diff --git a/EVALUATION-STANDARD.md b/EVALUATION-STANDARD.md
index 5df3a80..ec3fb14 100644
--- a/EVALUATION-STANDARD.md
+++ b/EVALUATION-STANDARD.md
@@ -22,7 +22,7 @@ LGD-Eval is an **independent third-party evaluation group**. Evaluations we publ
 Out of scope: certification, accreditation, conformity assessment with legal effect,
 regulatory opinion, or endorsement of any product or vendor.
 
-## 2. Evidence Model (evidence-grader v1.2)
+## 2. Evidence Model (evidence-grader v1.3)
 
 Each evaluated claim is graded on two axes:
 
@@ -38,12 +38,24 @@ Each evaluated claim is graded on two axes:
 
 ### 2.2 Authorization verdict (per decision)
 
+The verification verdict has three states. This is the vocabulary used in `outcome.verification`.
+
 | Verdict | Meaning | Operator meaning |
 |---|---|---|
-| `verified` | Evidence measured and consistent with authorization | ALLOW |
-| `unresolved` | Evidence absent or unmeasurable — not yet decidable | DEFER (do not default to allow) |
-| `rejected` | Evidence measured and found inconsistent | DENY |
-| `quarantined` | Normative semantics of the field still unsettled | EXCLUDE from formal result until spec settles |
+| `verified` | Authorization established and current | ALLOW |
+| `unresolved` | Authorization cannot be established — not yet decidable | DEFER (do not default to allow) |
+| `rejected` | Authorization affirmatively not valid — established by evidence | DENY |
+
+**Operator action is a separate axis.** What a relying party does is policy-dependent, so it is recorded in its own field (`outcome.policy_action`) and never merged into the verdict. `reject` is not available as an action name: the word is reserved for the verdict, so the two levels stay distinguishable at a glance.
+
+| Operator action | Meaning | Typical trigger |
+|---|---|---|
+| `allow` | Proceed under normal policy | `verified` |
+| `defer` | Do not default to allow; hold for review or escalation | `unresolved` |
+| `deny` | Do not accept | `rejected` |
+| `exclude` | Keep out of the formal result until the normative semantics settle | Field semantics still unsettled — this is **not** a verification verdict |
+
+`quarantined` was a fourth value of the verdict up to v1.2 and was removed in v1.3: it described a handling decision over an unsettled field, not something that had been verified. It is now `policy_action: exclude`. Evidence-level `failure_class` still reports `quarantined` for malformed input; that is the evidence axis (§2.1) and is unchanged.
 
 ### 2.3 Payload digest convention
 
@@ -52,6 +64,33 @@ Digests are truncated to the first 16 hex chars as vector ids in worked examples
 quoted in full in evidence records. Re-running the same canonical input must reproduce
 the same digest (determinism check, see §4).
 
+The digest covers the substantive objects of a conclusion (`domains`, `authorization`,
+`outcome`) and excludes `timestamp`, so reproduction is date-independent. `verdict` and
+`overall_failure_class` are pure functions of `domains` and are covered transitively.
+
+> **Correction (v1.3, 2026-10-23).** The convention above has been published in this
+> section since v0.1, but the v1.2 implementation computed the digest with default JSON
+> separators (`", "` / `": "`) and insertion order rather than `sort_keys=True` with
+> compact separators. A third party following this section could therefore not reproduce
+> any published digest. The implementation now matches the text; all four v1.2 digests
+> were recomputed, with the reasons listed in `worked-examples/cases/README.md`.
+
+### 2.4 Case outcome vs coverage verdict
+
+A conclusion reports two summary fields that answer different questions, and reading the
+wrong one reports a passing case as a failure:
+
+| Field | Answers | Scope |
+|---|---|---|
+| `outcome.verification` | What is the case-level conclusion for the dimension under test? | The case |
+| `verdict` | How much of the six-domain evidence grid is covered at grade V/S? | The grid |
+
+A case set that exercises one or two of the six domains is `Insufficient evidence` under
+`verdict` by construction, even when its authorization outcome is `verified`. Readers and
+programs should take the case conclusion from `outcome.verification`. Each conclusion also
+carries a `scopes` object stating this in machine-readable form, so the distinction
+travels with the data instead of living only in documentation.
+
 ## 3. Evaluation Report Format
 
 Every published evaluation follows the REVIEW format (see `reviews/` for samples):
@@ -83,7 +122,10 @@ displayed with the disclaimer text defined there.
 
