[] {
-  const reasons: string[] = [];
-  if (p.v !== 1 || p.type !== 'residency.claim') reasons.push('not a residency claim (v1)');
-  const ra = asPayload(p.region_attestation);
-  if (!ra) reasons.push('missing region attestation');
-  else {
-    if (typeof ra.region !== 'string' || !ra.region) reasons.push('missing/invalid region');
-    if (typeof ra.source !== 'string' || !ra.source) reasons.push('missing region source');
-  }
-  if (parseTime(p.ts) === null) reasons.push('missing/invalid ts');
-  return reasons;
-}
-
-/** Structural check of a `@zanii/subprocessor` transfer (`buildTransfer`'s shape). */
-function transferReasons(p: Record<string, unknown>): string[] {
-  const reasons: string[] = [];
-  if (p.v !== 1 || p.type !== 'subprocessor.transfer') reasons.push('not a subprocessor transfer (v1)');
-  if (typeof p.from !== 'string' || !p.from) reasons.push('missing from');
-  if (typeof p.to !== 'string' || !p.to) reasons.push('missing to');
-  const agreement = asPayload(p.agreement);
-  if (!agreement || typeof agreement.type !== 'string' || !agreement.type) reasons.push('missing agreement');
-  if (parseTime(p.ts) === null) reasons.push('missing/invalid ts');
-  return reasons;
-}
-
-/** Structural check of a `@zanii/minimization` field-set commitment record: the
- *  `commitFieldSet` output (`{ commitment, fields }`) carried as a payload of type
- *  `minimization.commit`. */
-function commitReasons(p: Record<string, unknown>): string[] {
-  const reasons: string[] = [];
-  if (p.type !== 'minimization.commit') reasons.push('not a field-set commitment record');
-  if (typeof p.commitment !== 'string' || !p.commitment.startsWith('minfields:')) reasons.push('missing/invalid commitment');
-  if (!Array.isArray(p.fields) || p.fields.some((f) => typeof f !== 'string')) reasons.push('missing/invalid fields');
-  return reasons;
-}
-
-/** Structural check of a `@zanii/minimization` access proof (`buildAccessProof`'s shape). */
-function accessReasons(p: Record<string, unknown>): string[] {
-  const reasons: string[] = [];
-  if (p.v !== 1 || p.type !== 'minimization.access') reasons.push('not a minimization access proof (v1)');
-  if (typeof p.field_set !== 'string' || !p.field_set.startsWith('minfields:')) reasons.push('missing/invalid field_set');
-  if (!Array.isArray(p.accessed) || p.accessed.some((f) => typeof f !== 'string')) reasons.push('missing/invalid accessed');
-  return reasons;
-}
-
-/** The evidence payload kinds rows 6-8 consume, identified by their `type` tag. */
-function evidenceKindOf(p: Record<string, unknown>): 'residency' | 'transfer' | 'commit' | 'access' | null {
-  switch (p.type) {
-    case 'residency.claim': return 'residency';
-    case 'subprocessor.transfer': return 'transfer';
-    case 'minimization.commit': return 'commit';
-    case 'minimization.access': return 'access';
-    default: return null;
-  }
-}
-
-/**
- * A slice receipt is well-formed custody evidence when its embedded payload is a
- * well-formed custody touch (`@zanii/data-custody`) OR a well-formed retention shred
- * (`@zanii/retention`) OR one of the evidence payloads rows 6-8 consume (a residency
- * claim, a subprocessor transfer, a field-set commitment, a minimization access
- * proof). Anything else in a custody slice is a red. Closed world on purpose: new
- * custody kinds stay red until wired here. The returned kind lets the row say
- * honestly what passed or what failed: a retention payload never gets touch-schema
- * reasons.
- */
-function wellFormedCustodyPayload(
-  p: unknown,
-): { ok: true; kind: 'touch' | 'shred' | 'residency' | 'transfer' | 'commit' | 'access' } | { ok: false; kind: 'touch' | 'retention' | 'residency' | 'transfer' | 'commit' | 'access'; reasons: string[] } {
-  const payload = asPayload(p);
-  // A retention-claimed payload is checked as one, pass or fail.
-  if (payload && payload['_zr_kind'] === 'retention') {
-    let shred: { ok: boolean; reasons: string[] };
-    try {
-      shred = verifyKeyDestruction(payload);
-    } catch {
-      shred = { ok: false, reasons: ['unreadable payload'] };
-    }
-    return shred.ok ? { ok: true, kind: 'shred' } : { ok: false, kind: 'retention', reasons: shred.reasons };
-  }
-  const kind = payload ? evidenceKindOf(payload) : null;
-  if (kind !== null && payload) {
-    const reasons = kind === 'residency' ? residencyClaimReasons(payload)
-      : kind === 'transfer' ? transferReasons(payload)
-      : kind === 'commit' ? commitReasons(payload)
-      : accessReasons(payload);
-    return reasons.length === 0 ? { ok: true, kind } : { ok: false, kind, reasons };
-  }
-  let touch: { ok: boolean; reasons: string[] };
-  try {
-    touch = verifyTouch(payload);
-  } catch {
-    touch = { ok: false, reasons: ['unreadable payload'] };
-  }
-  return touch.ok ? { ok: true, kind: 'touch' } : { ok: false, kind: 'touch', reasons: touch.reasons };
-}
-
-const EVIDENCE_NOUNS: Record<'residency' | 'transfer' | 'commit' | 'access', [string, string?]> = {
-  residency: ['residency claim'],
-  transfer: ['transfer record'],
-  commit: ['field-set commitment'],
-  access: ['access proof'],
-};
-
-function purposeRow(history: SubjectHistory, receipts: SubjectReceipt[]): VerdictRow {
-  const id = 'purpose' as const;
-  if (receipts.length === 0) {
-    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
-  }
-  if (history.verified !== true) {
-    return { id, label: LABELS[id], state: 'failed', detail: offlineFailureDetail(history) };
-  }
-  let touches = 0;
-  let shreds = 0;
-  const evidence: Array<'residency' | 'transfer' | 'commit' | 'access'> = [];
-  for (const sr of receipts) {
-    const check = wellFormedCustodyPayload(touchPayloadOf(sr));
-    if (!check.ok) {
-      const what = check.kind === 'touch' ? 'custody touch'
-        : check.kind === 'retention' ? 'retention'
-        : `${EVIDENCE_NOUNS[check.kind][0]}`;
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `Receipt ${sr?.hash} (index ${sr?.index}) has a malformed ${what} payload: ${check.reasons.join(', ')}.`,
-      };
-    }
-    if (check.kind === 'shred') shreds += 1;
-    else if (check.kind === 'touch') touches += 1;
-    else evidence.push(check.kind);
-  }
-  if (evidence.length === 0) {
-    if (shreds === 0) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'proven',
-        detail: `All ${plural(receipts.length, 'receipt')} in this slice verified offline (signature, delegation, scope) and each carries a well-formed custody touch payload naming its data class and operation.`,
-      };
-    }
-    return {
-      id,
-      label: LABELS[id],
-      state: 'proven',
-      detail: `All ${plural(receipts.length, 'receipt')} in this slice verified offline (signature, delegation, scope): ${plural(touches, 'touch', 'touches')} carried a well-formed custody touch payload naming its data class and operation, and ${plural(shreds, 'retention shred')} carried a well-formed key-destruction payload.`,
-    };
-  }
-  // Slices that also carry the rows 6-8 evidence payloads: enumerate them honestly.
-  const counts = new Map<string, number>();
-  for (const k of evidence) counts.set(k, (counts.get(k) ?? 0) + 1);
-  const named = [...counts.entries()].map(([k, n]) => {
-    const [noun, pluralForm] = EVIDENCE_NOUNS[k as keyof typeof EVIDENCE_NOUNS];
-    return plural(n, noun, pluralForm);
-  });
-  const parts = [`${plural(touches, 'touch', 'touches')} carried a well-formed custody touch payload naming its data class and operation`];
-  if (shreds > 0) parts.push(`${plural(shreds, 'retention shred')} carried a well-formed key-destruction payload`);
-  parts.push(`${named.join(', ')} passed structural checks`);
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `All ${plural(receipts.length, 'receipt')} in this slice verified offline (signature, delegation, scope): ${parts.join(', and ')}.`,
-  };
-}
-
-function offlineFailureDetail(history: SubjectHistory): string {
-  const failures = Array.isArray(history.failures) ? history.failures : [];
-  if (failures.length === 0) return 'The slice did not verify offline.';
-  return `${plural(failures.length, 'receipt')} failed offline verification: ${failures.join('; ')}. A receipt that does not verify is a failure, not an unknown.`;
-}
-
-// ---------------------------------------------------------------------------
-// Row 2 (self-sovereign): "You can check this yourself"
-// ---------------------------------------------------------------------------
-
-function selfSovereignRow(history: SubjectHistory, receipts: SubjectReceipt[]): VerdictRow {
-  const id = 'self_sovereign' as const;
-  if (receipts.length === 0) {
-    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
-  }
-  if (history.verified !== true) {
-    return { id, label: LABELS[id], state: 'failed', detail: offlineFailureDetail(history) };
-  }
-  if (history.sth === undefined || history.sth === null) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'The slice came with no signed tree head, so the anchor commitment could not be verified.',
-    };
-  }
-  let sthOk = false;
-  try {
-    sthOk = verifySTH(history.sth as unknown as SignedTreeHead);
-  } catch {
-    sthOk = false;
-  }
-  if (!sthOk) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: "The signed tree head failed verification: the log's commitment to this slice does not check out.",
-    };
-  }
-  const size = (history.sth as { size?: unknown }).size;
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `All ${plural(receipts.length, 'receipt')} verified offline in this process (signature, delegation, scope) and the signed tree head (size ${typeof size === 'number' ? size : '?'}) verifies: zero network calls, nothing taken on trust.`,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Row 3 (human_read): "Nobody read it"
-// ---------------------------------------------------------------------------
-
-async function humanReadRow(
-  receipts: SubjectReceipt[],
-  evidence: ExtraEvidence,
-  verifyQuote: QuoteVerifier | undefined,
-): Promise<VerdictRow> {
-  const id = 'human_read' as const;
-  // A receipt shows a human actor when its embedded touch payload declares one
-  // (`actor: "human"`). The check is cheap and always runs, evidence or not, and a
-  // human actor beats any coverage attestation: failed stays failed.
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['actor'] === 'human') {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `Receipt ${sr?.hash} (index ${sr?.index}) records a human actor: a person, not only an agent, touched this data.`,
-      };
-    }
-  }
-  const coverage = evidence.coverage;
-  if (!coverage) {
-    return { id, label: LABELS[id], state: 'not covered', detail: 'No coverage attestation for this window' };
-  }
-  if (typeof coverage !== 'object' || Array.isArray(coverage) || coverage.v !== 1 || coverage.type !== 'coverage.attestation') {
-    return { id, label: LABELS[id], state: 'not covered', detail: 'The coverage evidence is not a signed coverage attestation.' };
-  }
-  if (receipts.length === 0) {
-    // Coverage over nothing proves nothing about the subject's data.
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: "This slice has no receipts, so there is nothing for the coverage attestation to cover: coverage over nothing proves nothing about this subject's data.",
-    };
-  }
-  // Authenticate before evaluating: an unsigned or badly-signed claim is not evidence.
-  const signerPub = publicKeyFromDid(typeof coverage.signer === 'string' ? coverage.signer : '');
-  if (!signerPub || typeof coverage.sig !== 'string' || !/^ed25519:[0-9a-f]{128}$/.test(coverage.sig)) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: 'The coverage attestation is unsigned or carries a malformed signature: an unsigned coverage claim is not evidence.',
-    };
-  }
-  // The trust root: when the deployment pins coverage-signing DIDs, a signer outside
-  // the list is never proven, however good its signature.
-  const trustedSigners = coverage.trustedSigners;
-  if (Array.isArray(trustedSigners) && !trustedSigners.includes(coverage.signer)) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: `The coverage attestation is from an unrecognized signer (${coverage.signer}): it is not in this deployment's trusted signers list, so the claim is not evidence.`,
-    };
-  }
-  // trustedSigners is reader-side config merged in after signing: it is NOT part of
-  // the signed record, so it is excluded from the canonical preimage here.
