attenu-guard 0.12.0 → 0.13.0

package/dist/esm/evidence.js

@@ -30,11 +30,12 @@
  * point. This is byte-compatible with the Python library's
  * `attenu_guard.evidence`.
  */
-import { canonicalBytes, compareCodePoints, parseJson, pyNumber, RawNumber, sortedStrings, toPlain, } from "./canonical.js";
+import { canonicalBytes, compareCodePoints, intOr, integral, parseJson, pyNumber, RawNumber, sortedStrings, toPlain, } from "./canonical.js";
 import { createHash } from "node:crypto";
 import { AuditLog, SCHEMA_VERSION, chainIdOf, hashEntry, GENESIS } from "./audit.js";
 import { Authority } from "./authority.js";
-import { describe as describeCeiling } from "./ceilings.js";
+import { describeInFinding, wireKeyOf } from "./ceilings.js";
+import { pyRepr, pyStr, pyStrRepr, shown } from "./display.js";
 import { CAPTURES, BODY_STATES, POLICIES, BodyState, Capture } from "./reasons.js";
 import { PARAMS_HASH_REASONS } from "./params.js";
 import { Ed25519Signer, Ed25519Verifier } from "./wire.js";
@@ -267,23 +268,41 @@ function orNull(value) {
 class FailureLog {
     messages = [];
     details = [];
+    /**
+     * A third list in step with those two: the ledger entry each failure is about, or `null` for a
+     * failure about no single entry. It stays out of `details`, whose member set is the published
+     * contract, and `entryIndices` turns it into positions in the bundle's `entries`, which
+     * `verifyBundle` reports as `failure_entries`. A position is exact where a seq is not: an
+     * entry's seq can be missing, null, a boolean or a duplicate, and its index is still its own.
+     */
+    about = [];
     add(reason, detail, position = {}) {
-        const { seq = null, node = null, callId = null } = position;
+        const { seq = null, node = null, callId = null, entry = null } = position;
         this.messages.push(detail);
         this.details.push({ reason, seq, node, call_id: callId, detail });
+        this.about.push(entry);
     }
     extend(other) {
         this.messages.push(...other.messages);
         this.details.push(...other.details);
+        this.about.push(...other.about);
+    }
+    /**
+     * For each failure, the index in `entries` of the entry it is about, or `null`. Found by
+     * identity: every entry a check reports on is one of these objects.
+     */
+    entryIndices(entries) {
+        const at = new Map();
+        entries.forEach((e, i) => {
+            if (!at.has(e))
+                at.set(e, i);
+        });
+        return this.about.map((e) => (e === null ? null : (at.get(e) ?? null)));
     }
     get length() {
         return this.messages.length;
     }
 }
-/**
- * `node -> Authority` and `node -> parent`, reconstructed from `root` and
- * `spawn` events alone. No engine state.
- */
 /**
  * Why `child` is not ⊆ `parent`, rendered for the monotonicity failure message.
  *
@@ -307,7 +326,7 @@ function monotonicityDetail(child, parent) {
     // does not cover is also absent from that set.
     if (!Array.from(child.scopes).every((s) => parent.coversScope(s))) {
         const extra = Array.from(child.scopes).filter((s) => !parent.scopes.has(s));
-        return (`child scopes [${extra.sort(compareCodePoints).map((s) => `'${s}'`).join(", ")}] ` +
+        return (`child scopes ${reprList(extra.sort(compareCodePoints))} ` +
             `not held by parent`);
     }
     const childByKey = new Map(child.ceilings.map((c) => [String(c.key), c]));
@@ -316,11 +335,11 @@ function monotonicityDetail(child, parent) {
         const parentCeiling = parent.ceilings.find((c) => String(c.key) === key);
         const childCeiling = childByKey.get(key);
         if (childCeiling === undefined) {
-            return `ceiling ${key} unbounded, parent holds ${describeCeiling(parentCeiling)}`;
+            return `ceiling ${shown(wireKeyOf(parentCeiling))} unbounded, parent holds ${describeInFinding(parentCeiling)}`;
         }
         if (!parentCeiling.subsumes(childCeiling)) {
-            return (`ceiling ${describeCeiling(childCeiling)} looser than parent ` +
-                `${describeCeiling(parentCeiling)}`);
+            return (`ceiling ${describeInFinding(childCeiling)} looser than parent ` +
+                `${describeInFinding(parentCeiling)}`);
         }
     }
     if (parent.ttl !== null) {
@@ -334,6 +353,17 @@ function monotonicityDetail(child, parent) {
     // it exists so that such a dimension cannot fail SILENTLY.
     return "child not narrower than parent";
 }
+/**
+ * `node -> Authority` and `node -> parent`, reconstructed from `root` and `spawn` events in ledger
+ * order. No engine state.
+ *
+ * A node id is a string, and a node is defined once, by the root or by one spawn. A root or a
+ * spawn whose `node` is not a string defines nothing and is reported unreadable here. A second
+ * definition of a node is left out of these maps, so every later check reads the first one, and
+ * `verifyBundle`'s monotonicity check reports it. `parent` maps a spawned node to its `parent`
+ * member as written, whatever its type; whether that names a node defined earlier is judged there
+ * too. The Python implementation's `_node_authorities`.
+ */
 function nodeAuthorities(entries) {
     const auth = new Map();
     const parent = new Map();
@@ -341,37 +371,58 @@ function nodeAuthorities(entries) {
     const definedBy = new Map();
     for (const e of entries) {
         const ev = toPlain(e["event"]);
+        if (ev !== "root" && ev !== "spawn")
+            continue;
         const node = toPlain(e["node"]);
+        const position = { seq: orNull(e["seq"]), node: orNull(e["node"]), entry: e };
+        if (typeof node !== "string") {
+            // One of the two historical messages that name a node before their colon rather than a
+            // reason token, so the reason is stated here instead of parsed out of the string.
+            if (ev === "root") {
+                failures.add("unreadable_authority", `root ${shown(e["node"])}: unreadable authority (node is not a string)`, position);
+            }
+            else {
+                failures.add("unreadable_granted", `spawn ${shown(e["node"])}: unreadable granted (node is not a string)`, position);
+            }
+            continue;
+        }
+        if (definedBy.has(node))
+            continue; // defined twice: verifyBundle reports it
+        definedBy.set(node, e);
         if (ev === "root") {
-            definedBy.set(node, e);
             try {
                 auth.set(node, Authority.fromWire(e["authority"] ?? null));
             }
             catch (exc) {
-                // One of the two historical messages that name a node before their colon rather than a
-                // reason token, so the reason is stated here instead of parsed out of the string.
-                failures.add("unreadable_authority", `root ${node}: unreadable authority (${exc.message})`, {
-                    seq: orNull(e["seq"]),
-                    node: orNull(e["node"]),
-                });
+                failures.add("unreadable_authority", `root ${shown(e["node"])}: unreadable authority (${exc.message})`, position);
             }
         }
-        else if (ev === "spawn") {
-            definedBy.set(node, e);
-            parent.set(node, toPlain(e["parent"]) ?? null);
+        else {
+            parent.set(node, orNull(e["parent"]));
             try {
                 auth.set(node, Authority.fromWire(e["granted"] ?? null));
             }
             catch (exc) {
-                failures.add("unreadable_granted", `spawn ${node}: unreadable granted (${exc.message})`, {
-                    seq: orNull(e["seq"]),
-                    node: orNull(e["node"]),
-                });
+                failures.add("unreadable_granted", `spawn ${shown(e["node"])}: unreadable granted (${exc.message})`, position);
             }
         }
     }
     return { auth, parent, failures, definedBy };
 }
+/**
+ * Record the nodes a `kill` entry revokes, node -> that kill's own `seq`; the first kill stands.
+ * Only string ids in a list count: anything else names no node. The Python implementation's
+ * `_note_revoked`.
+ */
+function noteRevoked(entry, revokedAt) {
+    const revoked = entry["revoked"];
+    if (!Array.isArray(revoked))
+        return;
+    for (const node of revoked) {
+        if (typeof node === "string" && !revokedAt.has(node))
+            revokedAt.set(node, entry["seq"]);
+    }
+}
 /**
  * A view of the chain from the bundle: each node with its agent, task,
  * authority, parent and per-node action counts — what a reviewer or a UI
@@ -383,10 +434,15 @@ export function delegationGraph(bundle) {
     const meta = {};
     for (const e of entries) {
         const ev = toPlain(e["event"]);
-        const n = toPlain(e["node"]);
+        const raw = toPlain(e["node"]);
+        if (typeof raw !== "string" && ev !== "kill")
+            continue; // a node id is a string; anything else names no node
+        const n = raw;
         if (ev === "root" || ev === "spawn") {
+            if (Object.hasOwn(meta, n))
+                continue; // defined once: the first definition stands
             const a = auth.get(n);
-            meta[n] = {
+            setOwn(meta, n, {
                 agent: orNull(e["agent"]),
                 task: orNull(e["task"]),
                 parent: orNull(e["parent"]),
@@ -396,30 +452,32 @@ export function delegationGraph(bundle) {
                 revoked: false,
                 complete: false,
                 denials_by_disposition: {},
-            };
+            });
         }
-        else if (ev === "allow" && meta[n]) {
+        else if (ev === "allow" && Object.hasOwn(meta, n)) {
             meta[n].allows += 1;
         }
-        else if (ev === "deny" && meta[n]) {
+        else if (ev === "deny" && Object.hasOwn(meta, n)) {
             meta[n].denies += 1;
             // A deny without a disposition is named by its reason.
             const d = (toPlain(e["disposition"]) ?? toPlain(e["reason"]) ?? "unstated");
             meta[n].denials_by_disposition[d] = (meta[n].denials_by_disposition[d] ?? 0) + 1;
         }
-        else if (ev === "done" && meta[n]) {
+        else if (ev === "done" && Object.hasOwn(meta, n)) {
             meta[n].complete = true;
         }
         else if (ev === "kill") {
-            for (const r of toPlain(e["revoked"]) ?? []) {
-                if (meta[r])
+            const revoked = new Map();
+            noteRevoked(e, revoked);
+            for (const r of revoked.keys()) {
+                if (Object.hasOwn(meta, r))
                     meta[r].revoked = true;
             }
         }
     }
     const edges = [];
     for (const [child, p] of parent) {
-        if (p)
+        if (typeof p === "string" && p !== "")
             edges.push({ parent: p, child });
     }
     return { chain_id: orNull(bundle.chain_id), nodes: meta, edges };
@@ -487,37 +545,9 @@ export function denials(bundle) {
     }
     return Array.from(rows.values()).sort((a, b) => a.first_seq - b.first_seq);
 }
-/** Python-style repr for the small set of value types these failure messages carry. */
-function pyRepr(value) {
-    if (value === null)
-        return "None";
-    if (typeof value === "boolean")
-        return value ? "True" : "False";
-    if (typeof value === "number")
-        return String(value);
-    if (typeof value === "string")
-        return `'${value}'`;
-    // Containers reach here only on hostile input — a subject member that is a list or an object
-    // where the contract wants a scalar. Rendered the way Python's repr renders them, because the
-    // two implementations report the same failure strings and a JSON spelling would not match.