 ## 6. Versioning & Change
 
-- Protocol version: v1.2 (evidence-grader). This document: v0.1.
+- Protocol version: v1.3 (evidence-grader). This document: v0.2.
+- v1.3 (2026-10-23): case outcome separated from the coverage verdict; operator action split
+  out of the verdict vocabulary; digest computation corrected to match §2.3. All worked-example
+  digests recomputed.
 - Changes are tracked in git; worked examples updated atomically with the grader.
 - Zenodo record for protocol releases: https://zenodo.org/records/23428476 (CC-BY-4.0).
 
diff --git a/WORKED_EXAMPLES_L0-L13.md b/WORKED_EXAMPLES_L0-L13.md
index e47e0b0..4299f38 100644
--- a/WORKED_EXAMPLES_L0-L13.md
+++ b/WORKED_EXAMPLES_L0-L13.md
@@ -165,13 +165,13 @@
 
 ## Appendix A — Reproduction from live runs / 附录 A：实测复现对照
 
-The following three cases were executed with the reference grader (`evaluation-protocol/tools/evidence-grader.py` v1.2, SHA-256 `98C9C1F6FABA8E1E688D0CE01FF35C3715EF51EC25072685B23A8782A1C9C91B`); machine-readable outputs with payload digests are in `worked-examples/cases/` and `tools/demo/`. They illustrate L0–L2 judgment in practice and are offered as optional evaluation aid. / 以下用例已用参考分级器 v1.2 实跑（输出含 payload digest，位于 `worked-examples/cases/` 与 `tools/demo/`），用于演示 L0–L2 的判定实践，仅作可选评估辅助。
+The following four cases were executed with the reference grader (`evaluation-protocol/tools/evidence-grader.py` v1.3, SHA-256 `06C89E1BA30E4C331058AB90511B6DEA62D8641A8AB15D284BCAFD4005925098` (computed over the server-side LF bytes, 34795 B)); machine-readable outputs with payload digests are in `worked-examples/cases/` and `tools/demo/`. They illustrate L0–L2 judgment in practice and are offered as optional evaluation aid. / 以下用例已用参考分级器 v1.3 实跑（输出含 payload digest，位于 `worked-examples/cases/` 与 `tools/demo/`），用于演示 L0–L2 的判定实践，仅作可选评估辅助。
 
 | Case / 用例 | Scenario / 场景 | Judgment / 判定 | Outcome / 结果 |
 |---|---|---|---|
-| A — Valid registered credential / 有效已注册凭证 | Signed credential from an authorized issuer, status source available | L0/L1/L2 contract, static and functional checks pass; signature grade V; authorization **verified** | **positive** (reason: `none`) |
-| B1 — Unverifiable issuer scope / 签发范围不可判定 | Signature verifies, but authoritative issuer-scope information is unavailable | Signature grade V; authorization **unresolved** | **indeterminate** (reason: `authorization unresolved`; missing evidence ≠ invalid) |
-| B2 — Confirmed out-of-scope issuer / 已证实越权签发者 | Signature verifies, authoritative scope registry confirms the issuer lacks the required scope | Signature grade V; authorization **rejected** | **rejected** (reason: `authorization rejected`) |
-| C — Status source unavailable / 状态源不可用 | Credential cannot be confirmed or denied because the status source is down | Authorization **unresolved**; `unavailable ≠ revoked` | **indeterminate** (reason: `status unavailable ≠ revoked`) |
+| A — Valid registered credential / 有效已注册凭证 | Signed credential from an authorized issuer, status source available | L0/L1/L2 contract, static and functional checks pass; signature grade V; authorization **verified** | **verified** (reason_code `none`; policy `allow`) |
+| B1 — Unverifiable issuer scope / 签发范围不可判定 | Signature verifies, but authoritative issuer-scope information is unavailable | Signature grade V; authorization **unresolved** | **unresolved** (reason_code `authorization_unresolved`; policy `defer`; missing evidence ≠ invalid) |
+| B2 — Confirmed out-of-scope issuer / 已证实越权签发者 | Signature verifies, authoritative scope registry confirms the issuer lacks the required scope | Signature grade V; authorization **rejected** | **rejected** (reason_code `authorization_rejected`; policy `deny`) |
+| C — Status source unavailable / 状态源不可用 | Credential cannot be confirmed or denied because the status source is down | Authorization **unresolved**; `unavailable ≠ revoked` | **unresolved** (reason_code `status_unavailable`; policy `defer`; unavailable ≠ revoked) |
 
