SPEC v1.2 : la mesure nomme ce qu'elle a examiné (relations.confirms)

Le sens est la décision entière : c'est la MESURE qui déclare ce qu'elle
confirme, jamais l'assertion confirmée qui pointe en retour. Trois raisons
suffisantes chacune : l'assertion confirmée existe déjà et ne se réécrit
pas ; l'instrument sait ce qu'il a mesuré — le lien est inféré, jamais
saisi ; et l'auteur d'une confirmation est la machine, non l'agent dont
l'affirmation est confirmée. Le runner refuse confirms sur autre chose
qu'une mesure de provenance measured.

Mineur et ignorable : un consommateur qui ignore la clé la préserve.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

envelope/SPEC.md

@@ -1,4 +1,4 @@
-# Assertion Envelope — Specification v1.1
+# Assertion Envelope — Specification v1.2
 
 **Status**: stable. Declared v1.0 upon the first real federated exchange
 between two distinct jurisdictions — openathle → Prismagram, endorsed
@@ -89,7 +89,7 @@ fields (§7).
 | 10 | `jurisdiction` | string | REQUIRED. MUST equal the prefix of `id`. Lowercase ASCII, no separators |
 | 11 | `at` | string | REQUIRED. RFC 3339 timestamp of the asserted state |
 | 12 | `lifecycle` | string | REQUIRED. One of `proposed`, `endorsed`, `superseded`, `rejected`, `under_revision` |
-| 13 | `relations` | object | REQUIRED, MAY be empty. Keys among `amends`, `supersedes`, `depends_on`, `satellite_of`; values are lists of prefixed ids |
+| 13 | `relations` | object | REQUIRED, MAY be empty. Keys among `amends`, `supersedes`, `depends_on`, `satellite_of`, `confirms` (v1.2); values are lists of prefixed ids |
 | 14 | `deadline` | string or null | REQUIRED. RFC 3339. When a falsifiable statement expires into a verdict |
 | 15 | `falsification` | string or null | REQUIRED. What observation would make this assertion false. A hypothesis without one is not a hypothesis |
 
@@ -112,6 +112,22 @@ named, versioned and dated.
 It is OPTIONAL because a consumer that never exposes a derived value never owes
 one; it is not optional for those who do (§9).
 
+### 4.2 `confirms` — the measure names what it examined (v1.2)
+
+A `measure` assertion MAY carry `relations.confirms`: the prefixed ids of the
+assertions it examined. The direction is deliberate and it is the whole point:
+**the measure declares what it confirms; the confirmed assertion is never
+edited to point back.** Three reasons, each sufficient. The confirmed
+assertion already exists and is append-only. The instrument already knows what
+it measured — the link is inferred, never typed. And the author of a
+confirmation is the machine that measured, not the agent whose claim is being
+confirmed: a producer MUST NOT emit `confirms` on anything but a `measure` of
+provenance `measured`.
+
+A consumer MAY derive, from `confirms`, which assertions have been examined
+and when — and MAY treat an assertion that no measure has ever confirmed
+differently from one that has. That reading is consumer-local (§4.1).
+
 ## 5. Classes
 
 `invariant`, `step_realized`, `transition`, `traversal`, `stressor`,
@@ -151,6 +167,9 @@ a standard field is a contract change under §8.
   governs it (§9). Additive and ignorable: a v1.0 consumer that meets the field
   preserves it and moves on, exactly as §8 requires of any unknown field. No
   existing field, class, provenance or rule changed.
+- **v1.2 adds the relation kind `confirms`** (§4.2), carried by measures only.
+  Additive and ignorable: a consumer that does not know the kind preserves it
+  as any unknown key of `relations` and moves on.
 - At most **two published versions per year**. Deprecation is announced in
   this file at least one version before removal.
 - Consumers MUST accept any message whose `envelope` shares their MAJOR and