{"lexicon":1,"id":"money.atmosphere.payment.verifyReceipt","defs":{"main":{"type":"query","description":"EXPERIMENTAL DRAFT — not published. Exact-evidence verification of one receipt generation. This fresh NSID does not replace the already-served legacy-family money.atmosphere.payment.verifyRecord method, whose incompatible request/response contract remains unchanged. Every fragment identifier below is local to this NSID: for example, #attested means money.atmosphere.payment.verifyReceipt#attested and is not imported from network.attested.*. The caller names the exact record (uri + cid); the service answers with exactly one top-level result variant. When the record is current, settlement is reported as an evidence union whose every DECLARED variant schema-REQUIRES the evidence that justifies it, and lifecycle evidence is nested INSIDE the attested variant. Lexicon leaves unions open and ignores unexpected properties, so the closure is by declaration plus consumer rules: fail closed on unknown union variants; never read undeclared or extra properties as evidence. Exact authenticated block bytes (or their authenticated oversize length), author provenance, and proofs come from signed-commit-verified fetch or verified ingestion, never caller input. See COMMITMENT_PROFILE.md.","parameters":{"type":"params","required":["uri","cid"],"properties":{"uri":{"type":"string","format":"at-uri","description":"AT-URI of the exact receipt record to verify. Semantic request validation requires collection money.atmosphere.payment.receipt or money.atmosphere.payment.recurringReceipt plus a nonempty record key; collection-only or wrong-collection URIs are rejected before fetch because generic format: at-uri cannot enforce this exact-record boundary."},"cid":{"type":"string","format":"cid","description":"Canonical AT repository-record CID of the exact generation being verified: lowercase unpadded base32 CIDv1, dag-cbor codec, sha2-256 with a 32-byte digest. Semantic request validation enforces that profile before any fetch. Verification is always against one exact generation, never \"whatever is there now\"."},"attester":{"type":"string","format":"did","description":"Optional single-attester FILTER intersected with the service's fixed trust policy. A proof from an attester outside that trust set NEVER yields attestation. Supplying `attester` can only narrow results, never widen trust. A service needing a multi-attester filter MUST define a separately reviewed request shape; a neutral verify-any-attester surface would be separate and explicitly non-authoritative."}}},"output":{"encoding":"application/json","schema":{"type":"object","required":["result"],"properties":{"result":{"type":"union","refs":["#current","#cidMismatch","#absent","#unavailable"],"description":"Exactly one variant. Open union; consumers MUST fail closed on unknown variants for authorization purposes."}}}}},"current":{"type":"object","description":"The requested generation is the current record in the authenticity-verified repository. Settlement and lifecycle facts are reported as nested evidence bundles.","required":["block","author","settlement","evidenceAsOf"],"properties":{"block":{"type":"ref","ref":"#blockEvidence","description":"Exact authenticated repository block evidence for this generation."},"record":{"type":"unknown","description":"The exact decoded receipt record. Required by the normative profile for every settlement variant except #recordInvalid, and omitted for #recordInvalid so malformed data can never be laundered through the JSON response codec. Consumers validate it against block.bytes before use."},"author":{"type":"string","format":"did","description":"Author DID derived from authenticated provenance; the DID used in the commitment recomputation."},"settlement":{"type":"union","refs":["#attested","#recordInvalid","#unattested","#invalidEvidence","#unsupportedProfile","#proofReplaced","#proofAbsent","#settlementUnavailable"],"description":"Settlement-evidence bundle (with lifecycle nested under #attested). Semantic receipt validation runs first (#recordInvalid — includes a stored $commit key; a legacy, unknown, mixed, or non-canonical value form; non-canonical nonce/settledAt forms; and non-DID or wrong-collection proof references; the full list is normative in COMMITMENT_PROFILE.md); then every trusted proof reference is classified independently; outcome precedence (#attested > #settlementUnavailable > #unsupportedProfile > #invalidEvidence > not-current (#proofReplaced/#proofAbsent, one combined selection bucket — the variant is derived from the selected entry) > #unattested) and deterministic selection are normative in COMMITMENT_PROFILE.md. No DECLARED settlement variant carries lifecycle evidence except #attested; because Lexicon unions are open and unexpected properties are ignored, consumers MUST fail closed on unknown union variants and MUST NOT read undeclared or extra properties as evidence."