-*Case B was split into B1/B2 per the themes#42 review (missing evidence of authorization ≠ demonstrated invalid authorization). Worked examples drafted 2026-10-16, updated 2026-10-17 by LGD-Eval (evaluation account) — bilingual, English first, Chinese second. / 实例由 LGD-Eval 评测号起草并更新（双语，英前中后）；原 Case B 按 themes#42 评审意见拆分为 B1/B2。*
+*Case B was split into B1/B2 per the themes#42 review (missing evidence of authorization ≠ demonstrated invalid authorization). Worked examples drafted 2026-10-16, updated 2026-10-23 by LGD-Eval (v1.3: outcome vocabulary aligned, policy actions separated) (evaluation account) — bilingual, English first, Chinese second. / 实例由 LGD-Eval 评测号起草并更新（双语，英前中后）；原 Case B 按 themes#42 评审意见拆分为 B1/B2。*
diff --git a/demo/evidence-grading-demo.html b/demo/evidence-grading-demo.html
index 1dc6c50..b2f2066 100644
--- a/demo/evidence-grading-demo.html
+++ b/demo/evidence-grading-demo.html
@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Evidence Grading for Verifier Decisions — Interactive Demo</title>
-<meta name="description" content="Interactive demo of evidence grading separated from authorization validity: three worked cases, machine-runnable, externally verified. LGD-Eval.">
+<meta name="description" content="Interactive demo of evidence grading separated from authorization validity: four worked cases, machine-runnable, externally verified. LGD-Eval.">
 <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='6' fill='%230F1E2E'/%3E%3Ctext x='16' y='22' font-size='14' text-anchor='middle' fill='%23B8894A' font-family='serif' font-weight='bold'%3EL%3C/text%3E%3C/svg%3E">
 <style>
 :root{
@@ -49,7 +49,8 @@
 .ev .lbl{min-width:24px;font-weight:700;color:var(--gold)}
 .ev .src{color:var(--gray);font-size:12px;font-style:italic}
 .tag{display:inline-block;font-size:11px;border-radius:6px;padding:1px 7px;background:#EFEAE1;color:var(--ink2);margin-left:6px}
-.verdict{font-size:17px;font-weight:800;margin:4px 0}
+.outcome{font-size:14px;font-weight:700;margin:6px 0 2px;color:#0F1E2E}
+.outcome code{font-family:Consolas,monospace;font-size:12px;background:#EFEAE1;padding:1px 5px;border-radius:4px}.verdict{font-size:17px;font-weight:800;margin:4px 0}
 .v-insufficient{color:var(--red)}
 .fclass{font-family:Consolas,monospace;font-size:13px;background:#EFEAE1;border-radius:6px;padding:2px 8px}
 table{width:100%;border-collapse:collapse;font-size:13px;margin-top:10px}
@@ -72,7 +73,7 @@
   <div class="wrap">
     <div class="brand">LGD-Eval · Independent AI Evaluation</div>
     <h1>Evidence Grading for Verifier Decisions</h1>
-    <div class="sub">Separating evidence quality from authorization validity — three worked cases, machine-runnable, externally verified.</div>
+    <div class="sub">Separating evidence quality from authorization validity — four worked cases, machine-runnable, externally verified.</div>
   </div>
 </header>
 