-    if (Array.isArray(value))
-        return `[${value.map((v) => pyRepr(v)).join(", ")}]`;
-    if (typeof value === "object") {
-        const body = Object.entries(value)
-            .map(([k, v]) => `${pyRepr(k)}: ${pyRepr(v)}`)
-            .join(", ");
-        return `{${body}}`;
-    }
-    return JSON.stringify(value);
-}
-/**
- * Python's `str()` where a failure string interpolates a value bare (`{x}`) rather than through
- * `repr` (`{x!r}`) — the same rendering for every type except a string, which `str` leaves
- * unquoted. Both implementations report the same failure bytes, so the distinction is load-bearing.
- */
-function pyStr(value) {
-    return typeof value === "string" ? value : pyRepr(value);
-}
+// `pyRepr` and `pyStr` (display.ts) are Python's `repr` and `str` for the values these failure
+// messages carry. Both implementations report the same failure bytes, so the distinction between
+// `{x}` and `{x!r}` is load-bearing, and `pyRepr` escapes a string exactly as `repr` does.
 // =============================================================================================
 // Observer envelopes (envelope v1) — the TypeScript half of `attenu_guard.evidence`'s.
 //
@@ -572,7 +602,9 @@ export const ENVELOPE_ALG = "EdDSA";
 /**
  * A verifying envelope's state. It says where the signature came from and NOTHING about
  * authority — the witness is whoever holds the key `witness.kid` names, which nothing in the
- * envelope makes the delegation parent.
+ * envelope makes the delegation parent. The signature covers the entry's hash and chain position
+ * plus what the witness-key holder observed; it does not attest that the action was permitted.
+ * Monotonicity and containment answer that, from the ledger.
  */
 export const WITNESS_SIGNED = "witness-signed";
 /**
@@ -605,15 +637,25 @@ export function envelopeSigningInput(envelope) {
     return canonicalBytes(body);
 }
 /**
- * seq -> the entry's hash RECOMPUTED from the bundle, never read off the entry.
+ * Where `states` and `results` file an entry: its seq when it has one, as the integer when it is
+ * integral (`intOr`: `1.0` is filed as 1), and its index when it has none. The Python
+ * implementation's `_state_key`, rendered as a record key. It is a report key, never a lookup: an
+ * envelope finds the entry it covers through `subjectIndex`.
+ */
+export function stateKey(e, index) {
+    return String("seq" in e ? orNull(intOr(e["seq"])) : index);
+}
+/**
+ * Each entry's hash RECOMPUTED from the bundle, by index, never read off the entry.
  *
  * `entry_hash` in a subject is checked against this. The walk mirrors `AuditLog.verify`, so an
  * entry whose stored `hash` was replaced does not get to supply the value it is compared against.
+ * By index, not by seq: an entry's seq can be missing, another entry's, or not an integer.
  */
 function recomputedHashes(entries) {
-    const out = new Map();
+    const out = [];
     let prev = GENESIS;
-    entries.forEach((e, i) => {
+    for (const e of entries) {
         const payload = {};
         for (const [k, v] of Object.entries(e))
             if (k !== "hash")
@@ -626,20 +668,134 @@ function recomputedHashes(entries) {
             // An unhashable payload has no recomputable hash; that IS the break, at this entry.
             computed = null;
         }
-        out.set(orNull(e["seq"]) ?? i, computed);
+        out.push(computed);
         prev = computed ?? GENESIS;
+    }
+    return out;
+}
+/**
+ * subject.seq -> the index of the entry an envelope naming that seq covers.
+ *
+ * An entry is keyed by its own seq when that is an integral number and not a boolean, as the
+ * schema's integer type defines (`integral`: `1.0` is 1), and by its index when it has no seq
+ * member at all. An entry whose seq is a boolean, a string, null, or a fractional number is keyed
+ * by nothing, so no envelope covers it: in Python, keyed by the raw value, `"seq": true` took the
+ * envelope written for seq 1, and here a null seq was keyed by its index. Where two entries share
+ * a key the later one is covered, as it always was. The Python implementation's `_subject_index`.
+ */
+function subjectIndex(entries) {
+    const keyed = new Map();
+    entries.forEach((e, i) => {
+        if (!("seq" in e)) {
+            keyed.set(i, i);
+            return;
+        }
+        const seq = integral(e["seq"]);
+        if (seq !== null)
+            keyed.set(seq, i);
     });
+    return keyed;
+}
+/**
+ * Two `seq` or `v` values are the same: equal integers when either is integral (`integral`), so
+ * `1.0` is 1; otherwise the same value of the same type, so `true` is not 1 and `"1"` is not 1. An
+ * absent value is null, as Python's `dict.get` reads it. The Python implementation's
+ * `_same_number`.
+ */
+function sameNumber(a, b) {
+    const ia = integral(a);
+    const ib = integral(b);
+    if (ia !== null || ib !== null)
+        return ia === ib;
+    const pa = orNull(a);
+    const pb = orNull(b);
+    return pyTypeOf(pa) === pyTypeOf(pb) && pyEquals(pa, pb);
+}
+/** The Python type of a parsed JSON value, which tells a boolean from a number as `type()` does. */
+function pyTypeOf(value) {
+    if (value === null)
+        return "NoneType";
+    if (Array.isArray(value))
+        return "list";
+    if (typeof value === "number")
+        return Number.isInteger(value) ? "int" : "float";
+    return typeof value === "object" ? "dict" : typeof value;
+}
+/**
+ * Python's `==` on two parsed JSON values: numbers and booleans by value (`True == 1`), strings by
+ * text, lists and objects member by member.
+ */
+function pyEquals(a, b) {
+    const x = typeof a === "boolean" ? Number(a) : a;
+    const y = typeof b === "boolean" ? Number(b) : b;
+    if (typeof x !== "object" || typeof y !== "object" || x === null || y === null)
+        return x === y;
+    if (Array.isArray(x) || Array.isArray(y)) {
+        return Array.isArray(x) && Array.isArray(y) && x.length === y.length && x.every((v, i) => pyEquals(v, y[i]));
+    }
+    const keys = Object.keys(x);
+    return (keys.length === Object.keys(y).length && keys.every((k) => Object.hasOwn(y, k) && pyEquals(x[k], y[k])));
+}
+/** Python's `{value!r}` of an integral-or-not `seq` or `v`: the integer when it is integral (`intOr`). */
+function reprIntOr(value) {
+    return pyRepr((intOr(value) ?? null));
+}
+/**
+ * The distinct versions of `values`, as a Python set holds them: two that Python's `==` calls equal
+ * are one (`True` and 1 included), and the first of them stays. A list or an object has no place
+ * in a Python set (Python raises there), and each is kept on its own.
+ */
+function pySetOf(values) {
+    const seen = new Set();
+    const out = [];
+    for (const value of values) {
+        const plain = toPlain(value);
+        const key = plain === null
+            ? "None"
+            : typeof plain === "boolean" || typeof plain === "number"
+                ? `n:${Number(plain) === 0 ? 0 : Number(plain)}`
+                : typeof plain === "string"
+                    ? `s:${plain}`
+                    : null;
+        if (key !== null) {
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+        }
+        out.push(value);
+    }
     return out;
 }
+/**
+ * The order `mixed_entry_versions` lists versions in: numbers in numeric order, and anything else
+ * after them by its Python `repr`, so a boolean beside a string still sorts. The Python
+ * implementation's `_version_order`.
+ */
+function compareVersions(a, b) {
+    const numberOf = (v) => v instanceof RawNumber ? v.value : typeof v === "number" ? v : null;
+    const na = numberOf(a);
+    const nb = numberOf(b);
+    if (na !== null && nb !== null)
+        return na - nb;
+    if (na !== null)
+        return -1;
+    if (nb !== null)
+        return 1;
+    return compareCodePoints(pyRepr(a), pyRepr(b));
+}
 /**
  * The v1 subject for the entry at `seq`, recomputed from the ledger.
  *
- * Throws when `seq` names no entry, or names one whose `event` v1 defines no subject for.
+ * `seq` finds its entry the way a verifier finds it (`subjectIndex`), so the subject is the one the
+ * verifier will check it against. Throws when `seq` names no entry, or names one whose `event` v1
+ * defines no subject for.