-  const { sig: _omitted, trustedSigners: _ts, ...unsigned } = coverage;
-  let sigOk = false;
-  try {
-    sigOk = ed25519.verify(hexToBytes(coverage.sig.slice('ed25519:'.length)), canonicalBytes(unsigned as Record<string, unknown>), signerPub);
-  } catch {
-    sigOk = false;
-  }
-  if (!sigOk) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: "The coverage attestation's signature does not verify: a coverage claim that does not verify is a failure, not an unknown.",
-    };
-  }
-  // The claim must be bound to an attested image: attestationHash(embedded) === imageHash.
-  const attestation = asPayload(coverage.attestation) as Attestation | undefined;
-  let boundHash: string | null = null;
-  if (attestation) {
-    try {
-      boundHash = attestationHash(attestation);
-    } catch {
-      boundHash = null;
-    }
-  }
-  if (!attestation || boundHash === null || coverage.imageHash !== boundHash) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: "The coverage attestation's image hash does not match its embedded attestation (attestationHash convention): the binding to the attested image is broken.",
-    };
-  }
-  // The embedded attestation verifies through @zanii/attest with the injected quote
-  // verifier. A disproven quote is a red; no verifier injected is an honest grey.
-  let check: AttestCheck;
-  try {
-    check = await verifyAttestation(attestation, verifyQuote ? { verifyQuote } : {});
-  } catch {
-    check = { ok: false, structural: false, quoteVerified: false, reasons: ['attestation verification failed'] };
-  }
-  if (!check.structural) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: `The coverage attestation's embedded attestation is malformed: ${check.reasons.join(', ')}.`,
-    };
-  }
-  if (check.quoteVerified === false) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: "The coverage attestation's enclave quote failed verification: the code that claimed coverage is not confirmed to be the attested image.",
-    };
-  }
-  if (check.quoteVerified === null) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'The coverage attestation is signed and well-formed, but no enclave quote verifier was injected, so the attested image could not be confirmed.',
-    };
-  }
-  if (coverage.allPathsGated !== true) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'not covered',
-      detail: 'The coverage attestation does not assert that all egress paths were receipt-gated.',
-    };
-  }
-  const start = parseTime(coverage.windowStart);
-  const end = parseTime(coverage.windowEnd);
-  if (start === null || end === null || start > end) {
-    return { id, label: LABELS[id], state: 'not covered', detail: 'The coverage attestation window is missing or invalid.' };
-  }
-  const times = receipts.map((sr) => parseTime(sr?.receipt?.ts));
-  if (times.some((t) => t === null || t < start || t > end)) {
-    const valid = times.filter((t): t is number => t !== null);
-    const span = valid.length > 0
-      ? ` (this slice spans ${new Date(Math.min(...valid)).toISOString()} to ${new Date(Math.max(...valid)).toISOString()})`
-      : '';
-    return {
-      id,
-      label: LABELS[id],
-      state: 'not covered',
-      detail: `The coverage attestation (${coverage.windowStart} to ${coverage.windowEnd}) does not cover every receipt in this slice${span}.`,
-    };
-  }
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `Signed coverage attestation verified (signature and enclave quote): all egress paths were receipt-gated for the whole window (${coverage.windowStart} to ${coverage.windowEnd}) under attested image ${coverage.imageHash}, and no receipt in this slice shows a human actor.`,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Row 4 (trained_on): "Never used to train a model"
-// ---------------------------------------------------------------------------
-
-function trainedOnRow(history: SubjectHistory, receipts: SubjectReceipt[], evidence: ExtraEvidence): VerdictRow {
-  const id = 'trained_on' as const;
-  const training = evidence.training;
-  if (!training) {
-    // Exact wording matters: a missing proof is NOT a clean result. Never "never".
-    return { id, label: LABELS[id], state: 'not covered', detail: 'No declared training runs to check against' };
-  }
-  const anchoredAt = parseTime(training.anchoredAt);
-  const runAttestedAt = parseTime(training.runAttestedAt);
-  if (anchoredAt === null || runAttestedAt === null) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'The training evidence is missing a valid manifest anchor time or run attestation time, so the ordering cannot be checked.',
-    };
-  }
-  if (anchoredAt > runAttestedAt) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: `The training manifest's anchor (${training.anchoredAt}) does not precede the run attestation (${training.runAttestedAt}). A manifest anchored after the run could have been written to exclude this record.`,
-    };
-  }
-  if (receipts.length === 0) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'not covered',
-      detail: "This slice has no receipts: a training-absence proof over an empty slice proves nothing about this subject's data.",
-    };
-  }
-  const manifest = training.manifest;
-  if (
-    !manifest || typeof manifest !== 'object' || manifest.v !== 1 || manifest.type !== 'training.manifest'
-    || typeof manifest.run_id !== 'string' || typeof manifest.root !== 'string' || parseHash(manifest.root) === null
-    || !Number.isInteger(manifest.size) || manifest.size < 0
-  ) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: 'The training manifest is missing or malformed, so the absence proof cannot be checked against it.',
-    };
-  }
-  // The proof must speak to THIS subject, not someone else.
-  const proof = training.absenceProof;
-  if (!proof || typeof proof !== 'object' || proof.ref !== history.tag) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: "The non-membership proof is missing or names a different ref than this subject's tag, so it says nothing about this slice.",
-    };
-  }
-  let ok = false;
-  try {
-    ok = verifyAbsence(proof, manifest);
-  } catch {
-    ok = false;
-  }
-  if (!ok) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: `The non-membership proof does not verify against the declared training manifest (root ${manifest.root}).`,
-    };
-  }
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `Non-membership proof verified against the declared training manifest (${manifest.size} entries, root ${manifest.root}), anchored at ${training.anchoredAt} before the run was attested at ${training.runAttestedAt}. This subject's tag is absent from the training set.`,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Row 5 (copy_kept): "No copy was kept"
-// ---------------------------------------------------------------------------
-
-/**
- * The destruction evidence lives IN the slice: a receipt stamped with this subject's
- * tag whose embedded, signature-covered payload is a `@zanii/retention` shred
- * (`buildKeyDestruction`'s shape). Slice membership binds the receipt to this subject
- * (the ledger serves the receipt only under this tag, and the receipt's own offline
- * check re-verifies here); the payload's salted subject commitment can later be
- * proven to name the subject by revealing the salt. Binding to the OBJECT is by ref:
- * a shred counts only for an object whose custody touches carry the same payload
- * `ref`, so a shred for an unrelated object never turns this row green.
- */
-function shredReceiptsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
-  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['_zr_kind'] === 'retention' && p['action'] === 'shred') out.push({ sr, payload: p });
-  }
-  return out;
-}
-
-/** The refs of the custody touches in the slice: the objects destruction must bind to. */
-function touchRefsOf(receipts: SubjectReceipt[]): string[] {
-  const refs = new Set<string>();
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['_zdc'] === 1 && typeof p['ref'] === 'string') refs.add(p['ref']);
-  }
-  return [...refs].sort();
-}
-
-function copyKeptRow(receipts: SubjectReceipt[], evidence: ExtraEvidence): VerdictRow {
-  const id = 'copy_kept' as const;
-  const shreds = shredReceiptsOf(receipts);
-  if (shreds.length === 0) {
-    return { id, label: LABELS[id], state: 'not covered', detail: 'No key-destruction record on file.' };
-  }
-  // A presented-but-broken shred is a red, not a grey: any failure anywhere in the
-  // slice's destruction records fails the row, however many others verify.
-  for (const { sr, payload } of shreds) {
-    if (sr?.check?.ok !== true) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `Receipt ${sr?.hash} (index ${sr?.index}) carries a key-destruction payload, but the receipt itself failed offline verification.`,
-      };
-    }
-    let check: { ok: boolean; reasons: string[] };
-    try {
-      check = verifyKeyDestruction(payload);
-    } catch {
-      check = { ok: false, reasons: ['unreadable payload'] };
-    }
-    if (!check.ok) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `The key-destruction payload on receipt ${sr?.hash} (index ${sr?.index}) did not verify: ${check.reasons.join(', ')}.`,
-      };
-    }
-  }
-  // Ref binding: a shred is evidence only for the objects this slice touches. A
-  // shred carrying no ref, or a ref no touch in this slice carries, does not count.
-  const touchRefs = touchRefsOf(receipts);
-  const bound = shreds.filter(({ payload }) => typeof payload['ref'] === 'string' && touchRefs.includes(payload['ref'] as string));
-  if (bound.length === 0) {
-    return { id, label: LABELS[id], state: 'not covered', detail: 'No key-destruction record on file.' };
-  }
-  const coveredRefs = new Set(bound.map(({ payload }) => payload['ref'] as string));
-  const uncoveredRefs = touchRefs.filter((r) => !coveredRefs.has(r));
-  if (uncoveredRefs.length > 0) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: `Verified key-destruction records cover ${coveredRefs.size} of ${plural(touchRefs.length, 'object')} touched in this slice: no key-destruction record binds to ${plural(uncoveredRefs.length, 'object')} (${uncoveredRefs.join(', ')}), so ${uncoveredRefs.length === 1 ? 'its destruction' : 'their destruction'} is unknown.`,
-    };
-  }
-  // Optional image evidence: check the claimed attestation hashes to the published
-  // image hash (bag-internal consistency; it does not bind the shred to the image).
-  const image = evidence.destructionImage;
-  let imagePart = '';
-  if (image !== undefined && image !== null) {
-    const attestation = asPayload((image as DestructionImageEvidence).attestation) as Attestation | undefined;
-    const published = (image as DestructionImageEvidence).publishedImageHash;
-    let attested: string | null = null;
-    if (attestation) {
-      try {
-        attested = attestationHash(attestation);
-      } catch {
-        attested = null;
-      }
-    }
-    if (!attestation || attested === null || typeof published !== 'string' || published.length === 0) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: 'The destruction image evidence is incomplete: it must carry the attestation record and the published image hash.',
-      };
-    }
-    if (attested !== published) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `The attested image hash (${attested}) does not match the published image hash (${published}).`,
-      };
-    }
-    imagePart = ` The attested image hash matches the published one (${published}).`;
-  }
-  const first = bound[0]!;
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `Key-destruction record verified: receipt ${first.sr?.hash} (index ${first.sr?.index}) carries a crypto-shredding attestation signed by ${first.sr?.receipt?.agent_id}, key commitment ${first.payload['key_commitment']}, destroyed at ${first.payload['executed_at']}, bound to object ${first.payload['ref']}. ${plural(bound.length, 'verified key-destruction record')} ${bound.length === 1 ? 'covers' : 'cover'} every object touched in this slice (${plural(touchRefs.length, 'object')}).${imagePart}`,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Row 6 (residency): "Data stayed in its declared region"
-// ---------------------------------------------------------------------------
-
-/** Residency claims carried by the slice (`buildResidencyClaim`'s shape, embedded
- *  signature-covered exactly like the row-5 shred payloads). */
-function residencyClaimsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
-  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['type'] === 'residency.claim') out.push({ sr, payload: p });
-  }
-  return out;
-}
-
-/** A claim whose region signal is the operator asserting its own region: not an
- *  attestation, whatever it claims. */
-function isSelfDeclared(p: Record<string, unknown>): boolean {
-  const source = asPayload(p.region_attestation)?.source;
-  return typeof source === 'string' && source.toLowerCase().startsWith('self');
-}
-
-function receiptDetailPrefix(sr: SubjectReceipt): string {
-  return `Receipt ${sr?.hash} (index ${sr?.index})`;
-}
-
-async function residencyRow(
-  receipts: SubjectReceipt[],
-  evidence: ExtraEvidence,
-  verifyRegion: RegionVerifier | undefined,
-): Promise<VerdictRow> {
-  const id = 'residency' as const;
-  if (receipts.length === 0) {
-    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
-  }
-  const claims = residencyClaimsOf(receipts);
-  if (claims.length === 0) {
-    return { id, label: LABELS[id], state: 'not covered', detail: 'No residency attestations on record' };
-  }
-  // A self-declared claim is no attestation: it does not count as evidence, here or
-  // in the coverage and crossing checks below.
-  const attested = claims.filter(({ payload }) => !isSelfDeclared(payload));
-  const selfDeclared = claims.length - attested.length;
-  if (attested.length === 0) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'not covered',
-      detail: `Every residency claim on record is self-declared: the region source is self-declared (the operator asserted its own region), not an independently verified signal.`,
-    };
-  }
-  // A presented-but-broken claim is a red, not a grey: structural check first, then
-  // the receipt's own offline verification (an unverified receipt's payload is not
-  // signature-covered evidence).
