[skip-docs]
PM addendum 5 to order 20260902T151931Z-250257273, reported at the close of B4
and deliberately left unfixed there as outside that order.
evidence_for(path, key="sources") raised ValueError. The tier was derived
unconditionally through trust_tier, which refuses an entry that names no `by`
actor -- correctly, because a trust level derived from an entry identifying
nobody mints the provenance it claims to read. But `by` is required of a
VERIFICATION entry (SPEC 5.2), not of every provenance key: the agreed
segmented form carries segment_id/source_offset and a sources list carries
id/resource. The guard belonging to one key was being applied to all of them.
trust_tier is UNCHANGED. evidence_for stops applying it to keys it was never
about: _TIERED_KEY names the one key SPEC 5.3 tiers, and every other key comes
back with state / reason / items_seen / entries and tier=None.
admits_falsification moved WITH it, and that is the same fact rather than
scope: it read `tier != "unverified"`, and None != "unverified" is TRUE, so a
present `sources` list would have cleared a threshold about verification. It
now names the tiers that clear it. For every value reachable before this change
both spellings are identical, which is why the existing K5 arms stay green.
Measured, and it corrected the test: an actorless `verified` value never
reaches trust_tier through evidence_for at all -- the decoder refuses that shape
first as unreadable / unsupported-flow. Both guards are now asserted where each
actually lives instead of one asserted where it is not.
Load-bearing measured, four mutations, all red against the WHOLE suite: derive
the tier unconditionally (3 red) - revert the K5 threshold (1, the consequence
arm alone) - "fix" it by never tiering at all (3, including two pre-existing
falsification arms) - loosen trust_tier instead (2, including its own
pre-existing gate). Green control 1208 passed / 5 skipped; golden
demo-transcript.stdout unchanged (ea8c534773acdbe41ae68f2c55724d69aaf8be4f).