  */
 export function envelopeSubject(entries, seq) {
-    const entry = entries.find((e) => toPlain(e["seq"]) === seq);
-    if (entry === undefined)
+    const n = integral(seq);
+    const at = n === null ? undefined : subjectIndex(entries).get(n);
+    if (n === null || at === undefined)
         throw new Error(`no entry at seq ${seq}`);
+    const entry = entries[at];
     const event = toPlain(entry["event"]);
     if (!ENVELOPE_SUBJECT_MEMBERS.has(event)) {
         throw new Error(`envelope v${ENVELOPE_VERSION} defines no subject for event '${event}'`);
@@ -647,8 +803,8 @@ export function envelopeSubject(entries, seq) {
     const subject = {
         chain_id: orNull(entry["chain_id"]),
         node: orNull(entry["node"]),
-        seq,
-        entry_hash: recomputedHashes(entries).get(seq) ?? null,
+        seq: n,
+        entry_hash: recomputedHashes(entries)[at] ?? null,
         event,
     };
     if (event === "allow")
@@ -691,21 +847,21 @@ export function signEnvelope(entries, seq, seed, kid, observed) {
 function witnessPublicKey(kid, value) {
     if (typeof value === "string") {
         if (value.length !== 64) {
-            throw new Error(`witness key '${kid}': public_key_hex must be 64 hex characters (a 32-byte Ed25519 key), ` +
+            throw new Error(`witness key ${pyStrRepr(kid)}: public_key_hex must be 64 hex characters (a 32-byte Ed25519 key), ` +
                 `got ${value.length}`);
         }
         if (!/^[0-9a-fA-F]{64}$/.test(value)) {
-            throw new Error(`witness key '${kid}': public_key_hex is not hexadecimal`);
+            throw new Error(`witness key ${pyStrRepr(kid)}: public_key_hex is not hexadecimal`);
         }
         return Buffer.from(value, "hex");
     }
     if (value instanceof Uint8Array) {
         if (value.length !== 32) {
-            throw new Error(`witness key '${kid}': an Ed25519 public key is 32 bytes, got ${value.length}`);
+            throw new Error(`witness key ${pyStrRepr(kid)}: an Ed25519 public key is 32 bytes, got ${value.length}`);
         }
         return Buffer.from(value);
     }
-    throw new Error(`witness key '${kid}': expected 64 hex characters or 32 bytes`);
+    throw new Error(`witness key ${pyStrRepr(kid)}: expected 64 hex characters or 32 bytes`);
 }
 /**
  * kid -> `[alg, raw public key]`, from the vector file's own `witness_keys` shape or from a plain
@@ -720,27 +876,154 @@ function witnessPublicKey(kid, value) {
  * reported to the caller rather than folded into a finding about the bundle. v1 defines Ed25519
  * and no other algorithm, so a row declaring anything else is refused too.
  */
-function trustedWitnesses(witnessKeys) {
+function trustedWitnesses(witnessKeys, now) {
     const trusted = new Map();
+    const expired = new Map();
+    const seen = new Set();
     if (witnessKeys === null || witnessKeys === undefined)
-        return trusted;
+        return { trusted, expired };
     const rows = Array.isArray(witnessKeys)
         ? witnessKeys.map((k) => [isRecordLike(k) ? k["kid"] : undefined, k])
         : Object.entries(witnessKeys);
     for (const [kid, value] of rows) {
         if (typeof kid !== "string")
             throw new Error("witness key kid must be a string");
+        // One row per kid. The later row used to win, so a row added to expire a key could leave it
+        // trusted, and an expired row beside a live one did.
+        if (seen.has(kid))
+            throw new Error(`witness key ${pyStrRepr(kid)}: more than one row names this kid`);
+        seen.add(kid);
         let key = value;
+        let notAfter = null;
+        let until = null;
         if (isRecordLike(value)) {
+            // Read whole: a row read by projection let a misspelled `notAfter` leave a key that never
+            // expired. In the `{kid: row}` form a row may repeat its kid, and must agree with it.
+            const unknown = Object.keys(value)
+                .filter((m) => !TRUST_ROW_MEMBERS.has(m))
+                .sort(compareCodePoints);
+            if (unknown.length > 0) {
+                throw new Error(`witness key ${pyStrRepr(kid)}: the row carries members this build does not evaluate ` +
+                    `and will not ignore: ${unknown.map(pyStrRepr).join(", ")}`);
+            }
+            if ("kid" in value && value["kid"] !== kid) {
+                throw new Error(`witness key ${pyStrRepr(kid)}: its row names a different kid, ${pyRepr(value["kid"])}`);
+            }
             const alg = value["alg"];
             if (alg !== ENVELOPE_ALG) {
-                throw new Error(`witness key '${kid}': alg must be '${ENVELOPE_ALG}', got ${pyRepr(alg)}`);
+                throw new Error(`witness key ${pyStrRepr(kid)}: alg must be '${ENVELOPE_ALG}', got ${pyRepr(alg)}`);
+            }
+            // Present means checked: `null` is not "no expiry", it is a row that says nothing usable.
+            if (value["not_after"] !== undefined) {
+                until = rfc3339Utc(value["not_after"]);
+                if (until === null) {
+                    throw new Error(`witness key ${pyStrRepr(kid)}: not_after must be an RFC 3339 UTC date-time such as ` +
+                        `'2026-10-05T00:00:00Z', got ${pyRepr(value["not_after"])}`);
+                }
+                notAfter = value["not_after"];
             }
             key = value["public_key_hex"];
         }
-        trusted.set(kid, [ENVELOPE_ALG, witnessPublicKey(kid, key)]);
+        const publicKey = witnessPublicKey(kid, key);
+        if (until !== null && atOrBefore(until, now)) {
+            // Validated in full, then left out. An expired row neither adds its kid nor removes one
+            // that another row trusts; it is remembered so the failure can say the key expired, and
+            // when, instead of reading as a key nobody ever configured.
+            expired.set(kid, notAfter);
+            continue;
+        }
+        trusted.set(kid, [ENVELOPE_ALG, publicKey]);
     }
-    return trusted;
+    return { trusted, expired };
+}
+/**
+ * Every row of a trust set checked as the verifier checks it — kid, alg, public key, `not_after` —
+ * and an `Error` naming the kid for the first bad one. The CLI runs this when it loads a
+ * `--witness-keys` file, so a bad row is reported against that file before any bundle is read.
+ * Expiry is not an error: an expired row is a row the verifier leaves out, not a malformed one.
+ */
+export function validateWitnessKeys(witnessKeys) {
+    trustedWitnesses(witnessKeys, verificationTime(null));
+}
+/** A trust-set row's members. A row is read whole: anything else in it is refused. */
+const TRUST_ROW_MEMBERS = new Set(["kid", "alg", "public_key_hex", "not_after"]);
+/**
+ * RFC 3339 `date-time` in UTC: `YYYY-MM-DDTHH:MM:SS`, an optional fraction, and `Z`. RFC 3339
+ * allows `t` and `z` in lower case, so they are accepted too. A numeric offset, even `+00:00`, is
+ * not: a trust-set row says UTC in the one spelling that cannot be misread as local time. ASCII
+ * digits only. The Python implementation accepts exactly this grammar, so a row one of them
+ * refuses, both refuse.
+ */
+const RFC3339_UTC = /^([0-9]{4})-([0-9]{2})-([0-9]{2})[Tt]([0-9]{2}):([0-9]{2}):([0-9]{2})(?:\.([0-9]+))?[Zz]$/;
+/**
+ * `value` as an instant, or `null` when it is not an RFC 3339 UTC date-time. An out-of-range field
+ * (month 13, February 30, hour 24, second 60) is `null`: there is no leap second here, as there is
+ * none in Python's `datetime`.
+ */
+function rfc3339Utc(value) {
+    const m = typeof value === "string" ? RFC3339_UTC.exec(value) : null;
+    if (m !== null) {
+        const [year, month, day, hour, minute, second] = m.slice(1, 7).map(Number);
+        const leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+        const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1];
+        if (year >= 1 && days !== undefined && day >= 1 && day <= days && hour <= 23 && minute <= 59 && second <= 59) {
+            // `Date.UTC` reads a year below 100 as 19xx; `setUTCFullYear` does not.
+            const at = new Date(0);
+            at.setUTCFullYear(year, month - 1, day);
+            at.setUTCHours(hour, minute, second, 0);
+            return { seconds: at.getTime() / 1000, fraction: (m[7] ?? "").slice(0, 6) };
+        }
+    }
+    return null;
+}
+/**
+ * The verification time: `now` when given — a `Date`, or a string in the `not_after` grammar — and
+ * the current time otherwise.
+ *
+ * A number is refused, never read. The Python implementation takes epoch seconds there; a
+ * JavaScript epoch counts milliseconds, and a number read in the wrong unit moves the verification
+ * time a thousandfold, so this side takes no number at all rather than guess which one it got.
+ */
+function verificationTime(now) {
+    if (now === null || now === undefined)
+        return dateInstant(new Date());
+    if (now instanceof Date && !Number.isNaN(now.getTime()))
+        return dateInstant(now);
+    if (typeof now === "number") {
+        throw new Error("now must be a Date or an RFC 3339 UTC date-time such as '2026-10-05T00:00:00Z', not a " +
+            "number: a JavaScript epoch counts milliseconds and a Python one seconds");
+    }
+    const parsed = typeof now === "string" ? rfc3339Utc(now) : null;
+    if (parsed === null) {
+        throw new Error("now must be a valid Date or an RFC 3339 UTC date-time such as '2026-10-05T00:00:00Z'; got " +
+            (now instanceof Date ? "an invalid Date" : pyRepr(now)));
+    }
+    return parsed;
+}
+function dateInstant(at) {
+    const ms = at.getTime();
+    const seconds = Math.floor(ms / 1000);
+    return { seconds, fraction: String(ms - seconds * 1000).padStart(3, "0") };
+}
+/** `a` is at or before `b`: whole seconds first, then the fraction digits, padded to one length. */
+function atOrBefore(a, b) {
+    if (a.seconds !== b.seconds)
+        return a.seconds < b.seconds;
+    const width = Math.max(a.fraction.length, b.fraction.length);
+    return a.fraction.padEnd(width, "0") <= b.fraction.padEnd(width, "0");
+}
+/**
+ * Python's truthiness for a parsed JSON value, read where the Python implementation writes
+ * `value or default`: absent, null, false, a zero, "", [] and {} are false.