@@ -98,11 +99,12 @@ <h3>3 · Explicit failure classes</h3>
     </div>
   </div>
 
-  <h2>Worked cases <span class="en">Click to inspect input evidence and verdict</span></h2>
+  <h2>Worked cases <span class="en">Click to inspect input evidence, outcome and coverage verdict</span></h2>
   <div class="card">
     <div class="cases" id="cases">
       <button class="casebtn on" data-c="A"><b>Case A</b> — Valid registered credential<small>Authorized registrar, governance root</small><span class="dg" data-dg="A"></span></button>
-      <button class="casebtn" data-c="B"><b>Case B</b> — Out-of-scope issuer<small>Signature valid, authorization unverifiable</small><span class="dg" data-dg="B"></span></button>
+      <button class="casebtn" data-c="B1"><b>Case B1</b> — Unverifiable issuer scope<small>Signature valid, scope registry unavailable</small><span class="dg" data-dg="B1"></span></button>
+      <button class="casebtn" data-c="B2"><b>Case B2</b> — Confirmed out-of-scope issuer<small>Signature valid, registry confirms no scope</small><span class="dg" data-dg="B2"></span></button>
       <button class="casebtn" data-c="C"><b>Case C</b> — Status source unavailable<small>No revocation record retrievable</small><span class="dg" data-dg="C"></span></button>
     </div>
     <div class="split">
@@ -112,6 +114,7 @@ <h4>Input evidence</h4>
       </div>
       <div class="panel">
         <h4>Verifier conclusion</h4>
+        <div class="outcome" id="outcome"></div>
         <div class="verdict v-insufficient" id="verdict"></div>
         <div id="fclass"></div>
         <div id="domains"></div>
@@ -140,19 +143,21 @@ <h2>Two-axis separation <span class="en">Evidence grade ≠ authorization state<
 
   <h2>Reproduction <span class="en">clone → run → verify, from a clean checkout</span></h2>
   <div class="card">
-    <p style="font-size:13px;margin-bottom:10px">External verification performed 2026-10-16 on a fresh download of the public repository (no local configuration used):</p>
-    <div class="okbar">SELFTEST PASS — 12 invariants · 3/3 cases match published payload digests</div>
+    <p style="font-size:13px;margin-bottom:10px">Reproduction run of 2026-10-23 (v1.3): fresh download of the public repository, no local configuration used. Independent reproduction by a third party is what this output is for — the run below was made by the maintainers, and every number in it can be recomputed from the repository alone.</p>
+    <div class="okbar">SELFTEST PASS — 35 invariants · 4/4 cases match published payload digests</div>
     <div class="repro">$ python tools/evidence-grader.py --selftest
-SELFTEST OK — 12 invariants passed（12 项不变量全部通过）
+SELFTEST OK — 35 invariants passed（35 项不变量全部通过）
 
-$ python tools/evidence-grader.py --json worked-examples/cases/caseA_valid_registered_credential_input.json --out /tmp/caseA.json
-$ python tools/evidence-grader.py --json worked-examples/cases/caseB_out_of_scope_issuer_input.json --out /tmp/caseB.json
-$ python tools/evidence-grader.py --json worked-examples/cases/caseC_unavailable_status_source_input.json --out /tmp/caseC.json
+$ for c in caseA_valid_registered_credential caseB1_unverifiable_issuer_scope \
+           caseB2_confirmed_out_of_scope_issuer caseC_unavailable_status_source; do
+    python tools/evidence-grader.py --json worked-examples/cases/${c}_input.json --out /tmp/${c}.json
+  done
 
-re-generated payload digests vs published:
-  caseA  edc9b6fafba9ccf4  <span class="ok">MATCH</span>
-  caseB  995eba87beff6e7a  <span class="ok">MATCH</span>
-  caseC  faaf76277c4ac390  <span class="ok">MATCH</span></div>
+re-generated payload digests vs published (digest convention: EVALUATION-STANDARD.md §2.3):
+  caseA   fa8b1420cca29307  <span class="ok">MATCH</span>
+  caseB1  a353ad64f911030a  <span class="ok">MATCH</span>
+  caseB2  d709c4ec85ef5d6e  <span class="ok">MATCH</span>
+  caseC   982c390107058485  <span class="ok">MATCH</span></div>
     <p style="font-size:12px;color:var(--gray);margin-top:12px">
       Repository: <a href="https://github.com/LGD-Eval/evaluation-protocol" target="_blank" rel="noopener">github.com/LGD-Eval/evaluation-protocol</a> ·
       Examples: <a href="https://github.com/LGD-Eval/evaluation-protocol/tree/main/worked-examples/cases" target="_blank" rel="noopener">worked-examples/cases</a> ·
@@ -166,35 +171,233 @@ <h2>Reproduction <span class="en">clone → run → verify, from a clean checkou
 