},"evidenceAsOf":{"type":"string","format":"datetime","description":"The evidence boundary used to produce this response."}}},"attested":{"type":"object","description":"Immutable evidence from a trusted attester inside the service's trust set supports the historical settlement assertion for exactly this record generation. Unaffected by later refunds/disputes (see lifecycle).","required":["proof","proofRecord","attester","lifecycle","lifecyclePaths"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"Exact reference (uri + record CID) to the immutable proof record."},"proofRecord":{"type":"unknown","description":"The verifying proof record, verbatim. The service MUST have validated it (lexicon-valid proof, verified commitment) before returning this variant — the type is unknown only because Lexicon record definitions cannot be embedded in XRPC outputs."},"attester":{"type":"string","format":"did","description":"Authenticated controlling DID of the attesting repository."},"lifecycle":{"type":"union","refs":["#lifecycleKnown","#lifecycleMissing","#lifecycleInvalid","#lifecycleUnavailable","#noLifecycleAuthority"],"description":"Lifecycle-evidence bundle. Scope: EVERY logical receipt proof reference whose attester is a trusted lifecycle authority is a lifecycle CANDIDATE PATH — including candidates whose own proof could not be verified (unreachable, replaced, absent, unsupported, invalid): an unresolved candidate BLOCKS a clean settled outcome, so a candidate-resolution outage cannot be mistaken for a clean observation (normative in COMMITMENT_PROFILE.md). This does NOT turn the public sidecar into synchronous ledger truth: lifecycle records are eventual projections, and even a validated `settled` observation MUST NOT be used as the sole real-time payment or entitlement authorization; callers requiring current truth use the deploying consumer's canonical authoritative settlement ledger/API. Paths are identified by (attesterDid, exact proofUri string, decoded proofCid bytes). Selection is by fail-closed CATEGORY order (validated non-settled > missing > invalid > unavailable > validated settled), with bytewise attester DID, proof URI, then decoded CID bytes breaking ties inside the winning category; revisions are PER-PATH and never compared across authorities. Nested here because lifecycle state is defined only relative to trusted attestation: no DECLARED variant pairs lifecycle evidence with a non-attested outcome. Open union; unknown variants fail closed."},"lifecyclePaths":{"type":"array","maxLength":10,"items":{"type":"union","refs":["#pathValidated","#pathMissing","#pathInvalid","#pathUnresolved"],"description":"Typed per-outcome observation. Open union; consumers MUST fail closed on unknown variants."},"description":"EXHAUSTIVE typed enumeration of EVERY logical lifecycle candidate path — the same set the aggregation evaluated (bounded by the receipt's proofs maxLength, which is also 10). NORMATIVE CLOSURE (COMMITMENT_PROFILE.md): exactly one observation per candidate path (exact candidate-set equality — no omissions, no extras); unique (attesterDid, exact proofUri string, decoded proofCid bytes) identities; ordered ascending by bytewise attester DID, proof URI, then decoded CID bytes; each observation the union variant matching the path's classification, carrying that variant's REQUIRED evidence. The representative `lifecycle` variant MUST equal the category-then-path selection recomputed from this array, its evidence fields MUST be the SAME observation as the selected entry's (the per-variant-pair SHARED-field projection defined in COMMITMENT_PROFILE.md — never an independent re-read), and this array is empty IFF `lifecycle` is #noLifecycleAuthority. Consumers MUST recompute the aggregation and fail closed on ANY inconsistency — duplicate/missing/extra paths, unknown observation variants, or a mismatched representative. The current local stateless corpus exercises this emission-side closure, while consumption belongs to the separate stateful-consumer role. Conformance status is tracked only in COMMITMENT_PROFILE.md."}}},"unattested":{"type":"object","description":"No proof from a trusted attester was found for this generation. Not evidence of anything beyond absence-of-proof at the evidence boundary.","properties":{}},"invalidEvidence":{"type":"object","description":"Proof material from a trusted attester exists and was fetched, but failed verification: commitment recomputation mismatch or a malformed proof record. Exact authenticated block evidence is returned so the claim is inspectable even when malformed bytes cannot cross Lex-JSON as a decoded value. Fails closed — never collapsed into unattested. Precedence and deterministic selection are normative in COMMITMENT_PROFILE.md.","required":["proof","block","reason"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"Exact reference to the proof record that failed verification (deterministically selected when several fail; see COMMITMENT_PROFILE.md)."