+ */
+function pyFalsy(value) {
+    if (value === undefined || value === null || value === false || value === 0 || value === "")
+        return true;
+    if (Array.isArray(value))
+        return value.length === 0;
+    if (typeof value === "object")
+        return Object.keys(value).length === 0;
+    return false;
 }
 /** A plain object (not an array, not null, not a Buffer). */
 function isRecordLike(v) {
@@ -763,16 +1046,14 @@ function receivedBytes(raw) {
         return Buffer.from(raw);
     return null;
 }
-/**
- * A subject `seq` this build will look an entry up by: a JSON integer, and never a boolean.
- *
- * The type check comes first and every use of `seq` is behind it — in Python an unguarded lookup
- * raises on a list or an object and finds the entry at seq 1 for `true`, and the two
- * implementations report the same failure for the same bundle.
- */
-function isSeq(value) {
-    return typeof value === "number" && Number.isInteger(value);
-}
+// A subject `seq` this build looks an entry up by, and an envelope's `v`, must be an integral
+// number and never a boolean (`integral`, canonical.ts), as the schema's integer type defines:
+// Python's `_is_seq`. `1.0` is 1, and RFC 8785 writes it as 1, so an envelope signed over one
+// verifies as if signed over the other. The type check comes first and every use is behind it — in
+// Python an unguarded lookup raises on a list or an object and finds the entry at seq 1 for
+// `true`, and the two implementations report the same failure for the same bundle. The entries are
+// keyed by the same rule (`subjectIndex`), so an entry whose own seq is `true` or `1.5` is covered
+// by no envelope.
 /**
  * The report line: the state and the result together, in the same form for all three results. A
  * process-asserted entry gets no result.
@@ -794,43 +1075,45 @@ function envelopeLine(state, result) {
  * whoever appends the second decides what the first said, and an entry whose coverage is
  * disputed must not read as clean.
  */
-function scoreEnvelopes(entries, envelopes, trusted, rawBytes) {
+function scoreEnvelopes(entries, envelopes, trust, rawBytes) {
     const fail = new FailureLog();
     const states = {};
     const results = {};
+    const witnesses = {};
     entries.forEach((e, i) => {
-        states[String(orNull(e["seq"]) ?? i)] = PROCESS_ASSERTED;
+        setOwn(states, stateKey(e, i), PROCESS_ASSERTED);
     });
     // The hash walk is what an envelope's binding member is checked against; a bundle carrying
     // none does not pay for it. Every entry is process-asserted in that case, which is the status
     // quo and exactly what this reports.
-    const bySeq = new Map();
-    let recomputed = new Map();
-    if (envelopes.length > 0) {
-        entries.forEach((e, i) => bySeq.set(orNull(e["seq"]) ?? i, e));
-        recomputed = recomputedHashes(entries);
-    }
-    // seq -> how many envelopes in this array named it, valid or not. `scoreEnvelope` counts an
-    // envelope in as soon as its subject names an entry this bundle has.
+    const subjectAt = envelopes.length > 0 ? subjectIndex(entries) : new Map();
+    const recomputed = envelopes.length > 0 ? recomputedHashes(entries) : [];
+    // entry index -> how many envelopes in this array named it, valid or not. `scoreEnvelope` counts
+    // an envelope in as soon as its subject names an entry this bundle has.
     const claims = new Map();
     envelopes.forEach((envelope, index) => {
         const raw = rawBytes !== null && index < rawBytes.length ? rawBytes[index] ?? null : null;
-        const covered = scoreEnvelope(envelope, index, bySeq, recomputed, trusted, raw, fail, claims);
+        const covered = scoreEnvelope(envelope, index, entries, subjectAt, recomputed, trust, raw, fail, claims);
         if (covered === null)
             return;
-        states[String(covered.seq)] = WITNESS_SIGNED;
-        results[String(covered.seq)] = covered.result;
+        // Where `states` files that entry; `witnesses` files it by the index the subject resolved to.
+        const key = stateKey(entries[covered.at], covered.at);
+        setOwn(states, key, WITNESS_SIGNED);
+        setOwn(results, key, covered.result);
+        setOwn(witnesses, String(covered.at), covered.kid);
     });
     // The first envelope's result stands in `results` — it is what that witness said, and the
     // duplicate does not erase it — but the STATE falls back, so a contradicted entry never
-    // reports witness-signed and the bundle rejects.
-    for (const [seq, count] of claims) {
-        if (count > 1)
-            states[seq] = PROCESS_ASSERTED;
+    // reports witness-signed and the bundle rejects; and it leaves `witnesses`.
+    for (const [at, count] of claims) {
+        if (count > 1) {
+            setOwn(states, stateKey(entries[at], at), PROCESS_ASSERTED);
+            delete witnesses[String(at)];
+        }
     }
     const lines = {};
     for (const [seq, state] of Object.entries(states)) {
-        lines[seq] = envelopeLine(state, results[seq] ?? null);
+        setOwn(lines, seq, envelopeLine(state, Object.hasOwn(results, seq) ? results[seq] : null));
     }
     const summary = {
         status: fail.length === 0 ? "verified" : "FAILED",
@@ -841,47 +1124,58 @@ function scoreEnvelopes(entries, envelopes, trusted, rawBytes) {
             .sort((a, b) => a - b),
         states,
         results,
+        witnesses,
         lines,
         failures: [...fail.messages],
     };
     return [summary, fail];
 }
+/**
+ * `record[key] = value` as an own property, whatever the key. A key is an entry's seq rendered as
+ * text, and a bundle chooses its seqs: a plain assignment of `"__proto__"` would reach the
+ * prototype setter and record nothing.
+ */
+function setOwn(record, key, value) {
+    Object.defineProperty(record, key, { value, enumerable: true, configurable: true, writable: true });
+}
 /** Python `repr` for a member set, so both implementations print the same failure strings. */
 function reprList(values) {
-    return `[${values.map((v) => `'${v}'`).join(", ")}]`;
+    return `[${values.map(pyStrRepr).join(", ")}]`;
 }
 /**
  * One envelope, checked in the order the seven named failures are defined in.
  *
- * Returns the covered entry for an envelope that verified, and `null` for one that did not.
- * Every failure is positioned on the entry the envelope COVERS, found by `subject.seq` — the
- * locators are checked against that entry, not used to find it.
+ * Returns the index in `entries` of the entry an envelope that verified covers, and `null` for one
+ * that did not. Every failure is positioned on the entry the envelope COVERS, found by
+ * `subject.seq` through `subjectIndex` — the locators are checked against that entry, not used to
+ * find it.
  *
- * `claims` is the caller's seq -> count of the envelopes that have named each entry so far, and
+ * `claims` is the caller's entry index -> count of the envelopes that have named it so far, and
  * this function updates it. An envelope claims its entry as soon as `subject.seq` finds one,
  * BEFORE the rest of the subject is checked, so a second envelope over an entry an earlier one
  * already named is `envelope_duplicate_subject` whether either of them is otherwise sound: the
  * point of the check is that no one can decide what an earlier witness said by appending after
  * it.
  */
-function scoreEnvelope(envelope, index, bySeq, recomputed, trusted, raw, fail, claims) {
+function scoreEnvelope(envelope, index, entries, subjectAt, recomputed, trust, raw, fail, claims) {
     const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v) && !(v instanceof RawNumber);
     const subject = isRecord(envelope) ? envelope["subject"] : undefined;
     function position() {
         // Every failure is positioned by `subject.seq`, and `subject` is attacker-supplied, so the
         // lookup is guarded: a seq that is not an integer positions nothing, which is honest — it
         // names no entry — and it is never used as a key.
-        const s = isRecord(subject) ? toPlain(subject["seq"]) : null;
-        if (!isSeq(s))
-            return [null, null];
-        const entry = bySeq.get(s);
-        if (entry === undefined)
-            return [s, null];
-        return [orNull(entry["seq"]), orNull(entry["node"])];
+        const s = isRecord(subject) ? integral(subject["seq"]) : null;
+        if (s === null)
+            return [null, null, null];
+        const at = subjectAt.get(s);
+        if (at === undefined)
+            return [s, null, null];
+        const entry = entries[at];
+        return [orNull(entry["seq"]), orNull(entry["node"]), entry];
     }
     function report(reason, detail) {
-        const [seq, node] = position();
-        fail.add(reason, `${reason}: ${detail}`, { seq, node });
+        const [seq, node, entry] = position();
+        fail.add(reason, `${reason}: ${detail}`, { seq, node, entry });
         return null;
     }
     if (!isRecord(envelope)) {
@@ -890,11 +1184,11 @@ function scoreEnvelope(envelope, index, bySeq, recomputed, trusted, raw, fail, c
     }
     // (1) version — a `v` or `typ` this build does not know is a DIFFERENT CONTRACT, and nothing
     // further about it can be read safely.