-  for (const { sr, payload } of attested) {
-    const reasons = residencyClaimReasons(payload);
-    if (reasons.length > 0) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a malformed residency claim: ${reasons.join(', ')}.`,
-      };
-    }
-    if (sr?.check?.ok !== true) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a residency claim payload, but the receipt itself failed offline verification.`,
-      };
-    }
-  }
-  // The jurisdiction allow-set is READER config, never producer-supplied (same trust
-  // rule as trustedSigners). Absent: unknown, never proven. Empty: allows no region,
-  // so every verified claim below is a crossing.
-  const jurisdiction = evidence.jurisdiction;
-  if (!Array.isArray(jurisdiction)) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'Residency claims are on record, but the reader provided no declared jurisdiction allow-set, so there is nothing to check them against.',
-    };
-  }
-  if (verifyRegion === undefined) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'Residency claims are on record, but no region verifier was injected, so the region signals could not be authenticated.',
-    };
-  }
-  const verified: Array<{ ts: string; region: string; ref: string | null }> = [];
-  for (const { sr, payload } of attested) {
-    let check: { ok: boolean; reasons: string[]; region: string | null; crossed: boolean };
-    try {
-      check = await verifyResidency(payload as unknown as ResidencyClaim, { allowedRegions: jurisdiction, verifyRegion });
-    } catch {
-      check = { ok: false, reasons: ['the residency check failed'], region: null, crossed: false };
-    }
-    if (check.crossed) {
-      // Do not echo the producer reason: its wording is not reader-facing.
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `The residency claim on receipt ${sr?.hash} (index ${sr?.index}) verifies, but its region ${check.region} is outside the declared jurisdiction: a border crossing is on record.`,
-      };
-    }
-    if (!check.ok || check.region === null) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `The residency claim on receipt ${sr?.hash} (index ${sr?.index}) did not verify: ${check.reasons.join(', ')}.`,
-      };
-    }
-    verified.push({
-      ts: payload.ts as string,
-      region: check.region,
-      ref: typeof payload.ref === 'string' && payload.ref ? payload.ref : null,
-    });
-  }
-  // The sequence check over the verified regions: any exit from the allow-set is red.
-  // (Per-claim verification already rejects an outside region, so this is belt and
-  // suspenders; it also catches a sequence that STARTS outside, which per-claim
-  // checks phrase differently.)
-  const crossings = detectCrossings(verified, jurisdiction);
-  if (crossings.length > 0) {
-    const c = crossings[0]!;
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: `Verified residency claims show the data left the declared jurisdiction at ${c.ts} (moved to region ${c.region}).`,
-    };
-  }
-  // Coverage is per touch, never window-span: EVERY custody touch in the slice must
-  // be covered by a verified claim. A claim carrying a ref binds to every touch of
-  // that object; a ref-less claim is time-scoped and covers the touches made at its
-  // own timestamp. Anything looser would let two claims at the window's ends prove
-  // green over an uncovered middle.
-  const touches: Array<{ ref: string; ts: string }> = [];
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['_zdc'] === 1 && typeof p['ref'] === 'string' && parseTime(p['ts']) !== null) {
-      touches.push({ ref: p['ref'] as string, ts: p['ts'] as string });
-    }
-  }
-  if (touches.length === 0) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'This slice carries no custody touches, so per-touch residency coverage cannot be established.',
-    };
-  }
-  const isCovered = (t: { ref: string; ts: string }): boolean =>
-    verified.some((c) => (c.ref !== null ? c.ref === t.ref : c.ts === t.ts));
-  const uncovered = touches.filter((t) => !isCovered(t));
-  if (uncovered.length > 0) {
-    const covered = touches.length - uncovered.length;
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: `Verified residency claims cover ${covered} of ${plural(touches.length, 'touch', 'touches')} in this slice: ${plural(uncovered.length, 'touch', 'touches')} ${uncovered.length === 1 ? 'has' : 'have'} no valid in-jurisdiction claim, so ${uncovered.length === 1 ? 'its' : 'their'} residency is unknown.`,
-    };
-  }
-  const selfNote = selfDeclared > 0
-    ? ` ${plural(selfDeclared, 'self-declared claim')} ${selfDeclared === 1 ? 'was' : 'were'} not counted as evidence: the region source is self-declared.`
-    : '';
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `Verified residency claims cover every touch in this slice (${plural(touches.length, 'touch', 'touches')}): every region signal authenticated against the declared jurisdiction allow-set, and no border crossings were detected.${selfNote}`,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Row 7 (subprocessor): "Only declared third parties touched it"
-// ---------------------------------------------------------------------------
-
-/** Onward transfers carried by the slice (`buildTransfer`'s shape). */
-function transfersOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
-  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['type'] === 'subprocessor.transfer') out.push({ sr, payload: p });
-  }
-  return out;
-}
-
-/** Custody-touch junctions: the destinations the touch payloads say data crossed to. */
-function junctionsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; to: string }> {
-  const out: Array<{ sr: SubjectReceipt; to: string }> = [];
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    const j = p ? asPayload(p['junction']) : undefined;
-    // Only share/export are onward disclosures to a third party. Store/read/transform
-    // may carry a junction for topology (source/destination of the data), but they
-    // are not subprocessor transfers.
-    const op = typeof p?.['op'] === 'string' ? p['op'] : undefined;
-    if (j && typeof j.to === 'string' && j.to && (op === 'share' || op === 'export')) out.push({ sr, to: j.to });
-  }
-  return out;
-}
-
-function subprocessorRow(receipts: SubjectReceipt[], evidence: ExtraEvidence): VerdictRow {
-  const id = 'subprocessor' as const;
-  const transfers = transfersOf(receipts);
-  const junctions = junctionsOf(receipts);
-  if (transfers.length === 0 && junctions.length === 0) {
-    return { id, label: LABELS[id], state: 'not covered', detail: 'No onward transfers declared or recorded' };
-  }
-  // Presented-but-broken is a red before any trust-root question.
-  for (const { sr, payload } of transfers) {
-    const reasons = transferReasons(payload);
-    if (reasons.length > 0) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a malformed transfer record: ${reasons.join(', ')}.`,
-      };
-    }
-    if (sr?.check?.ok !== true) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a transfer record payload, but the receipt itself failed offline verification.`,
-      };
-    }
-    // Stricter than verifyTransfers (which requires an id only for dpa/scc): any
-    // onward transfer without an agreement id is a red here.
-    const agreement = asPayload(payload.agreement);
-    const agreementId = agreement?.id;
-    if (typeof agreementId !== 'string' || !agreementId) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `The transfer to '${payload.to}' at ${payload.ts} carries no agreement id: an onward transfer without an agreement reference is a failure, not an unknown.`,
-      };
-    }
-  }
-  // The declared subprocessor list is READER config, never producer-supplied (same
-  // trust rule as trustedSigners). Without it there is nothing to check against.
-  const declared = evidence.declaredSubprocessors;
-  if (!Array.isArray(declared)) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'Custody touches or transfer records name onward destinations, but the reader provided no declared subprocessor list, so there is nothing to check them against.',
-    };
-  }
-  let check: { ok: boolean; reasons: string[] };
-  try {
-    check = verifyTransfers(transfers.map(({ payload }) => payload as unknown as Transfer), declared);
-  } catch {
-    check = { ok: false, reasons: ['the transfer check failed'] };
-  }
-  if (!check.ok) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'failed',
-      detail: `The declared-subprocessor check failed: ${check.reasons.join('; ')}.`,
-    };
-  }
-  // Divergence is red, never silent: a junction naming a destination with no matching
-  // declared transfer means the custody trail and the transfer record disagree.
-  for (const { sr, to } of junctions) {
-    const matched = transfers.some(({ payload }) => payload.to === to && declared.includes(payload.to as string));
-    if (!matched) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} records a custody junction to '${to}', but no declared transfer to that party is on record: a divergence between the custody trail and the transfer record is a failure, never silent.`,
-      };
-    }
-  }
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `Every onward destination in this slice resolves to a declared subprocessor under a named agreement: ${plural(junctions.length, 'custody junction')} and ${plural(transfers.length, 'recorded transfer')} checked against the declared list (${declared.length} ${declared.length === 1 ? 'party' : 'parties'}), with no undeclared party, no missing agreement id, and no divergence.`,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Row 8 (minimization): "Only what was needed was taken"
-// ---------------------------------------------------------------------------
-
-/** Field-set commitments carried by the slice (`commitFieldSet` records under type
- *  `minimization.commit`). */
-function commitsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
-  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['type'] === 'minimization.commit') out.push({ sr, payload: p });
-  }
-  return out;
-}
-
-/** Access proofs carried by the slice (`buildAccessProof`'s shape). */
-function accessProofsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
-  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
-  for (const sr of receipts) {
-    const p = asPayload(touchPayloadOf(sr));
-    if (p && p['type'] === 'minimization.access') out.push({ sr, payload: p });
-  }
-  return out;
-}
-
-function minimizationRow(receipts: SubjectReceipt[]): VerdictRow {
-  const id = 'minimization' as const;
-  if (receipts.length === 0) {
-    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
-  }
-  const commits = commitsOf(receipts);
-  const accesses = accessProofsOf(receipts);
-  for (const { sr, payload } of commits) {
-    const reasons = commitReasons(payload);
-    if (reasons.length > 0) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a malformed field-set commitment record: ${reasons.join(', ')}.`,
-      };
-    }
-    if (sr?.check?.ok !== true) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a field-set commitment payload, but the receipt itself failed offline verification.`,
-      };
-    }
-    // Recompute the commitment from the claimed fields: a mismatch is a set widened
-    // (or swapped) after the commitment was recorded.
-    let matches = false;
-    try {
-      matches = verifyFieldSet(payload.fields as string[], payload.commitment as string);
-    } catch {
-      matches = false;
-    }
-    if (!matches) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a field-set commitment whose fields do not recompute to the commitment: the declared minimum may have been widened after the fact.`,
-      };
-    }
-  }
-  // Access proofs are validated before the commits-empty branch: a presented but
-  // broken proof is a red even when no commitments are on record.
-  for (const { sr, payload } of accesses) {
-    const reasons = accessReasons(payload);
-    if (reasons.length > 0) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries a malformed minimization access proof: ${reasons.join(', ')}.`,
-      };
-    }
-    if (sr?.check?.ok !== true) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `${receiptDetailPrefix(sr)} carries an access proof payload, but the receipt itself failed offline verification.`,
-      };
-    }
-  }
-  if (commits.length === 0) {
-    if (accesses.length > 0) {
-      // Symmetric with commits-without-accesses: an access proof whose declared
-      // minimum is not on record cannot be checked, and unchecked is unknown.
-      return {
-        id,
-        label: LABELS[id],
-        state: 'cannot determine',
-        detail: 'Access proofs are on record, but no minimum-field commitments: the declared minimum they claim cannot be checked, and an unchecked access is unknown, not clean.',
-      };
-    }
-    return { id, label: LABELS[id], state: 'not covered', detail: 'No minimum-field commitments on record' };
-  }
-  if (accesses.length === 0) {
-    return {
-      id,
-      label: LABELS[id],
-      state: 'cannot determine',
-      detail: 'Field-set commitments are on record, but no access proofs: no recorded access was checked against the declared minimum.',
-    };
-  }
-  for (const { sr, payload } of accesses) {
-    const commit = commits.find(({ payload: c }) => c.commitment === payload.field_set);
-    if (!commit) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'cannot determine',
-        detail: `${receiptDetailPrefix(sr)} carries an access proof against field-set commitment ${payload.field_set}, but that commitment is not on record in this slice: the declared minimum it claims cannot be checked.`,
-      };
-    }
-    let check: { ok: boolean; reasons: string[]; excess: string[] };
-    try {
-      check = verifyMinimization(payload as unknown as AccessProof, commit.payload.fields as string[]);
-    } catch {
-      check = { ok: false, reasons: ['the minimization check failed'], excess: [] };
-    }
-    if (!check.ok) {
-      return {
-        id,
-        label: LABELS[id],
-        state: 'failed',
-        detail: `The minimization check failed for receipt ${sr?.hash} (index ${sr?.index}): ${check.reasons.join(', ')}.`,
-      };
-    }
-  }
-  return {
-    id,
-    label: LABELS[id],
-    state: 'proven',
-    detail: `Every recorded access (${plural(accesses.length, 'proof')}) in this slice stayed within its committed minimum field set: all ${plural(commits.length, 'field-set commitment')} recomputed to their recorded commitments, and no accessed field fell outside the declared minimum.`,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// The one function both surfaces call.