},"block":{"type":"ref","ref":"#blockEvidence","description":"Exact authenticated proof block evidence."},"reason":{"type":"string","maxLength":64,"knownValues":["commitment-mismatch","proof-malformed"],"description":"Machine-readable failure class (kebab-case)."}}},"settlementUnavailable":{"type":"object","description":"The attesting repository or index could not be reached or authenticated; no settlement claim is made. NOT evidence of absence.","required":["attester","retryable"],"properties":{"attester":{"type":"string","format":"did","description":"The unreachable attesting repository’s DID (deterministically selected when several are unreachable)."},"retryable":{"type":"boolean","description":"OR of the transient classifications across ALL unreachable trusted attesters: true when at least one failure looked transient."}}},"lifecycleKnown":{"type":"object","description":"The aggregated lifecycle outcome, backed by the exact generation that produced it. Selection is by the fail-closed CATEGORY order — any validated non-settled record outranks every settled record regardless of revision (a refunded@2 beats a settled@100); the lowest bytewise path triple breaks ties within the category; the returned record's own revision is meaningful only on its own path. The service MUST have validated the record (lexicon-valid, its proof strongRef equal to THIS LIFECYCLE PATH's proof — which need not be the outer #attested.proof) before returning this variant; consumers read status and revision FROM the returned record. Response-local exactness only — callers MUST NOT persist strongRefs to the mutable sidecar.","required":["proof","uri","cid","block","record"],"properties":{"uri":{"type":"string","format":"at-uri"},"cid":{"type":"string","format":"cid","description":"Record CID of the exact lifecycle generation this response reports."},"record":{"type":"unknown","description":"The lifecycle record at the returned exact cid, verbatim. The service MUST have validated it (lexicon-valid, its proof strongRef equal to THIS LIFECYCLE PATH's proof) before returning this variant; consumers read status and revision from it."},"block":{"type":"ref","ref":"#blockEvidence","description":"Exact authenticated lifecycle block evidence. Consumers require its canonical decode to equal record and its CID to equal cid."},"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The lifecycle path's own verifying proof (its exact strongRef) — the path this evidence is bound to. May differ from the outer #attested.proof: settlement selection and lifecycle selection are independent."}}},"lifecycleUnavailable":{"type":"object","description":"A lifecycle-authority candidate path could not be resolved to a definitive state. An unverified lifecycle authority may hold a restrictive state, so while any candidate is unresolved a clean settled result is impossible. The representative path is selected deterministically and its cause is returned as a typed evidence-bearing variant; aggregate retryability is reported separately because the representative's own failure class may be permanent while another unresolved path's is transient.","required":["proof","cause","retryable"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The representative unresolved candidate path (deterministically selected by lowest bytewise path triple among ALL unresolved candidates)."},"cause":{"type":"union","refs":["#causeSidecarUnreachable","#causeProofUnreachable","#causeProofReplaced","#causeProofAbsent","#causeProofUnsupportedProfile","#causeProofInvalid"],"description":"Why the representative path is unresolved — each cause variant schema-REQUIRES its own evidence. Open union; unknown variants fail closed."},"retryable":{"type":"boolean","description":"Aggregate retryability. MUST equal the OR of the DERIVED per-path classifications across all unresolved candidate paths (a path is transient IFF its observation's cause is an unreachable variant with transient: true; replaced/absent/unsupported/invalid causes are permanent), and the representative `cause` on this variant MUST be THE SAME observation as the selected path's lifecyclePaths entry — identical declared-field values, compared as decoded Lex values over declared fields only (transport bytes are not canonical; consumers may equivalently read the cause from the selected array entry). Lexicon cannot express these cross-field rules; the current local stateless corpus supplies executable emission-side evidence. Conformance status is tracked only in COMMITMENT_PROFILE.md."