 <script>
 var DATA = {
-  A: {
-    verdict: "Insufficient evidence（证据不足）",
-    fclass: "unresolved",
-    digest: "edc9b6fafba9ccf4",
-    ev: [
-      {d:"D1", g:"V", claim:"Registration credential issued by registrar authorized under a governance root", kind:"audit", src:"frozen test vector T-A1 + independent replay"},
-      {d:"D1", g:"V", claim:"Registrar scope verified: resource within declared registration domain", kind:"repro-test", src:"frozen test vector T-A2 + independent replay"},
-      {d:"D2", g:"V", claim:"Credential status current: no revocation, suspension or expiry at verification time", kind:"process", src:"signed status response, frozen vector T-A3"}
+  "A": {
+    "outcome": "verified",
+    "reason": "none",
+    "policy": "allow",
+    "rpa": "proceed per normal policy",
+    "verdict": "Insufficient evidence（证据不足）",
+    "fclass": "unresolved",
+    "digest": "fa8b1420cca29307",
+    "ev": [
+      {
+        "d": "D1",
+        "g": "V",
+        "claim": "Registration credential issued by registrar authorized under a governance root",
+        "kind": "audit",
+        "src": "frozen test vector T-A1 + independent replay"
+      },
+      {
+        "d": "D1",
+        "g": "V",
+        "claim": "Registrar scope verified: resource within declared registration domain",
+        "kind": "repro-test",
+        "src": "frozen test vector T-A2 + independent replay"
+      },
+      {
+        "d": "D2",
+        "g": "V",
+        "claim": "Credential status current: no revocation, suspension or expiry at verification time",
+        "kind": "process",
+        "src": "signed status response, frozen vector T-A3"
+      }
     ],
-    dom: [["D1","V","Verified"],["D2","V","Verified"],["D3","P","Pending"],["D4","P","Pending"],["D5","P","Pending"],["D6","P","Pending"]]
+    "dom": [
+      [
+        "D1",
+        "V",
+        "Verified"
+      ],
+      [
+        "D2",
+        "V",
+        "Verified"
+      ],
+      [
+        "D3",
+        "P",
+        "Pending"
+      ],
+      [
+        "D4",
+        "P",
+        "Pending"
+      ],
+      [
+        "D5",
+        "P",
+        "Pending"
+      ],
+      [
+        "D6",
+        "P",
+        "Pending"
+      ]
+    ]
   },
-  B: {
-    verdict: "Insufficient evidence（证据不足）",
-    fclass: "unresolved",
-    digest: "995eba87beff6e7a",
-    ev: [
-      {d:"D1", g:"V", claim:"Credential signature cryptographically valid", kind:"repro-test", src:"signature replay on frozen vector T-B1"},
-      {d:"D1", g:"L", claim:"Issuer authorized for this credential profile and claim type", kind:"audit", src:"issuer self-declaration only; scope registry entry unavailable"}
+  "B1": {
+    "outcome": "unresolved",
+    "reason": "authorization_unresolved",
+    "policy": "defer",
+    "rpa": "do not rely on authorization; treat per risk policy (deny-open or manual review)",
+    "verdict": "Insufficient evidence（证据不足）",
+    "fclass": "unresolved",
+    "digest": "a353ad64f911030a",
+    "ev": [
+      {
+        "d": "D1",
+        "g": "V",
+        "claim": "Credential signature cryptographically valid",
+        "kind": "repro-test",
+        "src": "signature replay on frozen vector T-B1"
+      },
+      {
+        "d": "D1",
+        "g": "L",
+        "claim": "Issuer authorized for this credential profile and claim type",
+        "kind": "audit",
+        "src": "issuer self-declaration only; authoritative scope registry entry unavailable at verification time"
+      }
     ],
-    dom: [["D1","V","Verified (but unresolved) "],["D2","P","Pending"],["D3","P","Pending"],["D4","P","Pending"],["D5","P","Pending"],["D6","P","Pending"]]
+    "dom": [
+      [
+        "D1",
+        "V",
+        "Verified"
+      ],
+      [
+        "D2",
+        "P",
+        "Pending"
+      ],
+      [
+        "D3",
+        "P",
+        "Pending"
+      ],
+      [
+        "D4",
+        "P",