-    const v = toPlain(envelope["v"]);
+    // The version is read by the seq rule (`integral`): `1.0` is 1, and `true` is not.
     const typ = toPlain(envelope["typ"]);
-    if (v !== ENVELOPE_VERSION || typ !== ENVELOPE_TYP) {
-        return report("envelope_unknown_version", `envelope v=${pyRepr(v)} typ=${pyRepr(typ)}, this build knows v=${ENVELOPE_VERSION} ` +
-            `typ='${ENVELOPE_TYP}'`);
+    if (integral(envelope["v"]) !== ENVELOPE_VERSION || typ !== ENVELOPE_TYP) {
+        return report("envelope_unknown_version", `envelope v=${reprIntOr(envelope["v"])} typ=${pyRepr((envelope["typ"] ?? null))}, ` +
+            `this build knows v=${ENVELOPE_VERSION} typ='${ENVELOPE_TYP}'`);
     }
     // (2) member sets — the version commits the exact signed member set of the whole envelope, so
     // a member added ANYWHERE is a new version that did not declare itself.
@@ -943,30 +1237,31 @@ function scoreEnvelope(envelope, index, bySeq, recomputed, trusted, raw, fail, c
     // (3a) the binding member. `seq` is the lookup key, so there is nothing to compare it against;
     // the entry it finds supplies the hash the subject is checked against. It is also the one
     // subject member used as a KEY, so its type is checked before it is used as one.
-    const subjectSeq = toPlain(subject["seq"]);
-    if (!isSeq(subjectSeq)) {
+    const subjectSeq = integral(subject["seq"]);
+    if (subjectSeq === null) {
         return report("envelope_subject_mismatch", "subject seq is not an integer");
     }
-    const entry = bySeq.get(subjectSeq);
-    if (entry === undefined) {
-        return report("envelope_subject_mismatch", `no entry at seq ${pyRepr(subjectSeq)} in this bundle`);
+    const at = subjectAt.get(subjectSeq);
+    if (at === undefined) {
+        return report("envelope_subject_mismatch", `no entry at seq ${reprIntOr(subject["seq"])} in this bundle`);
     }
-    const seq = orNull(entry["seq"]);
+    const entry = entries[at];
+    // The messages below print an integral seq as its integer, and an entry without one as None.
+    const seq = (intOr(entry["seq"]) ?? null);
     // (3a') one entry, at most one envelope. Counted here, before anything else about this
     // envelope is judged, so the rule cannot be sidestepped by making the second envelope
     // defective in some other way as well.
-    const claimKey = String(seq);
-    const already = claims.get(claimKey) ?? 0;
-    claims.set(claimKey, already + 1);
+    const already = claims.get(at) ?? 0;
+    claims.set(at, already + 1);
     if (already > 0) {
-        return report("envelope_duplicate_subject", `seq ${claimKey} is already covered by an earlier envelope in this bundle; two ` +
+        return report("envelope_duplicate_subject", `seq ${pyStr(seq)} is already covered by an earlier envelope in this bundle; two ` +
             "observations of one event contradict each other by construction, so this entry is not " +
             "witness-signed");
     }
-    const computed = recomputed.get(seq) ?? null;
+    const computed = recomputed[at] ?? null;
     const claimed = toPlain(subject["entry_hash"]);
     if (claimed !== computed) {
-        return report("envelope_subject_mismatch", `subject entry_hash ${pyRepr(claimed)} != the hash recomputed for seq ${String(seq)} from ` +
+        return report("envelope_subject_mismatch", `subject entry_hash ${pyRepr(claimed)} != the hash recomputed for seq ${pyStr(seq)} from ` +
             `this bundle (${pyRepr(computed)})`);
     }
     // (3b) the locators, checked against the SAME entry `seq` found. A matching locator attests
@@ -981,7 +1276,7 @@ function scoreEnvelope(envelope, index, bySeq, recomputed, trusted, raw, fail, c
     for (const [member, actual] of locators) {
         const stated = toPlain(subject[member]);
         if (stated !== actual) {
-            return report("envelope_subject_mismatch", `subject ${member}=${pyRepr(stated)} != ${pyRepr(actual)} on the entry at seq ${String(seq)}`);
+            return report("envelope_subject_mismatch", `subject ${member}=${pyRepr(stated)} != ${pyRepr(actual)} on the entry at seq ${pyStr(seq)}`);
         }
     }
     // (4) canonicality — an invariant SEPARATE from the signature: the received bytes must equal
@@ -1024,10 +1319,15 @@ function scoreEnvelope(envelope, index, bySeq, recomputed, trusted, raw, fail, c
         return report("envelope_unknown_witness", `witness alg=${pyRepr(alg)} is not '${ENVELOPE_ALG}'; envelope v${ENVELOPE_VERSION} ` +
             "defines Ed25519 and no other algorithm");
     }
-    const known = trusted.get(kid);
+    const known = trust.trusted.get(kid);
     if (known === undefined) {
+        // A kid whose rows have all expired is not in the trust set, so it is the same failure as any
+        // other untrusted kid. The message keeps that wording first and then says why, because "not
+        // trusted" and "trusted until a date that has passed" call for different fixes.
+        const lapsed = trust.expired.get(kid);
         return report("envelope_unknown_witness", `witness kid=${pyRepr(kid)} alg=${pyRepr(alg)} is not in the trusted witness keys ` +
-            `(${reprList(sortedStrings(trusted.keys()))})`);
+            `(${reprList(sortedStrings(trust.trusted.keys()))})` +
+            (lapsed === undefined ? "" : `: the key expired at not_after=${pyRepr(lapsed)}`));
     }
     // (6) the signature, over JCS(envelope minus "sig").
     const sigHex = toPlain(envelope["sig"]);
@@ -1060,17 +1360,22 @@ function scoreEnvelope(envelope, index, bySeq, recomputed, trusted, raw, fail, c
     }
     if (nonCanonical)
         return null;
-    return { seq, node: orNull(entry["node"]), result: toPlain(envelope["observed"]["result"]) };
+    return { at, node: orNull(entry["node"]), result: toPlain(envelope["observed"]["result"]), kid };
 }
 /**
  * Score a bundle's observer envelopes on their own, without the ledger checks.
  *
- * Returns `{ok, ...summary, failure_details}`. `states` maps every entry's seq to
- * `witness-signed` or `process-asserted`; `lines` is the report line for each.
+ * Returns `{ok, ...summary, failure_details, failure_entries}`. `states` maps every entry's seq to
+ * `witness-signed` or `process-asserted`; `lines` is the report line for each. `results` maps a
+ * covered seq to the verifying envelope's `observed.result`. `witnesses` maps the index in
+ * `bundle.entries` of every witness-signed entry to that envelope's `witness.kid`: the entry the
+ * subject resolved to, the one `failure_entries` names, so of two entries sharing a seq only the
+ * one the witness signed is in it.
  */
 export function verifyEnvelopes(bundle, options = {}) {
-    const [summary, fail] = scoreEnvelopes(bundle.entries ?? [], bundle.envelopes ?? [], trustedWitnesses(options.witnessKeys ?? null), options.envelopeBytes ?? null);
-    return { ok: fail.length === 0, ...summary, failure_details: fail.details };
+    const entries = bundle.entries ?? [];
+    const [summary, fail] = scoreEnvelopes(entries, bundle.envelopes ?? [], trustedWitnesses(options.witnessKeys ?? null, verificationTime(options.now)), options.envelopeBytes ?? null);
+    return { ok: fail.length === 0, ...summary, failure_details: fail.details, failure_entries: fail.entryIndices(entries) };
 }
 // =============================================================================================
 // Execution binding (0.9.0): offline checks over callId/allow/outcome, from the ledger alone —
@@ -1159,7 +1464,7 @@ function validateAllow(e) {
     for (const k of ["module", "version", "hook_path"]) {
         const v = adapter[k];
         if (typeof v !== "string" || !v) {
-            return `adapter[${JSON.stringify(k)}] must be a non-empty string`;
+            return `adapter[${pyStrRepr(k)}] must be a non-empty string`;
         }
     }
     if (presentButNull(e, "policy")) {
@@ -1187,7 +1492,7 @@ function validateDeny(e) {
         return err;
     const leaked = ALLOW_ONLY_FIELDS.filter((f) => f in e).sort();
     if (leaked.length > 0) {
-        return `deny carries allow-only field(s) ${JSON.stringify(leaked)}`;
+        return `deny carries allow-only field(s) ${reprList(leaked)}`;
     }
     return null;
 }
@@ -1235,7 +1540,7 @@ function validateOutcome(e) {
         for (const k of ["type", "ref"]) {
             const v = receipt[k];
             if (typeof v !== "string" || !v) {
-                return `receipt[${JSON.stringify(k)}] must be a non-empty string`;
+                return `receipt[${pyStrRepr(k)}] must be a non-empty string`;
             }
         }
         const digest = receipt["digest"];
@@ -1352,19 +1657,19 @@ function policyFailures(entries, bundleV) {
         if (!("policy" in e))
             continue;
         const ev = toPlain(e["event"]);
-        const position = { seq: orNull(e["seq"]), node: orNull(e["node"]) };
+        const position = { seq: orNull(e["seq"]), node: orNull(e["node"]), entry: e };
         if (ev === "allow") {
             if (bundleV === 2)
                 continue; // validateAllow owns this entry's message
             if (!isKnownPolicy(toPlain(e["policy"]))) {
-                failures.add("invalid_policy", `invalid_policy: seq=${pyStr(orNull(e["seq"]))} allow carries policy ` +
-                    `${pyRepr(orNull(e["policy"]))}, not a value this format defines`, position);
+                failures.add("invalid_policy", `invalid_policy: seq=${shown(intOr(e["seq"]))} allow carries policy ` +
+                    `${pyRepr(e["policy"] ?? null)}, not a value this format defines`, position);
             }
         }
         else {
             if (ev === "deny" && bundleV === 2)
                 continue; // validateDeny owns this entry's message
-            failures.add("policy_on_non_allow", `policy_on_non_allow: seq=${pyStr(orNull(e["seq"]))} event=${pyRepr(orNull(e["event"]))} ` +
+            failures.add("policy_on_non_allow", `policy_on_non_allow: seq=${shown(intOr(e["seq"]))} event=${pyRepr(e["event"] ?? null)} ` +
                 "carries `policy`, which is an allow-only field", position);
         }
     }
@@ -1375,8 +1680,8 @@ function v2FieldLeaksOnV1(entries) {
     for (const e of entries) {
         const leaked = V2_ONLY_FIELDS.filter((f) => f in e).sort();
         if (leaked.length > 0) {
-            failures.add("v2_field_on_v1", `v2_field_on_v1: seq=${pyRepr(toPlain(e["seq"]))} event=${pyRepr(toPlain(e["event"]))} ` +
-                `carries v2-only field(s) ${JSON.stringify(leaked)} on a schemaVersion: 1 entry`, { seq: orNull(e["seq"]), node: orNull(e["node"]) });
+            failures.add("v2_field_on_v1", `v2_field_on_v1: seq=${shown(intOr(e["seq"]))} event=${pyRepr(e["event"] ?? null)} ` +
+                `carries v2-only field(s) ${reprList(leaked)} on a schema_version=1 entry`, { seq: orNull(e["seq"]), node: orNull(e["node"]), entry: e });
         }
     }
     return failures;
@@ -1396,7 +1701,8 @@ function executionBinding(entries, bundleV) {
     if (bundleV !== 2)
         return [{ status: "not applicable" }, new FailureLog()];
     const failures = new FailureLog();
-    const seenCallIds = new Map(); // callId -> [event, node, seq]
+    // callId -> [event, node, the entry's own seq value as the bundle wrote it]
+    const seenCallIds = new Map();
     const allows = new Map();
     const outcomes = new Map();
     const invalidAllowIds = new Set();
@@ -1405,16 +1711,18 @@ function executionBinding(entries, bundleV) {
     const revokedNodes = new Set();
     for (const e of entries) {
         const ev = toPlain(e["event"]);
-        const node = toPlain(e["node"]);
-        const seqForEvent = toPlain(e["seq"]);
+        const raw = toPlain(e["node"]);
+        // A node id is a string; anything else names no node, here as in the Python implementation.