-// ---------------------------------------------------------------------------
-
-/**
- * Compute the eight verdict rows from an offline-verified subject history. Pure: no
- * network, no clock. Async only because row 3's coverage attestation is checked
- * through `@zanii/attest`'s `verifyAttestation` and row 6's residency claims through
- * `@zanii/residency`'s `verifyResidency`, whose injected verifiers may be async;
- * pass them via `options.verifyQuote` / `options.verifyRegion`. Never throws:
- * malformed input yields honest `cannot determine` / `not covered` / `failed` rows
- * with reasons. Rows are always returned in this fixed order: purpose,
- * self_sovereign, human_read, trained_on, copy_kept, residency, subprocessor,
- * minimization.
- */
-export async function computeVerdicts(
-  history: SubjectHistory,
-  evidence: ExtraEvidence = {},
-  options: VerdictOptions = {},
-): Promise<VerdictRow[]> {
-  const h = (history && typeof history === 'object' ? history : {}) as SubjectHistory;
-  const receipts = Array.isArray(h.receipts) ? h.receipts : [];
-  const ev = (evidence && typeof evidence === 'object' ? evidence : {}) as ExtraEvidence;
-  const verifyQuote = options && typeof options === 'object' ? options.verifyQuote : undefined;
-  const verifyRegion = options && typeof options === 'object' ? options.verifyRegion : undefined;
-  const rows: Array<() => VerdictRow | Promise<VerdictRow>> = [
-    () => purposeRow(h, receipts),
-    () => selfSovereignRow(h, receipts),
-    () => humanReadRow(receipts, ev, verifyQuote),
-    () => trainedOnRow(h, receipts, ev),
-    () => copyKeptRow(receipts, ev),
-    () => residencyRow(receipts, ev, verifyRegion),
-    () => subprocessorRow(receipts, ev),
-    () => minimizationRow(receipts),
-  ];
-  const ids: VerdictId[] = ['purpose', 'self_sovereign', 'human_read', 'trained_on', 'copy_kept', 'residency', 'subprocessor', 'minimization'];
-  const out: VerdictRow[] = [];
-  for (let i = 0; i < rows.length; i++) {
-    try {
-      out.push(await rows[i]!());
-    } catch (err) {
-      // Verification paths never crash: an unexpected error is an honest grey.
-      const id = ids[i]!;
-      out.push({
-        id,
-        label: LABELS[id],
-        state: 'cannot determine',
-        detail: `This line could not be computed: ${err instanceof Error ? err.message : String(err)}.`,
-      });
-    }
-  }
-  return out;
-}
-
-/**
- * Seconds between the signed tree head's timestamp and `now` (the caller supplies
- * `now`; this package has no clock). The page shows anchor lag: four minutes vs
- * four hours is a property the reader is entitled to see. Null when unknown (no sth,
- * no timestamp, unparseable). Negative means the sth is newer than the caller's
- * clock: possible skew, shown as-is.
- */
-export function computeAnchorLag(
-  sth: Record<string, unknown> | SignedTreeHead | undefined | null,
-  now: Date | string | number,
-): number | null {
-  try {
-    const ts = parseTime((sth as Record<string, unknown> | undefined | null)?.ts);
-    if (ts === null) return null;
-    const nowMs = now instanceof Date ? now.getTime() : typeof now === 'number' ? now : parseTime(now);
-    if (nowMs === null || Number.isNaN(nowMs)) return null;
-    return Math.round((nowMs - ts) / 1000);
-  } catch {
-    return null;
-  }
-}
+/**
+ * @zanii/custody-verdicts: the one verifier. One verifier, two surfaces: the subject
+ * page (zanii-id) and `@zanii/cli` both import this package and call `computeVerdicts`.
+ * Never two implementations of the verdict logic: two drift, and the drift always
+ * favours the vendor.
+ *
+ * Verdicts are **computed, never stored**. Input is a `SubjectHistory` from
+ * `@zanii/subject` (`fetchSubjectHistory`): the subject's receipt slice, each receipt
+ * already verified offline (signature + delegation + scope), plus the signed tree
+ * head. SpiritWave's custody receipts embed the `@zanii/data-custody` touch payload
+ * inside the receipt as a signature-covered `payload` field (the ledger has no
+ * payload store); row 1 re-checks every embedded payload with `verifyTouch`, and
+ * tolerates the other custody kind this package itself consumes: a `@zanii/retention`
+ * crypto-shredding payload (`verifyKeyDestruction`), which row 5 reads as the
+ * key-destruction evidence.
+ *
+ * Four states per line: `proven`, `not covered`, `failed`, `cannot determine`. The
+ * last three are as first-class as the first: a missing proof is NOT a clean result
+ * ("no declared training runs to check against", never "never"). A bad receipt is a
+ * red, not a grey, and a presented-but-broken proof is a red too.
+ *
+ * The function is pure: no network, no clock (`computeAnchorLag` takes `now` from the
+ * caller). It is async for exactly one reason: row 3's coverage attestation is checked
+ * through `@zanii/attest`'s `verifyAttestation`, whose injected quote verifier may be
+ * async. Verification paths never throw: malformed input yields `cannot determine` /
+ * `not covered` / `failed` rows with reasons, per the codebase convention (creation
+ * paths throw, verification paths return results).
+ *
+ * Rows 3–5 consume real producer evidence, checked here, narrowly and offline:
+ * row 3 a SIGNED coverage attestation (`@zanii/attest` verifies the embedded
+ * attestation with an injected quote verifier; the producer side ships with the
+ * enclave phase, so until then `proven` is unreachable, by design), row 4 a declared,
+ * anchor-ordered training manifest plus `@zanii/train`'s sorted-Merkle `AbsenceProof`
+ * (`verifyAbsence`), row 5 the `@zanii/retention` shred receipts carried by the slice
+ * itself (`verifyKeyDestruction`), optionally bound to a published image hash via
+ * `@zanii/attest`'s `attestationHash` convention.
+ *
+ * Rows 6–8 consume the slice the same narrow way: row 6 residency claims
+ * (`@zanii/residency`'s `buildResidencyClaim` shape) verified with an injected region
+ * verifier against the reader-pinned jurisdiction allow-set, plus `detectCrossings`
+ * over the verified touch sequence; row 7 onward transfers (`@zanii/subprocessor`'s
+ * `buildTransfer` shape) and custody-touch junctions checked against the
+ * reader-pinned declared subprocessor list via `verifyTransfers`; row 8 field-set
+ * commitments (`@zanii/minimization`'s `commitFieldSet` records) and access proofs
+ * (`buildAccessProof`) checked with `verifyMinimization`. The jurisdiction allow-set
+ * and the declared subprocessor list are READER configuration (ExtraEvidence), never
+ * producer-supplied: the same trust rule as `coverage.trustedSigners`.
+ */
+import { ed25519 } from '@noble/curves/ed25519';
+import { hexToBytes } from '@noble/hashes/utils';
+import {
+  canonicalBytes, publicKeyFromDid, verifySTH,
+  type Receipt, type SignedTreeHead,
+} from '@zanii/core';
+import { verifyTouch } from '@zanii/data-custody';
+import { verifyKeyDestruction } from '@zanii/retention';
+import { verifyAbsence, type AbsenceProof, type TrainingManifest } from '@zanii/train';
+import {
+  attestationHash, verifyAttestation,
+  type Attestation, type AttestCheck, type QuoteVerifier,
+} from '@zanii/attest';
+import {
+  detectCrossings, verifyResidency,
+  type RegionVerifier, type ResidencyClaim,
+} from '@zanii/residency';
+import { verifyTransfers, type Agreement, type Transfer } from '@zanii/subprocessor';
+import { verifyFieldSet, verifyMinimization, type AccessProof } from '@zanii/minimization';
+import type { SubjectHistory, SubjectReceipt } from '@zanii/subject';
+
+export type { AbsenceProof, TrainingManifest } from '@zanii/train';
+export type { Attestation, QuoteVerifier } from '@zanii/attest';
+export type { RegionVerifier, ResidencyClaim } from '@zanii/residency';
+export type { Agreement, Transfer } from '@zanii/subprocessor';
+export type { AccessProof } from '@zanii/minimization';
+
+/**
+ * The well-known ledger tag under which declared training manifests are published.
+ * The subject page and the CLI fetch that slice to build the row-4 training evidence
+ * bag (`ExtraEvidence.training`).
+ */
+export const TRAINING_MANIFEST_TAG = 'zanii:training-manifests';
+
+/** The four verdict states. The last three are as loud as the first. */
+export type VerdictState = 'proven' | 'not covered' | 'failed' | 'cannot determine';
+
+export type VerdictId =
+  | 'purpose' | 'self_sovereign' | 'human_read' | 'trained_on' | 'copy_kept'
+  | 'residency' | 'subprocessor' | 'minimization';
+
+export interface VerdictRow {
+  id: VerdictId;
+  label: string;
+  state: VerdictState;
+  /** Plain-language working: which receipts were computed over, why this state. Rendered verbatim. */
+  detail: string;
+}
+
+/**
+ * Coverage attestation for the "nobody read it" line: a SIGNED record asserting that
+ * every egress path to the data was receipt-gated (the `@zanii/broker` invariant) for
+ * the whole window, bound to the attested image whose code enforced it. The signature
+ * covers every field but `sig`; `imageHash` must equal `attestationHash(attestation)`
+ * (`@zanii/attest`'s convention); the attestation's `nonce` must equal `signer`, which
+ * is what binds the SIGNING KEY to the attested image (without it a legitimately
+ * published attestation is replayable under an attacker's key, and `trustedSigners`
+ * is only an optional defence); and the embedded attestation is verified through
+ * `verifyAttestation` with the caller's injected quote verifier. Anything unsigned or
+ * malformed is never `proven`. The producer side ships with the enclave phase
+ * (`@zanii/attest` + `@zanii/broker`); until then this evidence does not exist and the
+ * row answers `not covered`, by design.
+ */
+export interface CoverageEvidence {
+  v: 1;
+  type: 'coverage.attestation';
+  /** Every egress path was receipt-gated; partial coverage is no coverage. */
+  allPathsGated: boolean;
+  /** ISO timestamp: start of the gated window. */
+  windowStart: string;
+  /** ISO timestamp: end of the gated window. */
+  windowEnd: string;
+  /** `attestationHash` of the embedded attestation: the image the claim is bound to. */
+  imageHash: string;
+  /** The full attestation record (`@zanii/attest`'s `Attestation`). */
+  attestation: Attestation;
+  /**
+   * did:key of the enclave key that signed this attestation. MUST equal
+   * `attestation.nonce`: the enclave generates this keypair inside the measured
+   * image and commits its DID to the quote, so the binding is covered by
+   * `attestationHash` and cannot be reassigned to another key.
+   */
+  signer: string;
+  /** `ed25519:<hex>` over the canonical record minus `sig`. */
+  sig: string;
+  /**
+   * Optional trust root: the deployment's pinned coverage-signing DIDs. The reader
+   * (subject page / CLI) sets this from its OWN configuration, never from
+   * producer-supplied data; otherwise an attacker could attest with their own key and
+   * name it trusted. Not part of the signed record (excluded from the signature
+   * preimage). When present, a signer not in the list is `failed`; an empty list
+   * trusts no one. When absent, any well-formed did:key signer is accepted.
+   */
+  trustedSigners?: string[];
+}
+
+/**
+ * A declared, anchored training run plus `@zanii/train`'s absence proof. Ordering is
+ * the whole claim: the manifest anchor must PRECEDE the run attestation. A manifest
+ * anchored afterwards could have been written to exclude the subject.
+ */
+export interface TrainingEvidence {
+  /** The run's sorted-Merkle training manifest (`@zanii/train`'s `TrainingManifest`). */
+  manifest: TrainingManifest;
+  /** ISO timestamp when the manifest root was anchored. */
+  anchoredAt: string;
+  /** ISO timestamp of the run attestation. */
+  runAttestedAt: string;
+  /** `@zanii/train`'s `AbsenceProof` for this subject's tag, verified against the manifest. */
+  absenceProof: AbsenceProof;
+}
+
+/**
+ * Optional image evidence for the "no copy was kept" line: a CLAIMED destruction-image
+ * attestation plus the image hash the operator published for it. What is checked here
+ * is bag-internal consistency only, via `@zanii/attest`'s `attestationHash` convention
+ * (the published image hash is `attestationHash` of the published attestation record):
+ * a mismatch is `failed`. A match does NOT by itself prove the destruction ran under
+ * that image: nothing yet binds the shred receipt to the attestation, and the
+ * attestation's quote is not verified on this path. Full binding ships with the
+ * enclave phase.