+        "Pending"
+      ],
+      [
+        "D5",
+        "P",
+        "Pending"
+      ],
+      [
+        "D6",
+        "P",
+        "Pending"
+      ]
+    ]
   },
-  C: {
-    verdict: "Insufficient evidence（证据不足）",
-    fclass: "unresolved",
-    digest: "faaf76277c4ac390",
-    ev: [
-      {d:"D2", g:"L", claim:"Credential status current (not revoked)", kind:"audit", src:"status endpoint unreachable at verification time; no revocation record retrievable"}
+  "B2": {
+    "outcome": "rejected",
+    "reason": "authorization_rejected",
+    "policy": "deny",
+    "rpa": "do not accept the credential for this operation; treat as unauthorized",
+    "verdict": "Insufficient evidence（证据不足）",
+    "fclass": "unresolved",
+    "digest": "d709c4ec85ef5d6e",
+    "ev": [
+      {
+        "d": "D1",
+        "g": "V",
+        "claim": "Credential signature cryptographically valid",
+        "kind": "repro-test",
+        "src": "signature replay on frozen vector T-B2a"
+      },
+      {
+        "d": "D1",
+        "g": "V",
+        "claim": "Issuer lacks required scope for this credential profile and claim type",
+        "kind": "audit",
+        "src": "authoritative scope registry consulted at verification time; issuer not listed for this profile (frozen vector T-B2b)"
+      }
     ],
-    dom: [["D1","P","Pending"],["D2","L","Limited"],["D3","P","Pending"],["D4","P","Pending"],["D5","P","Pending"],["D6","P","Pending"]]
+    "dom": [
+      [
+        "D1",
+        "V",
+        "Verified"
+      ],
+      [
+        "D2",
+        "P",
+        "Pending"
+      ],
+      [
+        "D3",
+        "P",
+        "Pending"
+      ],
+      [
+        "D4",
+        "P",
+        "Pending"
+      ],
+      [
+        "D5",
+        "P",
+        "Pending"
+      ],
+      [
+        "D6",
+        "P",
+        "Pending"
+      ]
+    ]
+  },
+  "C": {
+    "outcome": "unresolved",
+    "reason": "status_unavailable",
+    "policy": "defer",
+    "rpa": "do not treat as revoked; do not treat as valid; escalate",
+    "verdict": "Insufficient evidence（证据不足）",
+    "fclass": "unresolved",
+    "digest": "982c390107058485",
+    "ev": [
+      {
+        "d": "D2",
+        "g": "L",
+        "claim": "Credential status current (not revoked)",
+        "kind": "audit",
+        "src": "status endpoint unreachable at verification time; no revocation record retrievable"
+      }
+    ],
+    "dom": [
+      [
+        "D1",
+        "P",
+        "Pending"
+      ],
+      [
+        "D2",
+        "L",
+        "Limited"
+      ],
+      [
+        "D3",
+        "P",
+        "Pending"
+      ],
+      [
+        "D4",
+        "P",
+        "Pending"
+      ],
+      [
+        "D5",
+        "P",
+        "Pending"
+      ],
+      [
+        "D6",
+        "P",
+        "Pending"
+      ]
+    ]
   }
 };
 function gc(g){return '<span class="g g'+g+'">'+g+'</span>'}
@@ -203,7 +406,8 @@ <h2>Reproduction <span class="en">clone → run → verify, from a clean checkou
   var ev='';
   d.ev.forEach(function(e){ ev+='<div class="ev"><div class="row">'+gc(e.g)+'<span><b>'+e.claim+'</b><span class="tag">'+e.d+' · '+e.kind+'</span></span></div><div class="row"><span class="lbl"></span><span class="src">'+e.src+'</span></div></div>'; });
   document.getElementById('evlist').innerHTML=ev;
-  document.getElementById('verdict').textContent=d.verdict;
+  document.getElementById('outcome').innerHTML='verification outcome: <b>'+d.outcome+'</b> · reason <code>'+d.reason+'</code> · policy action <b>'+d.policy+'</b>';
+  document.getElementById('verdict').textContent='coverage verdict (D1–D6): '+d.verdict;
   document.getElementById('fclass').innerHTML='<span class="fclass">failure class: '+d.fclass+'</span>';
   var rows='<table><thead><tr><th>Domain</th><th>Best grade</th><th>Interpretation</th></tr></thead><tbody>';
   d.dom.forEach(function(r){ rows+='<tr><td>'+r[0]+'</td><td>'+gc(r[1])+'</td><td>'+r[2]+'</td></tr>'; });
