Nicolás, Evgenii, Roel,

You put rows 8/9 to me. With your consistency-row / evidence-row split, the
answer is cleaner: rows 8/9 are evidence rows — they read moved, which is
recomputed, not one declared slot read against another. So the per-slot
rule governs them, and it settles the reading-vs-agreement question
directly.

Rows 8/9 are a reading, not an agreement, on one condition: they read moved
as recomputed from the two observations the object names, not moved as the
emitter declared it. fail/A, fail/B, moved={verdict} is the proof — read
the declared field and it passes; recompute the delta and it's rejected. So
the fix isn't to drop rows 8/9, it's to specify they read the recomputed
delta.

Three things for the document:

1. Adopt the per-slot table: moved recomputed, arity recomputed from the
delta (no field), fixed resolved, compared declared. No rejection row reads
a declared slot. Rows 8/9 read moved-as-recomputed and survive.

2. Rows 8/9 keep their bite on a carried object and on a resolved
reference. On an unresolvable reference they degrade to unchecked — Roel's
third state, 0021's precedent, named apart from "couldn't fetch at all." A
resolved reference whose digest doesn't match is an integrity failure, not
absence of evidence.

3. compared stays in the object but no row reads it — it's intent, not
fact. Defining moved as the recomputed difference over the whole record
closes the narrow-compared-to-hide-a-field gap you flagged.

Net: 0040 keeps rows 8/9, they stop being forgeable, and the per-slot sort
kills the class rather than the three instances we found by hand.

Kenne