+ */
+export interface DestructionImageEvidence {
+  /** The attestation (`@zanii/attest`'s `Attestation`) claimed for the destruction image. */
+  attestation: Attestation;
+  /** The published image hash: `attestationHash` of the published attestation record. */
+  publishedImageHash: string;
+}
+
+/**
+ * Optional evidence bag for rows 3–5. Row 5 needs no bag entry for the destruction
+ * record itself: the shred receipts are read from the subject's slice, each already
+ * signature-covered and offline-verified. `destructionImage` only checks a claimed
+ * destruction-image attestation against the published image hash.
+ */
+export interface ExtraEvidence {
+  /**
+   * One coverage attestation, or an ordered CHAIN of them. A real deployment
+   * restarts, redeploys and upgrades its image, and each of those ends a window,
+   * so coverage of a subject's whole history is a chain of contiguous windows —
+   * the `@zanii/succession` shape, applied to enclave lifetime instead of keys.
+   * Every window must authenticate on its own AND abut the previous one: a gap
+   * between windows is a gap in coverage, and a gap in coverage is not coverage.
+   */
+  coverage?: CoverageEvidence | CoverageEvidence[];
+  training?: TrainingEvidence;
+  destructionImage?: DestructionImageEvidence;
+  /**
+   * Row 6 trust root: the declared jurisdiction as an allow-set of region codes
+   * (`@zanii/residency`'s `allowedRegions`, e.g. `['AE', 'me-central-1']`). READER
+   * configuration (deployment-side), never producer-supplied: the same trust rule as
+   * `coverage.trustedSigners`, or a producer could declare the whole world in bounds.
+   * When absent, residency claims can reach `cannot determine`, never `proven`. An
+   * empty array allows no region: every verified claim is a crossing.
+   */
+  jurisdiction?: string[];
+  /**
+   * Row 7 trust root: the declared subprocessor list (the parties onward transfers
+   * may name). READER configuration, never producer-supplied, same trust rule as
+   * `coverage.trustedSigners`. When absent, transfers or junctions on record reach
+   * `cannot determine`, never `proven`. An empty array declares no one.
+   */
+  declaredSubprocessors?: string[];
+}
+
+/** Caller-injected verifiers: the enclave quote verifier for row 3, the region
+ *  signal verifier for row 6. */
+export interface VerdictOptions {
+  /**
+   * Platform-specific enclave quote verifier (`@zanii/attest`'s `QuoteVerifier`).
+   * Without it a signed coverage attestation can reach `cannot determine`, never
+   * `proven`: the quote stays unknown, and unknown is not verified.
+   */
+  verifyQuote?: QuoteVerifier;
+  /**
+   * Region signal verifier (`@zanii/residency`'s `RegionVerifier`): authenticates a
+   * claim's region attestation (a cloud provider identity document, a TEE geo
+   * signal) and returns the trusted region. Without it residency claims can reach
+   * `cannot determine`, never `proven`.
+   */
+  verifyRegion?: RegionVerifier;
+}
+
+const LABELS: Record<VerdictId, string> = {
+  purpose: 'Used only for its declared purpose',
+  self_sovereign: 'You can check this yourself',
+  human_read: 'Nobody read it',
+  trained_on: 'Never used to train a model',
+  copy_kept: 'No copy was kept',
+  residency: 'Data stayed in its declared region',
+  subprocessor: 'Only declared third parties touched it',
+  minimization: 'Only what was needed was taken',
+};
+
+/** A receipt as served by the ledger: core fields plus the operator-revealed,
+ *  signature-covered embedded payload (the ledger has no payload store). */
+type ReceiptWithPayload = Receipt & { payload?: unknown };
+
+function touchPayloadOf(sr: SubjectReceipt): unknown {
+  return (sr?.receipt as ReceiptWithPayload | undefined)?.payload;
+}
+
+function asPayload(p: unknown): Record<string, unknown> | undefined {
+  return p !== null && typeof p === 'object' && !Array.isArray(p)
+    ? (p as Record<string, unknown>)
+    : undefined;
+}
+
+const plural = (n: number, word: string, pluralForm?: string) => `${n} ${n === 1 ? word : (pluralForm ?? `${word}s`)}`;
+
+function parseTime(ts: unknown): number | null {
+  if (typeof ts !== 'string') return null;
+  const ms = Date.parse(ts);
+  return Number.isNaN(ms) ? null : ms;
+}
+
+/** `sha256:<64 hex>` → bytes, null on any other shape. */
+function parseHash(s: unknown): Uint8Array | null {
+  if (typeof s !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(s)) return null;
+  return hexToBytes(s.slice('sha256:'.length));
+}
+
+// ---------------------------------------------------------------------------
+// Row 1 (purpose): "Used only for its declared purpose"
+// ---------------------------------------------------------------------------
+
+// Structural validators for the evidence payloads rows 6-8 consume, shared with row
+// 1's closed world. Creation paths throw, verification paths return reasons.
+
+/** Structural check of a `@zanii/residency` claim (`buildResidencyClaim`'s shape). */
+function residencyClaimReasons(p: Record<string, unknown>): string[] {
+  const reasons: string[] = [];
+  if (p.v !== 1 || p.type !== 'residency.claim') reasons.push('not a residency claim (v1)');
+  const ra = asPayload(p.region_attestation);
+  if (!ra) reasons.push('missing region attestation');
+  else {
+    if (typeof ra.region !== 'string' || !ra.region) reasons.push('missing/invalid region');
+    if (typeof ra.source !== 'string' || !ra.source) reasons.push('missing region source');
+  }
+  if (parseTime(p.ts) === null) reasons.push('missing/invalid ts');
+  return reasons;
+}
+
+/** Structural check of a `@zanii/subprocessor` transfer (`buildTransfer`'s shape). */
+function transferReasons(p: Record<string, unknown>): string[] {
+  const reasons: string[] = [];
+  if (p.v !== 1 || p.type !== 'subprocessor.transfer') reasons.push('not a subprocessor transfer (v1)');
+  if (typeof p.from !== 'string' || !p.from) reasons.push('missing from');
+  if (typeof p.to !== 'string' || !p.to) reasons.push('missing to');
+  const agreement = asPayload(p.agreement);
+  if (!agreement || typeof agreement.type !== 'string' || !agreement.type) reasons.push('missing agreement');
+  if (parseTime(p.ts) === null) reasons.push('missing/invalid ts');
+  return reasons;
+}
+
+/** Structural check of a `@zanii/minimization` field-set commitment record: the
+ *  `commitFieldSet` output (`{ commitment, fields }`) carried as a payload of type
+ *  `minimization.commit`. */
+function commitReasons(p: Record<string, unknown>): string[] {
+  const reasons: string[] = [];
+  if (p.type !== 'minimization.commit') reasons.push('not a field-set commitment record');
+  if (typeof p.commitment !== 'string' || !p.commitment.startsWith('minfields:')) reasons.push('missing/invalid commitment');
+  if (!Array.isArray(p.fields) || p.fields.some((f) => typeof f !== 'string')) reasons.push('missing/invalid fields');
+  return reasons;
+}
+
+/** Structural check of a `@zanii/minimization` access proof (`buildAccessProof`'s shape). */
+function accessReasons(p: Record<string, unknown>): string[] {
+  const reasons: string[] = [];
+  if (p.v !== 1 || p.type !== 'minimization.access') reasons.push('not a minimization access proof (v1)');
+  if (typeof p.field_set !== 'string' || !p.field_set.startsWith('minfields:')) reasons.push('missing/invalid field_set');
+  if (!Array.isArray(p.accessed) || p.accessed.some((f) => typeof f !== 'string')) reasons.push('missing/invalid accessed');
+  return reasons;
+}
+
+/** The evidence payload kinds rows 6-8 consume, identified by their `type` tag. */
+function evidenceKindOf(p: Record<string, unknown>): 'residency' | 'transfer' | 'commit' | 'access' | null {
+  switch (p.type) {
+    case 'residency.claim': return 'residency';
+    case 'subprocessor.transfer': return 'transfer';
+    case 'minimization.commit': return 'commit';
+    case 'minimization.access': return 'access';
+    default: return null;
+  }
+}
+
+/**
+ * A slice receipt is well-formed custody evidence when its embedded payload is a
+ * well-formed custody touch (`@zanii/data-custody`) OR a well-formed retention shred
+ * (`@zanii/retention`) OR one of the evidence payloads rows 6-8 consume (a residency
+ * claim, a subprocessor transfer, a field-set commitment, a minimization access
+ * proof). Anything else in a custody slice is a red. Closed world on purpose: new
+ * custody kinds stay red until wired here. The returned kind lets the row say
+ * honestly what passed or what failed: a retention payload never gets touch-schema
+ * reasons.
+ */
+function wellFormedCustodyPayload(
+  p: unknown,
+): { ok: true; kind: 'touch' | 'shred' | 'residency' | 'transfer' | 'commit' | 'access' } | { ok: false; kind: 'touch' | 'retention' | 'residency' | 'transfer' | 'commit' | 'access'; reasons: string[] } {
+  const payload = asPayload(p);
+  // A retention-claimed payload is checked as one, pass or fail.
+  if (payload && payload['_zr_kind'] === 'retention') {
+    let shred: { ok: boolean; reasons: string[] };
+    try {
+      shred = verifyKeyDestruction(payload);
+    } catch {
+      shred = { ok: false, reasons: ['unreadable payload'] };
+    }
+    return shred.ok ? { ok: true, kind: 'shred' } : { ok: false, kind: 'retention', reasons: shred.reasons };
+  }
+  const kind = payload ? evidenceKindOf(payload) : null;
+  if (kind !== null && payload) {
+    const reasons = kind === 'residency' ? residencyClaimReasons(payload)
+      : kind === 'transfer' ? transferReasons(payload)
+      : kind === 'commit' ? commitReasons(payload)
+      : accessReasons(payload);
+    return reasons.length === 0 ? { ok: true, kind } : { ok: false, kind, reasons };
+  }
+  let touch: { ok: boolean; reasons: string[] };
+  try {
+    touch = verifyTouch(payload);
+  } catch {
+    touch = { ok: false, reasons: ['unreadable payload'] };
+  }
+  return touch.ok ? { ok: true, kind: 'touch' } : { ok: false, kind: 'touch', reasons: touch.reasons };
+}
+
+const EVIDENCE_NOUNS: Record<'residency' | 'transfer' | 'commit' | 'access', [string, string?]> = {
+  residency: ['residency claim'],
+  transfer: ['transfer record'],
+  commit: ['field-set commitment'],
+  access: ['access proof'],
+};
+
+function purposeRow(history: SubjectHistory, receipts: SubjectReceipt[]): VerdictRow {
+  const id = 'purpose' as const;
+  if (receipts.length === 0) {
+    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
+  }
+  if (history.verified !== true) {
+    return { id, label: LABELS[id], state: 'failed', detail: offlineFailureDetail(history) };
+  }
+  let touches = 0;
+  let shreds = 0;
+  const evidence: Array<'residency' | 'transfer' | 'commit' | 'access'> = [];
+  for (const sr of receipts) {
+    const check = wellFormedCustodyPayload(touchPayloadOf(sr));
+    if (!check.ok) {
+      const what = check.kind === 'touch' ? 'custody touch'
+        : check.kind === 'retention' ? 'retention'
+        : `${EVIDENCE_NOUNS[check.kind][0]}`;
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `Receipt ${sr?.hash} (index ${sr?.index}) has a malformed ${what} payload: ${check.reasons.join(', ')}.`,
+      };
+    }
+    if (check.kind === 'shred') shreds += 1;
+    else if (check.kind === 'touch') touches += 1;
+    else evidence.push(check.kind);
+  }
+  if (evidence.length === 0) {
+    if (shreds === 0) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'proven',
+        detail: `All ${plural(receipts.length, 'receipt')} in this slice verified offline (signature, delegation, scope) and each carries a well-formed custody touch payload naming its data class and operation.`,
+      };
+    }
+    return {
+      id,
+      label: LABELS[id],
+      state: 'proven',
+      detail: `All ${plural(receipts.length, 'receipt')} in this slice verified offline (signature, delegation, scope): ${plural(touches, 'touch', 'touches')} carried a well-formed custody touch payload naming its data class and operation, and ${plural(shreds, 'retention shred')} carried a well-formed key-destruction payload.`,
+    };
+  }
+  // Slices that also carry the rows 6-8 evidence payloads: enumerate them honestly.