}}},"cidMismatch":{"type":"object","description":"A record exists at the uri in the current repository, but its current generation's canonical payment-v1 record CID differs from the requested canonical payment-v1 record CID. Both values have already passed the required lowercase-unpadded-base32 CIDv1 / dag-cbor / sha2-256/32 preflight, so there is exactly one permitted text for each CID byte sequence. No claim is made about the requested cid's history: a requested cid may be a prior generation or may never have been published at this uri — distinguishing those requires authenticated commit-history evidence this response does not carry.","required":["currentCid","evidenceAsOf"],"properties":{"currentCid":{"type":"string","format":"cid","description":"The record CID currently at the uri, from an authenticated current-head read."},"evidenceAsOf":{"type":"string","format":"datetime"}}},"absent":{"type":"object","description":"The current repository authoritatively contains no record at the uri. Distinct from unavailability, and NOT itself evidence of retraction or deletion intent — only of current absence. Historical proof evidence may still verify for parties holding old bytes.","required":["confirmedAt"],"properties":{"confirmedAt":{"type":"string","format":"datetime","description":"When current-repository absence was authoritatively confirmed."}}},"unavailable":{"type":"object","description":"The receipt's repository host or index could not be reached or authenticated. NOT evidence of absence; callers should retry. No claim of any kind is made.","required":["retryable"],"properties":{"retryable":{"type":"boolean"}}},"recordInvalid":{"type":"object","description":"The record at the exact requested CID is not a valid receipt: it fails authenticated AT-CBOR decoding, its lexicon, a normative semantic check (including a legacy/unknown/mixed value, non-canonical amountMinor/currency or amountAtomic/asset, nonce hex form, settledAt grammar, presence of a stored $commit key, or non-DID-authority/wrong-collection proof references), the 65536-byte payment-v1 record limit, or the COMMITTED DATA DOMAIN — null anywhere, non-integral or unsafe-range numbers, lone-surrogate strings, __proto__ or / map keys, container nesting beyond depth 32, CID/bytes values, or native/exotic host values. This parenthetical is a summary, NOT the definition: the complete normative list lives in COMMITMENT_PROFILE.md and governs. No settlement evaluation is possible; evaluated FIRST, before any proof. Exact evidence is already carried by #current.block, so this variant needs no further fields.","properties":{}},"unsupportedProfile":{"type":"object","description":"A trusted attester’s proof names a commitment profile this implementation does not implement — evidence exists that cannot be judged. Fails closed per proof; never masks a verifying supported proof (see precedence in COMMITMENT_PROFILE.md).","required":["proof","profile"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"Exact reference to the unjudgeable proof (deterministically selected when several)."},"profile":{"type":"string","maxLength":64,"description":"The unrecognized profile token, verbatim."}}},"lifecycleInvalid":{"type":"object","description":"A record exists at the lifecycle path but is not usable evidence: it fails authenticated AT-CBOR decoding, the lifecycle lexicon/profile, or its proof strongRef does not equal THIS LIFECYCLE PATH's proof (URI and CID — path selection is independent of the outer #attested.proof selection). Fails closed for authorization purposes — never read as settled. Exact authenticated block evidence is BOUND to its path (normative in COMMITMENT_PROFILE.md): uri MUST be the deterministic lifecycle URI derived from the path's proof; cid MUST hash the authenticated block currently observed at that URI; and reason MUST be consistent — record-invalid IFF decoding/profile/Lexicon validation fails, wrong-proof-binding IFF the record is otherwise valid but its proof differs from this path's proof. Consumers MUST verify these bindings and fail closed on mismatch. The representative evidence MUST be the SAME observation as the selected lifecyclePaths entry.","required":["proof","uri","cid","block","reason"],"properties":{"uri":{"type":"string","format":"at-uri"},"cid":{"type":"string","format":"cid","description":"Record CID of the exact offending generation."},"block":{"type":"ref","ref":"#blockEvidence","description":"Exact authenticated lifecycle block evidence."},"reason":{"type":"string","maxLength":64,"knownValues":["record-invalid","wrong-proof-binding"],"description":"Machine-readable failure class (kebab-case)."},"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The candidate path (its proof strongRef) whose sidecar is unusable."}}},"proofReplaced":{"type":"object","description":"An authenticated current-head read of the attesting repository shows a record at the referenced URI whose CID differs from the pinned reference. Current-state evidence ONLY: no claim is made about whether the pinned generation ever existed at that URI, and no intent is attributed. The pinned reference is therefore not standing evidence.","required":["proof","currentCid"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The receipt’s pinned reference (deterministically selected when several; see COMMITMENT_PROFILE.md)."