diff --git a/tools/demo/demo-conclusion.json b/tools/demo/demo-conclusion.json
index 0178d29..939c33b 100644
--- a/tools/demo/demo-conclusion.json
+++ b/tools/demo/demo-conclusion.json
@@ -1,154 +1,175 @@
-{
-  "schema": "lgd-eval/conclusion/v1.2",
-  "subject": "MedXpert-LLM-Library v1.6 (medical-device compliance assistant) / 示例：医械合规助手",
-  "evaluator": "LGD-Eval",
-  "timestamp": "2026-10-16T23:01:25Z",
-  "verdict": "Partially evidenced（部分有据）",
-  "overall_failure_class": "none",
-  "authorization": {
-    "result": "verified",
-    "reason": "issuer listed in authoritative scope registry for this credential profile and claim type",
-    "relying_party_action": "proceed per normal policy"
-  },
-  "no_composite_score": true,
-  "bias_controls": [
-    "multi-judge（多裁判）",
-    "human anchoring（人类锚定）",
-    "AB/BA ordering（顺序轮换）",
-    "inter-rater agreement kappa（裁判一致性）",
-    "no self-review（不自查原则）"
-  ],
-  "domains": {
-    "D1": {
-      "domain": "Identity & registration / 身份与注册",
-      "best_grade": "V",
-      "interpretation": "Verified / 确证",
-      "meaning": "Claim independently reproduced（已独立复现）",
-      "failure_class": "none",
-      "evidence_count": 2,
-      "used_evidence": [
-        {
-          "claim": "Identity registration with immutable registry entry / 身份注册留有不可变登记",
-          "grade": "V",
-          "kind": "audit",
-          "source": "zenodo v1.6.0 + .ots",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        },
-        {
-          "claim": "Delegation artefacts signed / 委托工件已签名",
-          "grade": "M",
-          "kind": "claim",
-          "source": "vendor statement",
-          "reproducible": false,
-          "timestamped": false,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D2": {
-      "domain": "Trust lifecycle / 信任生命周期",
-      "best_grade": "S",
-      "interpretation": "Strong / 强证据",
-      "meaning": "Converging method-level evidence（多方法收敛）",
-      "failure_class": "none",
-      "evidence_count": 1,
-      "used_evidence": [
-        {
-          "claim": "Lifecycle gates: establish-evaluate-degrade-revoke with evidence thresholds / 生命周期门禁各阶段带证据阈值",
-          "grade": "S",
-          "kind": "design+test",
-          "source": "lgd-theory + 28 consistency tests",
-          "reproducible": true,
-          "timestamped": false,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D3": {
-      "domain": "Security & resilience / 安全与韧性",
-      "best_grade": "V",
-      "interpretation": "Verified / 确证",
-      "meaning": "Claim independently reproduced（已独立复现）",
-      "failure_class": "none",
-      "evidence_count": 1,
-      "used_evidence": [
-        {
-          "claim": "Adversarial suite 9/9 passed (prompt-injection, mojibake, unicode confusion) / 对抗测试 9/9 通过",
-          "grade": "V",
-          "kind": "repro-test",
-          "source": "skill-audit scanner",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D4": {
-      "domain": "Privacy & data governance / 隐私与数据",
-      "best_grade": "L",
-      "interpretation": "Limited / 有限",
-      "meaning": "Anecdotal or single source（零散/单一来源）",
-      "failure_class": "none",
-      "evidence_count": 1,
-      "used_evidence": [
-        {
-          "claim": "Zero-exfiltration data handling declared / 声明零外泄数据处理",
-          "grade": "L",
-          "kind": "policy",
-          "source": "privacy notice",
-          "reproducible": false,
-          "timestamped": false,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D5": {
-      "domain": "Human oversight & accountability / 人类监督与问责",
-      "best_grade": "S",
-      "interpretation": "Strong / 强证据",
-      "meaning": "Converging method-level evidence（多方法收敛）",
-      "failure_class": "none",
-      "evidence_count": 1,
-      "used_evidence": [
-        {
-          "claim": "Human sign-off required at issuance / 签发须人类签批",
-          "grade": "S",