+  const counts = new Map<string, number>();
+  for (const k of evidence) counts.set(k, (counts.get(k) ?? 0) + 1);
+  const named = [...counts.entries()].map(([k, n]) => {
+    const [noun, pluralForm] = EVIDENCE_NOUNS[k as keyof typeof EVIDENCE_NOUNS];
+    return plural(n, noun, pluralForm);
+  });
+  const parts = [`${plural(touches, 'touch', 'touches')} carried a well-formed custody touch payload naming its data class and operation`];
+  if (shreds > 0) parts.push(`${plural(shreds, 'retention shred')} carried a well-formed key-destruction payload`);
+  parts.push(`${named.join(', ')} passed structural checks`);
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `All ${plural(receipts.length, 'receipt')} in this slice verified offline (signature, delegation, scope): ${parts.join(', and ')}.`,
+  };
+}
+
+function offlineFailureDetail(history: SubjectHistory): string {
+  const failures = Array.isArray(history.failures) ? history.failures : [];
+  if (failures.length === 0) return 'The slice did not verify offline.';
+  return `${plural(failures.length, 'receipt')} failed offline verification: ${failures.join('; ')}. A receipt that does not verify is a failure, not an unknown.`;
+}
+
+// ---------------------------------------------------------------------------
+// Row 2 (self-sovereign): "You can check this yourself"
+// ---------------------------------------------------------------------------
+
+function selfSovereignRow(history: SubjectHistory, receipts: SubjectReceipt[]): VerdictRow {
+  const id = 'self_sovereign' as const;
+  if (receipts.length === 0) {
+    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
+  }
+  if (history.verified !== true) {
+    return { id, label: LABELS[id], state: 'failed', detail: offlineFailureDetail(history) };
+  }
+  if (history.sth === undefined || history.sth === null) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: 'The slice came with no signed tree head, so the anchor commitment could not be verified.',
+    };
+  }
+  let sthOk = false;
+  try {
+    sthOk = verifySTH(history.sth as unknown as SignedTreeHead);
+  } catch {
+    sthOk = false;
+  }
+  if (!sthOk) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'failed',
+      detail: "The signed tree head failed verification: the log's commitment to this slice does not check out.",
+    };
+  }
+  const size = (history.sth as { size?: unknown }).size;
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `All ${plural(receipts.length, 'receipt')} verified offline in this process (signature, delegation, scope) and the signed tree head (size ${typeof size === 'number' ? size : '?'}) verifies: zero network calls, nothing taken on trust.`,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Row 3 (human_read): "Nobody read it"
+// ---------------------------------------------------------------------------
+
+async function humanReadRow(
+  receipts: SubjectReceipt[],
+  evidence: ExtraEvidence,
+  verifyQuote: QuoteVerifier | undefined,
+): Promise<VerdictRow> {
+  const id = 'human_read' as const;
+  // A receipt shows a human actor when its embedded touch payload declares one
+  // (`actor: "human"`). The check is cheap and always runs, evidence or not, and a
+  // human actor beats any coverage attestation: failed stays failed.
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['actor'] === 'human') {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `Receipt ${sr?.hash} (index ${sr?.index}) records a human actor: a person, not only an agent, touched this data.`,
+      };
+    }
+  }
+  const bag = evidence.coverage;
+  const windows: CoverageEvidence[] = Array.isArray(bag) ? bag : bag ? [bag] : [];
+  if (windows.length === 0) {
+    return { id, label: LABELS[id], state: 'not covered', detail: 'No coverage attestation for this window' };
+  }
+  for (const c of windows) {
+    if (typeof c !== 'object' || c === null || Array.isArray(c) || c.v !== 1 || c.type !== 'coverage.attestation') {
+      return { id, label: LABELS[id], state: 'not covered', detail: 'The coverage evidence is not a signed coverage attestation.' };
+    }
+  }
+  if (receipts.length === 0) {
+    // Coverage over nothing proves nothing about the subject's data.
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: "This slice has no receipts, so there is nothing for the coverage attestation to cover: coverage over nothing proves nothing about this subject's data.",
+    };
+  }
+  // Every window authenticates on its own before any of them counts: one bad link
+  // fails the chain, because a chain is only coverage if every part of it holds.
+  const spans: Array<{ start: number; end: number; startIso: string; endIso: string }> = [];
+  for (const coverage of windows) {
+    const checked = await checkCoverageWindow(coverage, verifyQuote);
+    if ('state' in checked) return { id, label: LABELS[id], state: checked.state, detail: checked.detail };
+    spans.push({ ...checked, startIso: coverage.windowStart, endIso: coverage.windowEnd });
+  }
+  // Contiguity: sorted by start, each window must begin no later than the running end
+  // of the ones before it. Abutting and overlapping are both fine; a gap is not.
+  spans.sort((a, b) => a.start - b.start);
+  let unionEnd = spans[0]!.end;
+  let unionEndIso = spans[0]!.endIso;
+  for (let k = 1; k < spans.length; k++) {
+    const w = spans[k]!;
+    if (w.start > unionEnd) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'not covered',
+        detail: `The coverage chain has a gap between ${new Date(unionEnd).toISOString()} and ${new Date(w.start).toISOString()}: egress was unattested in that interval, and an unattested interval is not coverage.`,
+      };
+    }
+    if (w.end > unionEnd) {
+      unionEnd = w.end;
+      unionEndIso = w.endIso;
+    }
+  }
+  const unionStart = spans[0]!.start;
+  const unionStartIso = spans[0]!.startIso;
+  const times = receipts.map((sr) => parseTime(sr?.receipt?.ts));
+  if (times.some((t) => t === null || t < unionStart || t > unionEnd)) {
+    const valid = times.filter((t): t is number => t !== null);
+    const span = valid.length > 0
+      ? ` (this slice spans ${new Date(Math.min(...valid)).toISOString()} to ${new Date(Math.max(...valid)).toISOString()})`
+      : '';
+    return {
+      id,
+      label: LABELS[id],
+      state: 'not covered',
+      detail: `The coverage attestation (${unionStartIso} to ${unionEndIso}) does not cover every receipt in this slice${span}.`,
+    };
+  }
+  const images = [...new Set(windows.map((w) => w.imageHash))];
+  const under = images.length === 1 ? `attested image ${images[0]}` : `${images.length} attested images (${images.join(', ')})`;
+  const chain = windows.length === 1
+    ? `the whole window (${unionStartIso} to ${unionEndIso})`
+    : `an unbroken chain of ${windows.length} windows (${unionStartIso} to ${unionEndIso})`;
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `Signed coverage attestation verified (signature, signer-to-image binding and enclave quote): all egress paths were receipt-gated for ${chain} under ${under}, and no receipt in this slice shows a human actor.`,
+  };
+}
+
+/**
+ * Authenticate ONE coverage window. Returns its time span, or the verdict state that
+ * window fails with. Authenticity failures are `failed` (a claim that does not verify
+ * is a red, not an unknown); a missing quote verifier is `cannot determine`; a claim
+ * that simply is not asserted is `not covered`.
+ */
+async function checkCoverageWindow(
+  coverage: CoverageEvidence,
+  verifyQuote: QuoteVerifier | undefined,
+): Promise<{ start: number; end: number } | { state: VerdictState; detail: string }> {
+  // Authenticate before evaluating: an unsigned or badly-signed claim is not evidence.
+  const signerPub = publicKeyFromDid(typeof coverage.signer === 'string' ? coverage.signer : '');
+  if (!signerPub || typeof coverage.sig !== 'string' || !/^ed25519:[0-9a-f]{128}$/.test(coverage.sig)) {
+    return {
+      state: 'failed',
+      detail: 'The coverage attestation is unsigned or carries a malformed signature: an unsigned coverage claim is not evidence.',
+    };
+  }
+  // The trust root: when the deployment pins coverage-signing DIDs, a signer outside
+  // the list is never proven, however good its signature.
+  const trustedSigners = coverage.trustedSigners;
+  if (Array.isArray(trustedSigners) && !trustedSigners.includes(coverage.signer)) {
+    return {
+      state: 'failed',
+      detail: `The coverage attestation is from an unrecognized signer (${coverage.signer}): it is not in this deployment's trusted signers list, so the claim is not evidence.`,
+    };
+  }
+  // trustedSigners is reader-side config merged in after signing: it is NOT part of
+  // the signed record, so it is excluded from the canonical preimage here.
+  const { sig: _omitted, trustedSigners: _ts, ...unsigned } = coverage;
+  let sigOk = false;
+  try {
+    sigOk = ed25519.verify(hexToBytes(coverage.sig.slice('ed25519:'.length)), canonicalBytes(unsigned as Record<string, unknown>), signerPub);
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) {
+    return {
+      state: 'failed',
+      detail: "The coverage attestation's signature does not verify: a coverage claim that does not verify is a failure, not an unknown.",
+    };
+  }
+  // The claim must be bound to an attested image: attestationHash(embedded) === imageHash.
+  const attestation = asPayload(coverage.attestation) as Attestation | undefined;
+  let boundHash: string | null = null;
+  if (attestation) {
+    try {
+      boundHash = attestationHash(attestation);
+    } catch {
+      boundHash = null;
+    }
+  }
+  if (!attestation || boundHash === null || coverage.imageHash !== boundHash) {
+    return {
+      state: 'failed',
+      detail: "The coverage attestation's image hash does not match its embedded attestation (attestationHash convention): the binding to the attested image is broken.",
+    };
+  }
+  // The embedded attestation verifies through @zanii/attest with the injected quote
+  // verifier. A disproven quote is a red; no verifier injected is an honest grey.
+  let check: AttestCheck;
+  try {
+    check = await verifyAttestation(attestation, verifyQuote ? { verifyQuote } : {});
+  } catch {
+    check = { ok: false, structural: false, quoteVerified: false, reasons: ['attestation verification failed'] };
+  }
+  if (!check.structural) {
+    return { state: 'failed', detail: `The coverage attestation's embedded attestation is malformed: ${check.reasons.join(', ')}.` };
+  }
+  // And the SIGNING KEY must be bound to that image too. The enclave commits its
+  // signing DID to the quote as the attestation nonce, which attestationHash covers.
+  // Without this check a real published attestation can be lifted and re-signed by
+  // anyone, and only an optional trustedSigners pin would catch it.
+  if (attestation.nonce !== coverage.signer) {
+    return {
+      state: 'failed',
+      detail: `The coverage attestation's signing key is not bound to the attested image: the quote commits to ${attestation.nonce ?? '(no nonce)'}, but the record is signed by ${coverage.signer}. A key the enclave never vouched for is not evidence.`,
+    };
+  }
+  if (check.quoteVerified === false) {
+    return {
+      state: 'failed',
+      detail: "The coverage attestation's enclave quote failed verification: the code that claimed coverage is not confirmed to be the attested image.",
+    };
+  }
+  if (check.quoteVerified === null) {
+    return {
+      state: 'cannot determine',
+      detail: 'The coverage attestation is signed and well-formed, but no enclave quote verifier was injected, so the attested image could not be confirmed.',
+    };
+  }
+  if (coverage.allPathsGated !== true) {
+    return { state: 'not covered', detail: 'The coverage attestation does not assert that all egress paths were receipt-gated.' };
+  }
+  const start = parseTime(coverage.windowStart);
+  const end = parseTime(coverage.windowEnd);
+  if (start === null || end === null || start > end) {
+    return { state: 'not covered', detail: 'The coverage attestation window is missing or invalid.' };
+  }
+  return { start, end };
+}
+
+// ---------------------------------------------------------------------------
+// Row 4 (trained_on): "Never used to train a model"
+// ---------------------------------------------------------------------------
+
+function trainedOnRow(history: SubjectHistory, receipts: SubjectReceipt[], evidence: ExtraEvidence): VerdictRow {
+  const id = 'trained_on' as const;
+  const training = evidence.training;
+  if (!training) {
+    // Exact wording matters: a missing proof is NOT a clean result. Never "never".