+        const node = typeof raw === "string" ? raw : null;
         if (ev === "root") {
             if (node !== null)
                 nodes.add(node);
             const err = validateRoot(e);
             if (err) {
-                failures.add("invalid_root", `invalid_root: ${err} (seq ${pyRepr(seqForEvent)})`, {
+                failures.add("invalid_root", `invalid_root: ${err} (seq ${shown(intOr(e["seq"]))})`, {
                     seq: orNull(e["seq"]),
                     node: orNull(e["node"]),
+                    entry: e,
                 });
             }
         }
@@ -1427,37 +1735,40 @@ function executionBinding(entries, bundleV) {
                 finalizedNodes.add(node);
         }
         else if (ev === "kill") {
-            for (const r of toPlain(e["revoked"]) ?? [])
+            const killed = new Map();
+            noteRevoked(e, killed);
+            for (const r of killed.keys())
                 revokedNodes.add(r);
             const err = validateKill(e);
             if (err) {
-                failures.add("invalid_kill", `invalid_kill: ${err} (seq ${pyRepr(seqForEvent)})`, {
+                failures.add("invalid_kill", `invalid_kill: ${err} (seq ${shown(intOr(e["seq"]))})`, {
                     seq: orNull(e["seq"]),
                     node: orNull(e["node"]),
+                    entry: e,
                 });
             }
         }
         if (ev === "allow" || ev === "deny") {
             const cid = toPlain(e["call_id"]);
-            const seq = toPlain(e["seq"]);
             if (cid !== null && cid !== undefined) {
                 const prior = seenCallIds.get(cid);
                 if (prior !== undefined) {
                     // Positioned on the SECOND sighting: the entry that re-used a call_id is the offending
                     // record, the first one having been legitimate when it was written.
-                    failures.add("duplicate_call_id", `duplicate_call_id: call_id ${cid} on seq ${pyRepr(seq)} (${ev}) already used at seq ` +
-                        `${pyRepr(prior[2])} (${prior[0]})`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: cid });
+                    failures.add("duplicate_call_id", `duplicate_call_id: call_id ${shown(e["call_id"])} on seq ${shown(intOr(e["seq"]))} (${ev}) already used at seq ` +
+                        `${shown(intOr(prior[2]))} (${prior[0]})`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: cid, entry: e });
                 }
                 else {
-                    seenCallIds.set(cid, [ev, node, seq]);
+                    seenCallIds.set(cid, [ev, node, e["seq"] ?? null]);
                 }
             }
             const err = ev === "allow" ? validateAllow(e) : validateDeny(e);
             if (err) {
-                failures.add(`invalid_${ev}`, `invalid_${ev}: ${err} (seq ${pyRepr(seq)})`, {
+                failures.add(`invalid_${ev}`, `invalid_${ev}: ${err} (seq ${shown(intOr(e["seq"]))})`, {
                     seq: orNull(e["seq"]),
                     node: orNull(e["node"]),
                     callId: cid ?? null,
+                    entry: e,
                 });
                 if (ev === "allow" && cid !== null && cid !== undefined)
                     invalidAllowIds.add(cid);
@@ -1468,19 +1779,19 @@ function executionBinding(entries, bundleV) {
         }
         else if (ev === "outcome") {
             const cid = toPlain(e["call_id"]);
-            const seq = toPlain(e["seq"]);
             const err = validateOutcome(e);
             if (err) {
-                failures.add("invalid_outcome", `invalid_outcome: ${err} (seq ${pyRepr(seq)})`, {
+                failures.add("invalid_outcome", `invalid_outcome: ${err} (seq ${shown(intOr(e["seq"]))})`, {
                     seq: orNull(e["seq"]),
                     node: orNull(e["node"]),
                     callId: cid ?? null,
+                    entry: e,
                 });
                 continue;
             }
             if (cid !== null && outcomes.has(cid)) {
-                failures.add("duplicate_outcome", `duplicate_outcome: call_id ${cid} at seq ${pyRepr(seq)} (first at seq ` +
-                    `${pyRepr(toPlain(outcomes.get(cid)["seq"]))})`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: cid });
+                failures.add("duplicate_outcome", `duplicate_outcome: call_id ${shown(e["call_id"])} at seq ${shown(intOr(e["seq"]))} (first at seq ` +
+                    `${shown(intOr(outcomes.get(cid)["seq"]))})`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: cid, entry: e });
                 continue;
             }
             if (cid !== null)
@@ -1501,25 +1812,26 @@ function executionBinding(entries, bundleV) {
     for (const [cid, oc] of outcomes) {
         const allowE = allows.get(cid);
         if (allowE === undefined) {
-            failures.add("outcome_without_allow", `outcome_without_allow: call_id ${cid} at seq ${pyRepr(toPlain(oc["seq"]))} has no allow in this chain`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
+            failures.add("outcome_without_allow", `outcome_without_allow: call_id ${shown(oc["call_id"])} at seq ${shown(intOr(oc["seq"]))} has no allow in this chain`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid, entry: oc });
             continue;
         }
         const nodeOk = toPlain(allowE["node"]) === toPlain(oc["node"]);
         if (!nodeOk) {
-            failures.add("cross_ref", `cross_ref: call_id ${cid} allow on node ${pyRepr(toPlain(allowE["node"]))} but ` +
-                `outcome on node ${pyRepr(toPlain(oc["node"]))}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
+            failures.add("cross_ref", `cross_ref: call_id ${shown(oc["call_id"])} allow on node ${pyRepr(allowE["node"] ?? null)} but ` +
+                `outcome on node ${pyRepr(oc["node"] ?? null)}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid, entry: oc });
         }
         const ocSeq = toPlain(oc["seq"]);
         const allowSeq = toPlain(allowE["seq"]);
         const orderOk = typeof ocSeq === "number" && typeof allowSeq === "number" && ocSeq > allowSeq;
         if (!orderOk) {
-            failures.add("outcome_before_allow", `outcome_before_allow: call_id ${cid} outcome seq ${pyRepr(ocSeq ?? null)} not ` +
-                `after allow seq ${pyRepr(allowSeq ?? null)}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
+            failures.add("outcome_before_allow", `outcome_before_allow: call_id ${shown(oc["call_id"])} outcome seq ${shown(intOr(oc["seq"]))} not ` +
+                `after allow seq ${shown(intOr(allowE["seq"]))}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid, entry: oc });
         }
         const ah = toPlain(allowE["authorized_params_hash"]);
         const ih = toPlain(oc["invoked_params_hash"]);
         if (ah !== null && ah !== undefined && ih !== null && ih !== undefined && ah !== ih) {
-            failures.add("params_mismatch", `params_mismatch: call_id ${cid} authorized_params_hash ${ah} != invoked_params_hash ${ih}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid });
+            failures.add("params_mismatch", `params_mismatch: call_id ${shown(oc["call_id"])} authorized_params_hash ` +
+                `${shown(allowE["authorized_params_hash"])} != invoked_params_hash ${shown(oc["invoked_params_hash"])}`, { seq: orNull(oc["seq"]), node: orNull(oc["node"]), callId: cid, entry: oc });
         }
         if (nodeOk && orderOk)
             boundOk.add(cid);
@@ -1545,7 +1857,8 @@ function executionBinding(entries, bundleV) {
         }
         else {
             perCall[cid] = "unaccounted";
-            const node = toPlain(allowE["node"]);
+            const raw = toPlain(allowE["node"]);
+            const node = typeof raw === "string" ? raw : null;
             const list = nodePending.get(node) ?? [];
             list.push(cid);
             nodePending.set(node, list);
@@ -1601,16 +1914,16 @@ function executionBinding(entries, bundleV) {
     ];
 }
 /**
- * `[seq, node]` of the FIRST entry the hash chain does not reproduce at — position only.
