[scbrown]

Add the bounded evidence reader needed to verify signed Decision Deck answers. It checks five exact registered-query templates, graph identities, native receipts and typed fact provenance, then rechecks request/item bookends before displaying a result. Missing, changed, oversized or inconsistent evidence yields UNKNOWN; a controlled empty population yields Waiting.

The separate Fetch transport restricts origin/routes, omits credentials, rejects redirects, caps streamed bytes and limits each read cycle. Importing the module performs no request. Existing feature configuration remains disabled; registering production definitions and admitting their served cost are separate prerequisites.

Validation: 89 unit tests pass, build/README checks pass, and three targeted fault injections fail before restoration. Nineteen disposable native controls pass, including actual registered-query load/render/execute and receipt/fact readback. Five actual Chrome Fetch/CORS and DOM controls pass against intercepted synthetic replies. Committed repeatable qualifiers and result archives document the boundaries; no production, device or human proof is claimed. Meaningful runs passed the HOME escape guard.

This is the eight-path reader delta after #11. A normal merge of current main preserved the entire previously qualified reader tree exactly. The earlier review of #11 does not approve this delta: fresh exact-head CI and one independent post-green review are required. No query registration, curator, served enablement, enrollment or activation is part of this proposal. Browser behavior is demonstrated in the committed synthetic qualifier; the disabled served page has no changed live behavior.

[scbrown]

Source APPROVE at 2800beb68aa4845c89eb299d3c598e1a8c0b3756 / base 3676f04e. Full independent audit of all eight changed paths; no blocking finding. This review covers #12's reader delta independently of #11.

The reader binds graph creation provenance and exact stored-query definitions, refuses overflow/truncation/ambiguous rows, verifies native point receipts and exact typed facts/provenance, and brackets answers with request/item reads. Transport stays on explicit HTTPS read routes with byte caps, abort and an overall deadline. Source import makes no request; the production adapter remains unselected and signing disabled.

Validation: required just ci passes all 89 tests, static build and README checks. Two additional independent tests pass: progressive streaming cannot extend the overall deadline, and chunk-split UTF-8 decodes correctly while a one-byte-under cumulative cap refuses. Each guarded run exits 0 with 157 paths and five resources unchanged. The complete eight-path proposal reconstructs the entire candidate tree and reverses exactly to base. The native result archive's fixture-source hash matches the checked-in helper.

The current risk packet/helper reports T1/floor1 and review exemption with PREFLIGHT PASS; this is the requested independent source verdict despite that exemption. Archived native/browser qualification results remain author evidence; I did not rerun a native enrollment ceremony or browser qualification. Production query registration, served cost approval, graph protection, HTTP/CORS and human/device enrollment remain distinct acceptance gates. No production query, activation, deployment or merge is asserted.