},"currentCid":{"type":"string","format":"cid","description":"The record CID currently at the URI, from the authenticated current-head read."}}},"proofAbsent":{"type":"object","description":"An authenticated current-head read of the attesting repository shows NO record at the referenced URI. Current-state evidence ONLY: no claim is made about whether the pinned generation ever existed, and no intent is attributed. The pinned reference is therefore not standing evidence.","required":["proof","confirmedAt"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The receipt’s pinned reference (deterministically selected when several; see COMMITMENT_PROFILE.md)."},"confirmedAt":{"type":"string","format":"datetime","description":"When current absence was authoritatively confirmed."}}},"lifecycleMissing":{"type":"object","description":"FAIL-CLOSED ALARM: no lifecycle record exists at a lifecycle-authority candidate path. Under the genesis rule, every proof path that verifier policy treats as lifecycle-authoritative is expected to have a lifecycle record from settlement onward, so authenticated current absence indicates deletion or rollback — an integrity failure, never good standing. Consumers MUST NOT authorize on this state. Deterministically selected by path triple when several paths are missing.","required":["proof","confirmedAt"],"properties":{"confirmedAt":{"type":"string","format":"datetime","description":"When current absence was authoritatively confirmed."},"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The candidate path (its proof strongRef) whose deterministic sidecar location was authoritatively empty."}}},"noLifecycleAuthority":{"type":"object","description":"The verifier's trust policy contains no lifecycle authority among this receipt's proof references — a PERMANENT policy limitation, distinct from evidence failure: nothing was unreadable; there is simply no authority to consult. Consumers requiring lifecycle assurance must extend their trust policy.","properties":{}},"causeSidecarUnreachable":{"type":"object","description":"The candidate's proof verified but its sidecar location could not be read or authenticated.","required":["transient"],"properties":{"transient":{"type":"boolean","description":"This path's own failure classification per the profile's taxonomy."}}},"causeProofUnreachable":{"type":"object","description":"The candidate's own proof repository could not be reached or authenticated this pass.","required":["transient"],"properties":{"transient":{"type":"boolean","description":"This path's own failure classification per the profile's taxonomy."}}},"causeProofReplaced":{"type":"object","description":"An authenticated current-head read shows a different record CID at the candidate's proof URI. Permanent for retry purposes.","required":["currentCid"],"properties":{"currentCid":{"type":"string","format":"cid","description":"The record CID currently at the URI."}}},"causeProofAbsent":{"type":"object","description":"An authenticated current-head read shows no record at the candidate's proof URI. Permanent for retry purposes.","required":["confirmedAt"],"properties":{"confirmedAt":{"type":"string","format":"datetime","description":"When current absence was authoritatively confirmed."}}},"causeProofUnsupportedProfile":{"type":"object","description":"The candidate's proof names a commitment profile this implementation does not implement. Permanent for retry purposes (an upgrade, not a retry, resolves it).","required":["profile"],"properties":{"profile":{"type":"string","maxLength":64,"description":"The unrecognized profile token, verbatim."}}},"causeProofInvalid":{"type":"object","description":"The candidate's proof was fetched but failed verification. Permanent for retry purposes. Exact authenticated block evidence is carried even when malformed content cannot be represented as Lex-JSON.","required":["reason","block"],"properties":{"reason":{"type":"string","maxLength":64,"knownValues":["commitment-mismatch","proof-malformed"],"description":"Machine-readable failure class (kebab-case)."},"block":{"type":"ref","ref":"#blockEvidence","description":"Exact authenticated proof block evidence."}}},"pathValidated":{"type":"object","description":"Per-path observation: a validated lifecycle record at this path (lexicon-valid, proof strongRef equal to THIS path's proof — verified by the service before returning). Carries the complete evidence a stateful consumer needs to establish or advance this path's high-water — BOUND to the verbatim record, not merely carried (normative in COMMITMENT_PROFILE.md): status MUST equal record.status, revision MUST equal record.revision, the record's proof strongRef MUST equal this observation's proof, uri MUST be the deterministic lifecycle URI derived from the path's attester and the proof's rkey, and cid MUST be the authenticated repository-record CID recomputable from the exact verbatim record. Consumers MUST verify these equalities and fail closed on any mismatch.","required":["proof","status","revision","uri","cid","block","record"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The path (its proof strongRef)."