## Problem `AuditTrailVerifier::verifyRow()` reads the per-row verdict `checkRow()` builds and reports the first thing that went wrong by walking `ROW_CHECK_LAYERS` and stopping at the first check that is **not `pass`**. A check can also come back `undetermined`, and the HMAC is the one that routinely does: a row whose signing secret cannot be resolved leaves `hmac => 'undetermined'` with `cross_reference` and `transient` still unread. The loop stops there, and the branch below it states the invariant it needs: ```php // Tolerant: the secret that signed this row would not // resolve here, which says nothing about the row. Every // other layer passed, so the walk goes on ... ``` "Every other layer passed" is not established by anything. On a `VerificationDepth::Tolerant` walk the row is returned as verified whatever those two checks found. `VerificationDepth::None` has a second hole with the same result. `verifyRow()` takes a branch of its own there and runs the link, the payload hash and the transient column, but not the segment-event cross reference — which needs no secret at all, being a comparison of a lifecycle row's `resource` against the `audit_trail_segment` table. At that depth the check never runs, under any condition. Both end in a verdict reporting `structurally_ok => TRUE` for a chain whose structure does not check out. `verifyChain()` documents that flag as covering "`previous_hash` linkage, recomputed `hash`, segment-event cross-references, and NULL-transient legitimization". ## What it costs These are the two walks an auditor is given. `VerificationDepth::None` is described as "exactly the walk a reader without the keys gets, so an operator can run it before handing a copy over"; `Tolerant` is for "a keyring known to be incomplete: a site mid-rotation whose retired key has already been removed". Both accept a lifecycle attestation naming a segment that is not there, and `Tolerant` additionally accepts an emptied `context_transient` column that nothing attests — the attacker-NULLs-to-hide-data branch the transient check exists for. ## Reproduction A chain of three rows, the middle one a properly signed `segment_archived` attestation whose `resource` is `segment:999`, with no such segment. Observed against 1.x at `087f396`: ``` with secret depth=strict ok=false structurally_ok=false with secret depth=tolerant ok=false structurally_ok=false with secret depth=none ok=true structurally_ok=true ``` and with the Key holding the signing bytes deleted: ``` secret gone depth=strict ok=false structurally_ok=true authenticated_ok=false msg=Chain "webdav" cannot be HMAC-verified from id 1: ... secret gone depth=tolerant ok=true structurally_ok=true authenticated_ok=NULL msg=Chain "webdav" verified: 3 entries intact. secret gone depth=none ok=true structurally_ok=true authenticated_ok=NULL msg=Chain "webdav" verified: 3 entries intact. ``` ## Fix - `checkRow()` honours the depth it is given for the HMAC layer, so a walk that reads no signature resolves no secret there either, and the result stays `undetermined` rather than being computed and discarded. - `verifyRow()` drops its separate `None` branch and goes through `checkRow()` at every depth, so the five checks are one list rather than one list and a subset of it. - The layer walk reports the first check that **failed**, and the undetermined HMAC keeps its own rule below, where it is reached only when nothing failed. - The out-parameter carries every layer at fault rather than one, so a row that is both unauthenticated and structurally broken sets `authenticated_ok` and `structurally_ok` both, instead of whichever came first. ## Break messages carry their frame twice The same methods produce this, and it is the plumbing being corrected: `Segment\SegmentAttestations` and `verifyTransientColumn()` return messages already formatted through `Chain\BrokenRowMessage::format()`, and `verifyRow()` formats the result again. An operator reading the status report, the banner on the entries listing or `drush audit_trail:verify` gets: ``` Chain "webdav" broken at id 2: Chain "webdav" broken at id 2: segment_archived references segment #999 which does not exist. ``` Each check returns the reason on its own; the two readers add the frame they need, once. AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the code and tests on the merge request. I reviewed and ran the work myself before posting it.)