+    return { id, label: LABELS[id], state: 'not covered', detail: 'No declared training runs to check against' };
+  }
+  const anchoredAt = parseTime(training.anchoredAt);
+  const runAttestedAt = parseTime(training.runAttestedAt);
+  if (anchoredAt === null || runAttestedAt === null) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: 'The training evidence is missing a valid manifest anchor time or run attestation time, so the ordering cannot be checked.',
+    };
+  }
+  if (anchoredAt > runAttestedAt) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: `The training manifest's anchor (${training.anchoredAt}) does not precede the run attestation (${training.runAttestedAt}). A manifest anchored after the run could have been written to exclude this record.`,
+    };
+  }
+  if (receipts.length === 0) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'not covered',
+      detail: "This slice has no receipts: a training-absence proof over an empty slice proves nothing about this subject's data.",
+    };
+  }
+  const manifest = training.manifest;
+  if (
+    !manifest || typeof manifest !== 'object' || manifest.v !== 1 || manifest.type !== 'training.manifest'
+    || typeof manifest.run_id !== 'string' || typeof manifest.root !== 'string' || parseHash(manifest.root) === null
+    || !Number.isInteger(manifest.size) || manifest.size < 0
+  ) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'failed',
+      detail: 'The training manifest is missing or malformed, so the absence proof cannot be checked against it.',
+    };
+  }
+  // The proof must speak to THIS subject, not someone else.
+  const proof = training.absenceProof;
+  if (!proof || typeof proof !== 'object' || proof.ref !== history.tag) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'failed',
+      detail: "The non-membership proof is missing or names a different ref than this subject's tag, so it says nothing about this slice.",
+    };
+  }
+  let ok = false;
+  try {
+    ok = verifyAbsence(proof, manifest);
+  } catch {
+    ok = false;
+  }
+  if (!ok) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'failed',
+      detail: `The non-membership proof does not verify against the declared training manifest (root ${manifest.root}).`,
+    };
+  }
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `Non-membership proof verified against the declared training manifest (${manifest.size} entries, root ${manifest.root}), anchored at ${training.anchoredAt} before the run was attested at ${training.runAttestedAt}. This subject's tag is absent from the training set.`,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Row 5 (copy_kept): "No copy was kept"
+// ---------------------------------------------------------------------------
+
+/**
+ * The destruction evidence lives IN the slice: a receipt stamped with this subject's
+ * tag whose embedded, signature-covered payload is a `@zanii/retention` shred
+ * (`buildKeyDestruction`'s shape). Slice membership binds the receipt to this subject
+ * (the ledger serves the receipt only under this tag, and the receipt's own offline
+ * check re-verifies here); the payload's salted subject commitment can later be
+ * proven to name the subject by revealing the salt. Binding to the OBJECT is by ref:
+ * a shred counts only for an object whose custody touches carry the same payload
+ * `ref`, so a shred for an unrelated object never turns this row green.
+ */
+function shredReceiptsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
+  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['_zr_kind'] === 'retention' && p['action'] === 'shred') out.push({ sr, payload: p });
+  }
+  return out;
+}
+
+/** The refs of the custody touches in the slice: the objects destruction must bind to. */
+function touchRefsOf(receipts: SubjectReceipt[]): string[] {
+  const refs = new Set<string>();
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['_zdc'] === 1 && typeof p['ref'] === 'string') refs.add(p['ref']);
+  }
+  return [...refs].sort();
+}
+
+function copyKeptRow(receipts: SubjectReceipt[], evidence: ExtraEvidence): VerdictRow {
+  const id = 'copy_kept' as const;
+  const shreds = shredReceiptsOf(receipts);
+  if (shreds.length === 0) {
+    return { id, label: LABELS[id], state: 'not covered', detail: 'No key-destruction record on file.' };
+  }
+  // A presented-but-broken shred is a red, not a grey: any failure anywhere in the
+  // slice's destruction records fails the row, however many others verify.
+  for (const { sr, payload } of shreds) {
+    if (sr?.check?.ok !== true) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `Receipt ${sr?.hash} (index ${sr?.index}) carries a key-destruction payload, but the receipt itself failed offline verification.`,
+      };
+    }
+    let check: { ok: boolean; reasons: string[] };
+    try {
+      check = verifyKeyDestruction(payload);
+    } catch {
+      check = { ok: false, reasons: ['unreadable payload'] };
+    }
+    if (!check.ok) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `The key-destruction payload on receipt ${sr?.hash} (index ${sr?.index}) did not verify: ${check.reasons.join(', ')}.`,
+      };
+    }
+  }
+  // Ref binding: a shred is evidence only for the objects this slice touches. A
+  // shred carrying no ref, or a ref no touch in this slice carries, does not count.
+  const touchRefs = touchRefsOf(receipts);
+  const bound = shreds.filter(({ payload }) => typeof payload['ref'] === 'string' && touchRefs.includes(payload['ref'] as string));
+  if (bound.length === 0) {
+    return { id, label: LABELS[id], state: 'not covered', detail: 'No key-destruction record on file.' };
+  }
+  const coveredRefs = new Set(bound.map(({ payload }) => payload['ref'] as string));
+  const uncoveredRefs = touchRefs.filter((r) => !coveredRefs.has(r));
+  if (uncoveredRefs.length > 0) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: `Verified key-destruction records cover ${coveredRefs.size} of ${plural(touchRefs.length, 'object')} touched in this slice: no key-destruction record binds to ${plural(uncoveredRefs.length, 'object')} (${uncoveredRefs.join(', ')}), so ${uncoveredRefs.length === 1 ? 'its destruction' : 'their destruction'} is unknown.`,
+    };
+  }
+  // Optional image evidence: check the claimed attestation hashes to the published
+  // image hash (bag-internal consistency; it does not bind the shred to the image).
+  const image = evidence.destructionImage;
+  let imagePart = '';
+  if (image !== undefined && image !== null) {
+    const attestation = asPayload((image as DestructionImageEvidence).attestation) as Attestation | undefined;
+    const published = (image as DestructionImageEvidence).publishedImageHash;
+    let attested: string | null = null;
+    if (attestation) {
+      try {
+        attested = attestationHash(attestation);
+      } catch {
+        attested = null;
+      }
+    }
+    if (!attestation || attested === null || typeof published !== 'string' || published.length === 0) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: 'The destruction image evidence is incomplete: it must carry the attestation record and the published image hash.',
+      };
+    }
+    if (attested !== published) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `The attested image hash (${attested}) does not match the published image hash (${published}).`,
+      };
+    }
+    imagePart = ` The attested image hash matches the published one (${published}).`;
+  }
+  const first = bound[0]!;
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `Key-destruction record verified: receipt ${first.sr?.hash} (index ${first.sr?.index}) carries a crypto-shredding attestation signed by ${first.sr?.receipt?.agent_id}, key commitment ${first.payload['key_commitment']}, destroyed at ${first.payload['executed_at']}, bound to object ${first.payload['ref']}. ${plural(bound.length, 'verified key-destruction record')} ${bound.length === 1 ? 'covers' : 'cover'} every object touched in this slice (${plural(touchRefs.length, 'object')}).${imagePart}`,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Row 6 (residency): "Data stayed in its declared region"
+// ---------------------------------------------------------------------------
+
+/** Residency claims carried by the slice (`buildResidencyClaim`'s shape, embedded
+ *  signature-covered exactly like the row-5 shred payloads). */
+function residencyClaimsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
+  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['type'] === 'residency.claim') out.push({ sr, payload: p });
+  }
+  return out;
+}
+
+/** A claim whose region signal is the operator asserting its own region: not an
+ *  attestation, whatever it claims. */
+function isSelfDeclared(p: Record<string, unknown>): boolean {
+  const source = asPayload(p.region_attestation)?.source;
+  return typeof source === 'string' && source.toLowerCase().startsWith('self');
+}
+
+function receiptDetailPrefix(sr: SubjectReceipt): string {
+  return `Receipt ${sr?.hash} (index ${sr?.index})`;
+}
+
+async function residencyRow(
+  receipts: SubjectReceipt[],
+  evidence: ExtraEvidence,
+  verifyRegion: RegionVerifier | undefined,
+): Promise<VerdictRow> {
+  const id = 'residency' as const;
+  if (receipts.length === 0) {
+    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
+  }
+  const claims = residencyClaimsOf(receipts);
+  if (claims.length === 0) {
+    return { id, label: LABELS[id], state: 'not covered', detail: 'No residency attestations on record' };
+  }
+  // A self-declared claim is no attestation: it does not count as evidence, here or
+  // in the coverage and crossing checks below.
+  const attested = claims.filter(({ payload }) => !isSelfDeclared(payload));
+  const selfDeclared = claims.length - attested.length;
+  if (attested.length === 0) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'not covered',
+      detail: `Every residency claim on record is self-declared: the region source is self-declared (the operator asserted its own region), not an independently verified signal.`,
+    };
+  }
+  // A presented-but-broken claim is a red, not a grey: structural check first, then
+  // the receipt's own offline verification (an unverified receipt's payload is not
+  // signature-covered evidence).
+  for (const { sr, payload } of attested) {
+    const reasons = residencyClaimReasons(payload);
+    if (reasons.length > 0) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a malformed residency claim: ${reasons.join(', ')}.`,
+      };
+    }
+    if (sr?.check?.ok !== true) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a residency claim payload, but the receipt itself failed offline verification.`,
+      };
+    }
+  }
+  // The jurisdiction allow-set is READER config, never producer-supplied (same trust
+  // rule as trustedSigners). Absent: unknown, never proven. Empty: allows no region,
+  // so every verified claim below is a crossing.
+  const jurisdiction = evidence.jurisdiction;
+  if (!Array.isArray(jurisdiction)) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: 'Residency claims are on record, but the reader provided no declared jurisdiction allow-set, so there is nothing to check them against.',
+    };
+  }
+  if (verifyRegion === undefined) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: 'Residency claims are on record, but no region verifier was injected, so the region signals could not be authenticated.',
+    };
+  }
+  const verified: Array<{ ts: string; region: string; ref: string | null }> = [];
+  for (const { sr, payload } of attested) {
+    let check: { ok: boolean; reasons: string[]; region: string | null; crossed: boolean };
+    try {
+      check = await verifyResidency(payload as unknown as ResidencyClaim, { allowedRegions: jurisdiction, verifyRegion });
+    } catch {
+      check = { ok: false, reasons: ['the residency check failed'], region: null, crossed: false };
+    }
+    if (check.crossed) {
+      // Do not echo the producer reason: its wording is not reader-facing.
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `The residency claim on receipt ${sr?.hash} (index ${sr?.index}) verifies, but its region ${check.region} is outside the declared jurisdiction: a border crossing is on record.`,
+      };
+    }
+    if (!check.ok || check.region === null) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `The residency claim on receipt ${sr?.hash} (index ${sr?.index}) did not verify: ${check.reasons.join(', ')}.`,
+      };
+    }
+    verified.push({
+      ts: payload.ts as string,
+      region: check.region,
+      ref: typeof payload.ref === 'string' && payload.ref ? payload.ref : null,
+    });
+  }
+  // The sequence check over the verified regions: any exit from the allow-set is red.
+  // (Per-claim verification already rejects an outside region, so this is belt and
+  // suspenders; it also catches a sequence that STARTS outside, which per-claim
+  // checks phrase differently.)
+  const crossings = detectCrossings(verified, jurisdiction);
+  if (crossings.length > 0) {
+    const c = crossings[0]!;
+    return {
+      id,
+      label: LABELS[id],
+      state: 'failed',
+      detail: `Verified residency claims show the data left the declared jurisdiction at ${c.ts} (moved to region ${c.region}).`,
+    };
+  }
+  // Coverage is per touch, never window-span: EVERY custody touch in the slice must
+  // be covered by a verified claim. A claim carrying a ref binds to every touch of
+  // that object; a ref-less claim is time-scoped and covers the touches made at its
+  // own timestamp. Anything looser would let two claims at the window's ends prove
+  // green over an uncovered middle.