+ * The index of the FIRST entry the hash chain does not reproduce at — position only.
  *
  * `AuditLog.verify` stays the authority on WHETHER the chain is broken and on the message this
  * module reports; this walk exists so the structured twin of that message can say WHERE, which
  * the message's own text does not expose in a parseable form. Mirrors `AuditLog.verify`'s walk
- * exactly (same seq/prev_hash/hash order). `[null, null]` when nothing entry-local is wrong — a
- * consistently re-hashed ledger fails against the signed anchor, not here, and that failure is
- * chain-level.
+ * exactly (same seq/prev_hash/hash order, and the same rule that a seq is an integral number and
+ * never a boolean, `integral`). `null` when nothing entry-local is wrong — a consistently
+ * re-hashed ledger fails against the signed anchor, not here, and that failure is chain-level.
  */
-function integrityPosition(entries) {
+export function integrityBreak(entries) {
     let prev = GENESIS;
     for (let i = 0; i < entries.length; i++) {
         const e = entries[i];
@@ -1622,19 +1935,19 @@ function integrityPosition(entries) {
         let broken;
         try {
             broken =
-                orNull(e["seq"]) !== i ||
+                integral(e["seq"]) !== i ||
                     orNull(payload["prev_hash"]) !== prev ||
                     hashEntry(prev, payload) !== orNull(e["hash"]);
         }
         catch {
             // An unhashable payload is itself the break, at this entry.
-            return [orNull(e["seq"]), orNull(e["node"])];
+            return i;
         }
         if (broken)
-            return [orNull(e["seq"]), orNull(e["node"])];
+            return i;
         prev = orNull(e["hash"]);
     }
-    return [null, null];
+    return null;
 }
 export function verifyBundle(bundle, signer = null, options = {}) {
     const entries = bundle.entries ?? [];
@@ -1654,17 +1967,18 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     };
     const log = new FailureLog();
     // (0) version: the bundle must declare a schema version this build understands, and — when
-    // an anchor is present — the anchor must be anchoring THAT version, not a different one.
-    const bundleV = toPlain(bundle.v);
-    let versionOk = typeof bundleV === "number" && SUPPORTED_BUNDLE_VERSIONS.has(bundleV);
+    // an anchor is present — the anchor must be anchoring THAT version, not a different one. A
+    // version is read by the seq rule (`integral`): `2.0` is 2, and `true` is not.
+    const rawV = bundle.v;
+    const bundleV = integral(rawV);
+    let versionOk = bundleV !== null && SUPPORTED_BUNDLE_VERSIONS.has(bundleV);
     if (!versionOk) {
         const supported = Array.from(SUPPORTED_BUNDLE_VERSIONS).sort((a, b) => a - b);
-        log.add("unsupported_version", `unsupported_version: bundle v=${pyRepr(bundleV)} not in [${supported.join(", ")}]`);
+        log.add("unsupported_version", `unsupported_version: bundle v=${reprIntOr(rawV)} not in [${supported.join(", ")}]`);
     }
-    const anchorV = toPlain(anchor["v"]);
-    if (anchorPresent && anchorV !== bundleV) {
+    if (anchorPresent && !sameNumber(anchor["v"], rawV)) {
         versionOk = false;
-        log.add("anchor_version_mismatch", `anchor_version_mismatch: anchor v=${pyRepr(anchorV)} != bundle v=${pyRepr(bundleV)}`);
+        log.add("anchor_version_mismatch", `anchor_version_mismatch: anchor v=${reprIntOr(anchor["v"])} != bundle v=${reprIntOr(rawV)}`);
     }
     // (0a) exactly one root: a rootless bundle (or one splicing in a second root) would otherwise
     // sail through monotonicity/containment trivially — there is nothing to anchor those checks to.
@@ -1676,17 +1990,19 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     const rootEntry = rootEvents.length === 1 ? rootEvents[0] : undefined;
     // 0.9.0: a chain is created at ONE schema version and never mixes (spec section 9) — the root
     // entry's v must equal the bundle's declared v, and no OTHER entry may carry a different v.
-    if (rootEntry !== undefined && toPlain(rootEntry["v"]) !== bundleV) {
+    if (rootEntry !== undefined && !sameNumber(rootEntry["v"], rawV)) {
         versionOk = false;
-        log.add("root_version_mismatch", `root_version_mismatch: root v=${pyRepr(toPlain(rootEntry["v"]))} != bundle v=${pyRepr(bundleV)}`, { seq: orNull(rootEntry["seq"]), node: orNull(rootEntry["node"]) });
+        log.add("root_version_mismatch", `root_version_mismatch: root v=${reprIntOr(rootEntry["v"])} != bundle v=${reprIntOr(rawV)}`, { seq: orNull(rootEntry["seq"]), node: orNull(rootEntry["node"]), entry: rootEntry });
     }
-    const mixedEntries = entries.filter((e) => toPlain(e["v"]) !== bundleV);
-    const mixed = Array.from(new Set(mixedEntries.map((e) => toPlain(e["v"])))).sort((a, b) => (typeof a === "number" && typeof b === "number" ? a - b : String(a).localeCompare(String(b))));
+    const mixedEntries = entries.filter((e) => !sameNumber(e["v"], rawV));
+    // An entry without `v` is Python's None in the list. Numbers come first in numeric order, then
+    // everything else by its repr, compared by code point as Python compares strings, never by locale.
+    const mixed = pySetOf(mixedEntries.map((e) => (intOr(e["v"]) ?? null))).sort(compareVersions);
     if (mixed.length > 0) {
         versionOk = false;
         // One aggregate message over every offending entry (unchanged); the twin is positioned on
         // the first of them, which is where a reader looks.
-        log.add("mixed_entry_versions", `mixed_entry_versions: entries declare v in [${mixed.map((v) => pyRepr(v)).join(", ")}], bundle v=${pyRepr(bundleV)}`, { seq: orNull(mixedEntries[0]["seq"]), node: orNull(mixedEntries[0]["node"]) });
+        log.add("mixed_entry_versions", `mixed_entry_versions: entries declare v in [${mixed.map((v) => pyRepr(v)).join(", ")}], bundle v=${reprIntOr(rawV)}`, { seq: orNull(mixedEntries[0]["seq"]), node: orNull(mixedEntries[0]["node"]), entry: mixedEntries[0] });
     }
     checks.version = versionOk;
     // (0b2) every entry must be read WHOLE. `LEDGER_FIELDS` was enforced only on the EXPORT path
@@ -1712,10 +2028,24 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         if (extra.length > 0) {
             unknownOk = false;
             log.add("unknown_ledger_fields", `unknown_ledger_fields: entry carries fields this verifier does not evaluate and will ` +
-                `not ignore: ${extra.join(", ")}`, { seq: orNull(e["seq"]), node: orNull(e["node"]) });
+                `not ignore: ${extra.map((f) => shown(f)).join(", ")}`, { seq: orNull(e["seq"]), node: orNull(e["node"]), entry: e });
         }
     }
     checks.ledger_fields = unknownOk;
+    // (0b3) a node id is a string (the schema's `node`). A root, a spawn and an allow are judged by
+    // the checks that read their node, below; any other entry that carries a node which is a list,
+    // an object, a number or a boolean is reported here, never read by projection and never used as
+    // a key. A null node counts as absent.
+    for (const e of entries) {
+        const ev = toPlain(e["event"]);
+        if (ev === "root" || ev === "spawn" || ev === "allow")
+            continue;
+        const node = toPlain(e["node"]);
+        if (node === undefined || node === null || typeof node === "string")
+            continue;
+        log.add("invalid_node", `invalid_node: seq=${shown(intOr(e["seq"]))} event=${pyRepr((e["event"] ?? null))} ` +
+            `carries node ${shown(e["node"])}, which is not a string`, { seq: orNull(e["seq"]), node: orNull(e["node"]), entry: e });
+    }
     // (0c) independently retained expected anchor/head: verified against the BUNDLE's actual
     // computed head, never against its own (possibly forged) enclosed anchor.
     const { expectedAnchor = null, expectedHead = null } = options;
@@ -1727,7 +2057,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
             const [expSeq, expHash] = expectedHead;
             if (actualSeq !== expSeq || actualHead !== expHash) {
                 expectedOk = false;
-                log.add("expected_head_mismatch", `expected_head_mismatch: bundle head is (seq=${actualSeq}, hash=${actualHead}) but the ` +
+                log.add("expected_head_mismatch", `expected_head_mismatch: bundle head is (seq=${actualSeq}, hash=${shown(actualHead)}) but the ` +
                     `independently retained expected head is (seq=${expSeq}, hash=${expHash})`);
             }
         }
@@ -1736,7 +2066,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
             if (toPlain(ea["seq"]) !== actualSeq ||
                 toPlain(ea["head"]) !== actualHead ||
                 toPlain(ea["chain_id"]) !== toPlain(bundle.chain_id) ||
-                toPlain(ea["v"]) !== bundleV) {
+                !sameNumber(ea["v"], rawV)) {
                 expectedOk = false;
                 log.add("expected_anchor_mismatch", "expected_anchor_mismatch: the bundle's actual (seq, head, chainId, v) does not match " +
                     "the independently retained expected anchor");
@@ -1754,6 +2084,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         log.add("chain_id_mismatch", `chain_id_mismatch: an entry does not carry chain_id=${pyRepr(bundleChainId)}`, {
             seq: orNull(foreign["seq"]),
             node: orNull(foreign["node"]),
+            entry: foreign,
         });
     }
     const anchorChainId = orNull(anchor["chain_id"]);
@@ -1765,8 +2096,13 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     // (1) integrity: the hash chain, plus the signed anchor when a key is given.
     const [okChain, err] = AuditLog.verify(entries);
     if (!okChain) {
-        const [badSeq, badNode] = integrityPosition(entries);
-        log.add("integrity", `integrity: ${err}`, { seq: badSeq, node: badNode });
+        const bad = integrityBreak(entries);
+        const badEntry = bad === null ? null : entries[bad];
+        log.add("integrity", `integrity: ${err}`, {
+            seq: badEntry === null ? null : orNull(badEntry["seq"]),
+            node: badEntry === null ? null : orNull(badEntry["node"]),
+            entry: badEntry,
+        });
     }
     if (signer !== null) {
         const [okAnchor, aerr] = AuditLog.verifyAnchor(entries, anchor, signer);
@@ -1780,24 +2116,62 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     else {
         checks.integrity = okChain;
     }
-    const { auth, parent, failures: afail, definedBy } = nodeAuthorities(entries);
+    const { auth, failures: afail } = nodeAuthorities(entries);
     log.extend(afail);
-    // (2) monotonicity: every child ⊆ its parent.