},"uri":{"type":"string","format":"at-uri"},"cid":{"type":"string","format":"cid","description":"Exact record CID observed at this path — the high-water candidate generation. MUST be recomputable as the repository-record CID of the exact verbatim record."},"status":{"type":"string","maxLength":64,"knownValues":["settled","refunded","partially-refunded","disputed","reversed"],"description":"The record's status (kebab-case; open set — unknown values fail closed for authorization). MUST equal the verbatim record's own status field."},"revision":{"type":"integer","minimum":1,"maximum":9007199254740991,"description":"The record's per-path revision. MUST equal the verbatim record's own revision field."},"record":{"type":"unknown","description":"The lifecycle record at the returned cid, verbatim."},"block":{"type":"ref","ref":"#blockEvidence","description":"Exact authenticated lifecycle block evidence. Consumers require its canonical decode to equal record and its CID to equal cid."}}},"pathMissing":{"type":"object","description":"Per-path observation: authenticated current ABSENCE at this path's deterministic sidecar location — always anomalous under the genesis rule. A stateful consumer treats this as sticky integrity-compromising evidence for the path, retains it, and never restores authorization merely because a later exact record appears (normative in COMMITMENT_PROFILE.md).","required":["proof","confirmedAt"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The path (its proof strongRef)."},"confirmedAt":{"type":"string","format":"datetime","description":"When current absence was authoritatively confirmed."}}},"pathInvalid":{"type":"object","description":"Per-path observation: a record exists at this path but is unusable evidence (fails authenticated AT-CBOR decoding, the lifecycle profile/Lexicon, or is bound to a different proof). Exact authenticated block evidence and CID are BOUND to the deterministic path as defined in COMMITMENT_PROFILE.md. A stateful consumer retains this as sticky integrity-compromising evidence and does not auto-heal on a later valid record.","required":["proof","uri","cid","block","reason"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The path (its proof strongRef)."},"uri":{"type":"string","format":"at-uri"},"cid":{"type":"string","format":"cid","description":"Record CID of the exact offending generation."},"block":{"type":"ref","ref":"#blockEvidence","description":"Exact authenticated lifecycle block evidence."},"reason":{"type":"string","maxLength":64,"knownValues":["record-invalid","wrong-proof-binding"],"description":"Machine-readable failure class (kebab-case)."}}},"blockEvidence":{"type":"object","description":"Authenticated repository block evidence. encodedBytes is always the exact block length. bytes is REQUIRED by the normative profile when encodedBytes is at most 65536 and MUST equal the complete authenticated block; bytes is OMITTED when encodedBytes is larger, so an oversized hostile record cannot force an unbounded verification response. The record CID or proof strongRef carried by the parent authenticates either form.","required":["encodedBytes"],"properties":{"encodedBytes":{"type":"integer","minimum":0,"maximum":9007199254740991},"bytes":{"type":"bytes","maxLength":65536}}},"pathUnresolved":{"type":"object","description":"Per-path observation: this candidate could not be resolved to a definitive state (its own proof did not verify this pass, or its sidecar was unreachable). The typed cause carries its own required evidence and is the SINGLE source of this path's retry classification: a path is transient IFF its cause is an unreachable variant with transient: true; replaced/absent/unsupported/invalid causes are permanent. Stateful rule (COMMITMENT_PROFILE.md): after a path validated, proof-replaced/proof-absent/proof-invalid permanently sets its sticky integrity-compromised state; unreachable causes park/retry without themselves compromising history; unsupported-profile remains fail-closed policy limitation; no later exact record automatically clears retained bad evidence. There is deliberately no separate per-path transient field — duplicating the classification invited schema-valid contradictions.","required":["proof","cause"],"properties":{"proof":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"The path (its proof strongRef)."},"cause":{"type":"union","refs":["#causeSidecarUnreachable","#causeProofUnreachable","#causeProofReplaced","#causeProofAbsent","#causeProofUnsupportedProfile","#causeProofInvalid"],"description":"Why this path is unresolved — each cause variant schema-REQUIRES its own evidence. Open union; unknown variants fail closed."}}}}}