+  const touches: Array<{ ref: string; ts: string }> = [];
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['_zdc'] === 1 && typeof p['ref'] === 'string' && parseTime(p['ts']) !== null) {
+      touches.push({ ref: p['ref'] as string, ts: p['ts'] as string });
+    }
+  }
+  if (touches.length === 0) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: 'This slice carries no custody touches, so per-touch residency coverage cannot be established.',
+    };
+  }
+  const isCovered = (t: { ref: string; ts: string }): boolean =>
+    verified.some((c) => (c.ref !== null ? c.ref === t.ref : c.ts === t.ts));
+  const uncovered = touches.filter((t) => !isCovered(t));
+  if (uncovered.length > 0) {
+    const covered = touches.length - uncovered.length;
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: `Verified residency claims cover ${covered} of ${plural(touches.length, 'touch', 'touches')} in this slice: ${plural(uncovered.length, 'touch', 'touches')} ${uncovered.length === 1 ? 'has' : 'have'} no valid in-jurisdiction claim, so ${uncovered.length === 1 ? 'its' : 'their'} residency is unknown.`,
+    };
+  }
+  const selfNote = selfDeclared > 0
+    ? ` ${plural(selfDeclared, 'self-declared claim')} ${selfDeclared === 1 ? 'was' : 'were'} not counted as evidence: the region source is self-declared.`
+    : '';
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `Verified residency claims cover every touch in this slice (${plural(touches.length, 'touch', 'touches')}): every region signal authenticated against the declared jurisdiction allow-set, and no border crossings were detected.${selfNote}`,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Row 7 (subprocessor): "Only declared third parties touched it"
+// ---------------------------------------------------------------------------
+
+/** Onward transfers carried by the slice (`buildTransfer`'s shape). */
+function transfersOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
+  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['type'] === 'subprocessor.transfer') out.push({ sr, payload: p });
+  }
+  return out;
+}
+
+/** Custody-touch junctions: the destinations the touch payloads say data crossed to. */
+function junctionsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; to: string }> {
+  const out: Array<{ sr: SubjectReceipt; to: string }> = [];
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    const j = p ? asPayload(p['junction']) : undefined;
+    // Only share/export are onward disclosures to a third party. Store/read/transform
+    // may carry a junction for topology (source/destination of the data), but they
+    // are not subprocessor transfers.
+    const op = typeof p?.['op'] === 'string' ? p['op'] : undefined;
+    if (j && typeof j.to === 'string' && j.to && (op === 'share' || op === 'export')) out.push({ sr, to: j.to });
+  }
+  return out;
+}
+
+function subprocessorRow(receipts: SubjectReceipt[], evidence: ExtraEvidence): VerdictRow {
+  const id = 'subprocessor' as const;
+  const transfers = transfersOf(receipts);
+  const junctions = junctionsOf(receipts);
+  if (transfers.length === 0 && junctions.length === 0) {
+    return { id, label: LABELS[id], state: 'not covered', detail: 'No onward transfers declared or recorded' };
+  }
+  // Presented-but-broken is a red before any trust-root question.
+  for (const { sr, payload } of transfers) {
+    const reasons = transferReasons(payload);
+    if (reasons.length > 0) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a malformed transfer record: ${reasons.join(', ')}.`,
+      };
+    }
+    if (sr?.check?.ok !== true) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a transfer record payload, but the receipt itself failed offline verification.`,
+      };
+    }
+    // Stricter than verifyTransfers (which requires an id only for dpa/scc): any
+    // onward transfer without an agreement id is a red here.
+    const agreement = asPayload(payload.agreement);
+    const agreementId = agreement?.id;
+    if (typeof agreementId !== 'string' || !agreementId) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `The transfer to '${payload.to}' at ${payload.ts} carries no agreement id: an onward transfer without an agreement reference is a failure, not an unknown.`,
+      };
+    }
+  }
+  // The declared subprocessor list is READER config, never producer-supplied (same
+  // trust rule as trustedSigners). Without it there is nothing to check against.
+  const declared = evidence.declaredSubprocessors;
+  if (!Array.isArray(declared)) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: 'Custody touches or transfer records name onward destinations, but the reader provided no declared subprocessor list, so there is nothing to check them against.',
+    };
+  }
+  let check: { ok: boolean; reasons: string[] };
+  try {
+    check = verifyTransfers(transfers.map(({ payload }) => payload as unknown as Transfer), declared);
+  } catch {
+    check = { ok: false, reasons: ['the transfer check failed'] };
+  }
+  if (!check.ok) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'failed',
+      detail: `The declared-subprocessor check failed: ${check.reasons.join('; ')}.`,
+    };
+  }
+  // Divergence is red, never silent: a junction naming a destination with no matching
+  // declared transfer means the custody trail and the transfer record disagree.
+  for (const { sr, to } of junctions) {
+    const matched = transfers.some(({ payload }) => payload.to === to && declared.includes(payload.to as string));
+    if (!matched) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} records a custody junction to '${to}', but no declared transfer to that party is on record: a divergence between the custody trail and the transfer record is a failure, never silent.`,
+      };
+    }
+  }
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `Every onward destination in this slice resolves to a declared subprocessor under a named agreement: ${plural(junctions.length, 'custody junction')} and ${plural(transfers.length, 'recorded transfer')} checked against the declared list (${declared.length} ${declared.length === 1 ? 'party' : 'parties'}), with no undeclared party, no missing agreement id, and no divergence.`,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Row 8 (minimization): "Only what was needed was taken"
+// ---------------------------------------------------------------------------
+
+/** Field-set commitments carried by the slice (`commitFieldSet` records under type
+ *  `minimization.commit`). */
+function commitsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
+  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['type'] === 'minimization.commit') out.push({ sr, payload: p });
+  }
+  return out;
+}
+
+/** Access proofs carried by the slice (`buildAccessProof`'s shape). */
+function accessProofsOf(receipts: SubjectReceipt[]): Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> {
+  const out: Array<{ sr: SubjectReceipt; payload: Record<string, unknown> }> = [];
+  for (const sr of receipts) {
+    const p = asPayload(touchPayloadOf(sr));
+    if (p && p['type'] === 'minimization.access') out.push({ sr, payload: p });
+  }
+  return out;
+}
+
+function minimizationRow(receipts: SubjectReceipt[]): VerdictRow {
+  const id = 'minimization' as const;
+  if (receipts.length === 0) {
+    return { id, label: LABELS[id], state: 'cannot determine', detail: 'No receipts in this slice, so there is nothing to check.' };
+  }
+  const commits = commitsOf(receipts);
+  const accesses = accessProofsOf(receipts);
+  for (const { sr, payload } of commits) {
+    const reasons = commitReasons(payload);
+    if (reasons.length > 0) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a malformed field-set commitment record: ${reasons.join(', ')}.`,
+      };
+    }
+    if (sr?.check?.ok !== true) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a field-set commitment payload, but the receipt itself failed offline verification.`,
+      };
+    }
+    // Recompute the commitment from the claimed fields: a mismatch is a set widened
+    // (or swapped) after the commitment was recorded.
+    let matches = false;
+    try {
+      matches = verifyFieldSet(payload.fields as string[], payload.commitment as string);
+    } catch {
+      matches = false;
+    }
+    if (!matches) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a field-set commitment whose fields do not recompute to the commitment: the declared minimum may have been widened after the fact.`,
+      };
+    }
+  }
+  // Access proofs are validated before the commits-empty branch: a presented but
+  // broken proof is a red even when no commitments are on record.
+  for (const { sr, payload } of accesses) {
+    const reasons = accessReasons(payload);
+    if (reasons.length > 0) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries a malformed minimization access proof: ${reasons.join(', ')}.`,
+      };
+    }
+    if (sr?.check?.ok !== true) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `${receiptDetailPrefix(sr)} carries an access proof payload, but the receipt itself failed offline verification.`,
+      };
+    }
+  }
+  if (commits.length === 0) {
+    if (accesses.length > 0) {
+      // Symmetric with commits-without-accesses: an access proof whose declared
+      // minimum is not on record cannot be checked, and unchecked is unknown.
+      return {
+        id,
+        label: LABELS[id],
+        state: 'cannot determine',
+        detail: 'Access proofs are on record, but no minimum-field commitments: the declared minimum they claim cannot be checked, and an unchecked access is unknown, not clean.',
+      };
+    }
+    return { id, label: LABELS[id], state: 'not covered', detail: 'No minimum-field commitments on record' };
+  }
+  if (accesses.length === 0) {
+    return {
+      id,
+      label: LABELS[id],
+      state: 'cannot determine',
+      detail: 'Field-set commitments are on record, but no access proofs: no recorded access was checked against the declared minimum.',
+    };
+  }
+  for (const { sr, payload } of accesses) {
+    const commit = commits.find(({ payload: c }) => c.commitment === payload.field_set);
+    if (!commit) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'cannot determine',
+        detail: `${receiptDetailPrefix(sr)} carries an access proof against field-set commitment ${payload.field_set}, but that commitment is not on record in this slice: the declared minimum it claims cannot be checked.`,
+      };
+    }
+    let check: { ok: boolean; reasons: string[]; excess: string[] };
+    try {
+      check = verifyMinimization(payload as unknown as AccessProof, commit.payload.fields as string[]);
+    } catch {
+      check = { ok: false, reasons: ['the minimization check failed'], excess: [] };
+    }
+    if (!check.ok) {
+      return {
+        id,
+        label: LABELS[id],
+        state: 'failed',
+        detail: `The minimization check failed for receipt ${sr?.hash} (index ${sr?.index}): ${check.reasons.join(', ')}.`,
+      };
+    }
+  }
+  return {
+    id,
+    label: LABELS[id],
+    state: 'proven',
+    detail: `Every recorded access (${plural(accesses.length, 'proof')}) in this slice stayed within its committed minimum field set: all ${plural(commits.length, 'field-set commitment')} recomputed to their recorded commitments, and no accessed field fell outside the declared minimum.`,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// The one function both surfaces call.
+// ---------------------------------------------------------------------------
+
+/**
+ * Compute the eight verdict rows from an offline-verified subject history. Pure: no
+ * network, no clock. Async only because row 3's coverage attestation is checked
+ * through `@zanii/attest`'s `verifyAttestation` and row 6's residency claims through
+ * `@zanii/residency`'s `verifyResidency`, whose injected verifiers may be async;
+ * pass them via `options.verifyQuote` / `options.verifyRegion`. Never throws:
+ * malformed input yields honest `cannot determine` / `not covered` / `failed` rows
+ * with reasons. Rows are always returned in this fixed order: purpose,
+ * self_sovereign, human_read, trained_on, copy_kept, residency, subprocessor,
+ * minimization.
+ */
+export async function computeVerdicts(
+  history: SubjectHistory,
+  evidence: ExtraEvidence = {},
+  options: VerdictOptions = {},
+): Promise<VerdictRow[]> {
+  const h = (history && typeof history === 'object' ? history : {}) as SubjectHistory;
+  const receipts = Array.isArray(h.receipts) ? h.receipts : [];
+  const ev = (evidence && typeof evidence === 'object' ? evidence : {}) as ExtraEvidence;
+  const verifyQuote = options && typeof options === 'object' ? options.verifyQuote : undefined;
+  const verifyRegion = options && typeof options === 'object' ? options.verifyRegion : undefined;
+  const rows: Array<() => VerdictRow | Promise<VerdictRow>> = [
+    () => purposeRow(h, receipts),
+    () => selfSovereignRow(h, receipts),
+    () => humanReadRow(receipts, ev, verifyQuote),
+    () => trainedOnRow(h, receipts, ev),
+    () => copyKeptRow(receipts, ev),
+    () => residencyRow(receipts, ev, verifyRegion),
+    () => subprocessorRow(receipts, ev),
+    () => minimizationRow(receipts),
+  ];
+  const ids: VerdictId[] = ['purpose', 'self_sovereign', 'human_read', 'trained_on', 'copy_kept', 'residency', 'subprocessor', 'minimization'];
+  const out: VerdictRow[] = [];
+  for (let i = 0; i < rows.length; i++) {
+    try {
+      out.push(await rows[i]!());
+    } catch (err) {
+      // Verification paths never crash: an unexpected error is an honest grey.
+      const id = ids[i]!;
+      out.push({
+        id,
+        label: LABELS[id],
+        state: 'cannot determine',
+        detail: `This line could not be computed: ${err instanceof Error ? err.message : String(err)}.`,
+      });
+    }
+  }
+  return out;
+}
+
+/**
+ * Seconds between the signed tree head's timestamp and `now` (the caller supplies
+ * `now`; this package has no clock). The page shows anchor lag: four minutes vs
+ * four hours is a property the reader is entitled to see. Null when unknown (no sth,
+ * no timestamp, unparseable). Negative means the sth is newer than the caller's
+ * clock: possible skew, shown as-is.
+ */
+export function computeAnchorLag(
+  sth: Record<string, unknown> | SignedTreeHead | undefined | null,
+  now: Date | string | number,
+): number | null {
+  try {
+    const ts = parseTime((sth as Record<string, unknown> | undefined | null)?.ts);
+    if (ts === null) return null;
+    const nowMs = now instanceof Date ? now.getTime() : typeof now === 'number' ? now : parseTime(now);
+    if (nowMs === null || Number.isNaN(nowMs)) return null;
+    return Math.round((nowMs - ts) / 1000);
+  } catch {
+    return null;
+  }
+}