+    // (2) monotonicity: every child ⊆ its parent, read in ledger order. Every spawn is checked, and
+    // the node it names as `parent` has to be one the root or an EARLIER spawn defined, not revoked
+    // by an earlier kill, and not the spawn's own node. Through 0.12.0 a spawn whose parent was
+    // absent, null, or named no node in the bundle was skipped, so a child widened past the
+    // authority it was really given verified OK; the process being watched writes that field. A
+    // node is defined once: a second definition is a failure too, since only one of the two could
+    // be read. The Python implementation's same pass, finding for finding.
     let mono = true;
-    for (const [node, pid] of parent) {
-        if (pid === null || !auth.has(pid) || !auth.has(node))
+    const definedAt = new Map(); // node -> the entry that defined it, as of this point
+    const revokedAt = new Map(); // node -> the seq of the kill that revoked it
+    for (const e of entries) {
+        const ev = toPlain(e["event"]);
+        if (ev === "kill") {
+            noteRevoked(e, revokedAt);
+            continue;
+        }
+        if (ev !== "root" && ev !== "spawn")
             continue;
-        const child = auth.get(node);
-        const p = auth.get(pid);
-        // 0.6.x: the subsumption relation ALONE decides. This used to be gated on a literal,
-        // non-wildcard-aware scope difference, which silently accepted a delegation that widened
-        // only ttl or a ceiling whenever the child's scopes happened to be literally a subset of
-        // the parent's — the child was more powerful and the bundle verified clean.
-        if (!child.isNarrowerThan(p)) {
+        const node = toPlain(e["node"]);
+        if (typeof node !== "string")
+            continue; // unreadable, reported by nodeAuthorities
+        const position = { seq: orNull(e["seq"]), node, entry: e };
+        const first = definedAt.get(node);
+        if (first !== undefined) {
             mono = false;
-            const spawnE = definedBy.get(node);
-            log.add("monotonicity", `monotonicity: ${node} not ⊆ parent ${pid} (${monotonicityDetail(child, p)})`, { seq: spawnE === undefined ? null : orNull(spawnE["seq"]), node });
+            log.add("monotonicity", `monotonicity: ${shown(node)} is defined a second time in this bundle (first at seq ${shown(intOr(first["seq"]))})`, position);
+            continue;
+        }
+        if (ev === "spawn") {
+            const pid = toPlain(e["parent"]);
+            if (typeof pid !== "string" || !definedAt.has(pid)) {
+                mono = false;
+                log.add("monotonicity", `monotonicity: ${shown(node)} names no parent defined earlier in this bundle (parent ${shown(e["parent"])})`, position);
+            }
+            else if (revokedAt.has(pid)) {
+                mono = false;
+                log.add("monotonicity", `monotonicity: ${shown(node)} is spawned from ${shown(pid)} after ${shown(pid)} was revoked at seq ` +
+                    shown(intOr(revokedAt.get(pid))), position);
+            }
+            else {
+                // 0.6.x: the subsumption relation ALONE decides. This used to be gated on a literal,
+                // non-wildcard-aware scope difference, which silently accepted a delegation that widened
+                // only ttl or a ceiling whenever the child's scopes happened to be literally a subset of
+                // the parent's. An unreadable authority on either side is reported by nodeAuthorities
+                // and fails this check on its own.
+                const child = auth.get(node);
+                const p = auth.get(pid);
+                if (child !== undefined && p !== undefined && !child.isNarrowerThan(p)) {
+                    mono = false;
+                    log.add("monotonicity", `monotonicity: ${shown(node)} not ⊆ parent ${shown(pid)} (${monotonicityDetail(child, p)})`, position);
+                }
+            }
         }
+        definedAt.set(node, e);
     }
     checks.monotonicity = mono && afail.length === 0;
     // (3) containment: every allowed action's scope within the acting node's authority.
@@ -1807,11 +2181,27 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     // a violation the entry never asserted. Such entries are counted as UNGATED and reported as
     // their own number instead: a reader sees how much of the run was actually measured, which is
     // the honest answer and never a silent one.
+    // Read in ledger order, like monotonicity: an allow is judged against a node defined EARLIER (one
+    // defined only later is unknown at that point), and an allow on a node an earlier kill revoked
+    // is outside its authority, since a revoked node holds none.
     let contained = true;
     let actions = 0;
     let ungated = 0;
+    const known = new Set();
+    const killedAt = new Map();
     for (const e of entries) {
-        if (toPlain(e["event"]) !== "allow")
+        const ev = toPlain(e["event"]);
+        if (ev === "root" || ev === "spawn") {
+            const defined = toPlain(e["node"]);
+            if (typeof defined === "string")
+                known.add(defined);
+            continue;
+        }
+        if (ev === "kill") {
+            noteRevoked(e, killedAt);
+            continue;
+        }
+        if (ev !== "allow")
             continue;
         if (isKnownPolicy(toPlain(e["policy"]))) {
             // Only a policy value the format DEFINES buys the exemption. An entry carrying anything
@@ -1823,21 +2213,39 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         actions += 1;
         const node = toPlain(e["node"]);
         const scope = toPlain(e["scope"]);
-        const ctx = toPlain(e["context"]) ?? {};
-        const a = auth.get(node);
+        // The Python implementation reads `e.get("context") or {}`, so an absent context and any value
+        // Python counts as false (null, false, 0, "", [] or {}) are no context. Any other value that
+        // is not an object is not a context the allow could have been checked against, and it does not
+        // verify: it is the containment finding below. (Python 0.19.0 raises on it.)
+        const rawContext = toPlain(e["context"]);
+        const noContext = pyFalsy(rawContext);
+        const contextIsObject = isRecordLike(rawContext);
+        const ctx = (noContext ? {} : rawContext);
+        const a = typeof node === "string" && known.has(node) ? auth.get(node) : undefined;
         if (a === undefined) {
             contained = false;
-            log.add("containment", `containment: allow on unknown node ${node}`, {
+            log.add("containment", `containment: allow on unknown node ${shown(e["node"])}`, {
                 seq: orNull(e["seq"]),
                 node: orNull(e["node"]),
                 callId: orNull(e["call_id"]),
+                entry: e,
             });
             continue;
         }
-        if (!a.permits(scope, ctx).allowed) {
+        if (killedAt.has(node)) {
+            contained = false;
+            log.add("containment", `containment: allow of ${pyRepr(e["scope"] ?? null)} on ${shown(e["node"])} after ${shown(e["node"])} was ` +
+                `revoked at seq ${shown(intOr(killedAt.get(node)))}`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: orNull(e["call_id"]), entry: e });
+            continue;
+        }
+        // A scope that is not a string is no scope the node can hold. Against a wildcard it threw
+        // (`startsWith` on a number or null) out of the verifier; it is this finding either way, as
+        // in the Python implementation. A context that is neither absent, nor false to Python, nor an
+        // object is this finding too.
+        if (typeof scope !== "string" || !(noContext || contextIsObject) || !a.permits(scope, ctx).allowed) {
             contained = false;
-            log.add("containment", `containment: allow of '${scope}' on ${node} outside its authority ` +
-                `[${Array.from(a.scopes).sort(compareCodePoints).map((s) => `'${s}'`).join(", ")}]`, { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: orNull(e["call_id"]) });
+            log.add("containment", `containment: allow of ${pyRepr(e["scope"] ?? null)} on ${shown(e["node"])} outside its authority ` +
+                reprList(Array.from(a.scopes).sort(compareCodePoints)), { seq: orNull(e["seq"]), node: orNull(e["node"]), callId: orNull(e["call_id"]), entry: e });
         }
     }
     checks.containment = contained;
@@ -1851,7 +2259,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
     // nothing — but a PRESENT one has to verify, and a broken one lands in this same list. The
     // per-entry state is reported either way, so a reader sees which hops were covered before
     // reading which one failed.
-    const [envelopeSummary, envelopeFailures] = scoreEnvelopes(entries, bundle.envelopes ?? [], trustedWitnesses(options.witnessKeys ?? null), options.envelopeBytes ?? null);
+    const [envelopeSummary, envelopeFailures] = scoreEnvelopes(entries, bundle.envelopes ?? [], trustedWitnesses(options.witnessKeys ?? null, verificationTime(options.now)), options.envelopeBytes ?? null);
     if (bundle.envelopes === undefined) {
         envelopeSummary.status = "not present";
     }
@@ -1875,6 +2283,7 @@ export function verifyBundle(bundle, signer = null, options = {}) {
         checks,
         failures: log.messages,
         failure_details: log.details,
+        failure_entries: log.entryIndices(entries),
         nodes: auth.size,
         actions_checked: actions,
         ungated,