-          "kind": "process",
-          "source": "workflow spec + 2 audits",
-          "reproducible": true,
-          "timestamped": false,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D6": {
-      "domain": "Interoperability / 互操作性",
-      "best_grade": "S",
-      "interpretation": "Strong / 强证据",
-      "meaning": "Converging method-level evidence（多方法收敛）",
-      "failure_class": "none",
-      "evidence_count": 1,
-      "used_evidence": [
-        {
-          "claim": "Machine-readable trust metadata schema.jsonld / 机器可读信任元数据",
-          "grade": "S",
-          "kind": "interop",
-          "source": "JSON-LD schema + validator",
-          "reproducible": true,
-          "timestamped": false,
-          "failure_class": "none"
-        }
-      ]
-    }
-  },
-  "reproducibility": {
-    "open_rubric": true,
-    "evidence_appendix": true,
-    "response_window_days": 14,
-    "correction_window_hours": 24,
-    "machine_readable": true,
-    "payload_digest": "106e64ae1534df82"
-  }
+{
+  "schema": "lgd-eval/conclusion/v1.3",
+  "subject": "MedXpert-LLM-Library v1.6 (medical-device compliance assistant) / 示例：医械合规助手",
+  "evaluator": "LGD-Eval",
+  "timestamp": "2026-10-23T09:14:50Z",
+  "outcome": {
+    "verification": "verified",
+    "reason_code": "none",
+    "policy_dependent": true,
+    "policy_action": "allow",
+    "relying_party_action": "proceed per normal policy"
+  },
+  "verdict": "Partially evidenced（部分有据）",
+  "scopes": {
+    "outcome": "Case-level verification outcome for the dimension under test — read this field for the case conclusion. / 用例结论，读这个字段。",
+    "verdict": "Six-domain evidence coverage: how many of the six domains reach V/S. A case that exercises one or two domains is 'Insufficient evidence' here by construction — this is NOT a case outcome. / 六域覆盖度，不是用例结论。",
+    "overall_failure_class": "Worst evidence failure class across the six domains; an unexercised (empty) domain is 'unresolved' by v1.x design. / 空域按 v1.x 设计记为 unresolved。",
+    "policy_action": "Policy-dependent action, recorded separately from the verification outcome (allow / defer / deny / exclude), reusing the operator meanings in EVALUATION-STANDARD.md §2.2. / 策略动作，与结论分开，词表与规范一致。"
+  },
+  "overall_failure_class": "none",
+  "authorization": {
+    "result": "verified",
+    "reason_code": "none",
+    "reason": "issuer listed in authoritative scope registry for this credential profile and claim type",
+    "relying_party_action": "proceed per normal policy",
+    "policy_action": "allow"
+  },
+  "no_composite_score": true,
+  "bias_controls": [
+    "multi-judge（多裁判）",
+    "human anchoring（人类锚定）",
+    "AB/BA ordering（顺序轮换）",
+    "inter-rater agreement kappa（裁判一致性）",
+    "no self-review（不自查原则）"
+  ],
+  "domains": {
+    "D1": {
+      "domain": "Identity & registration / 身份与注册",
+      "best_grade": "V",
+      "interpretation": "Verified / 确证",
+      "meaning": "Claim independently reproduced（已独立复现）",
+      "failure_class": "none",
+      "evidence_count": 2,
+      "used_evidence": [
+        {
+          "claim": "Identity registration with immutable registry entry / 身份注册留有不可变登记",
+          "grade": "V",
+          "kind": "audit",
+          "source": "zenodo v1.6.0 + .ots",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        },
+        {
+          "claim": "Delegation artefacts signed / 委托工件已签名",
+          "grade": "M",
+          "kind": "claim",
+          "source": "vendor statement",
+          "reproducible": false,
+          "timestamped": false,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D2": {
+      "domain": "Trust lifecycle / 信任生命周期",
+      "best_grade": "S",
+      "interpretation": "Strong / 强证据",
+      "meaning": "Converging method-level evidence（多方法收敛）",
+      "failure_class": "none",
+      "evidence_count": 1,
+      "used_evidence": [
+        {
+          "claim": "Lifecycle gates: establish-evaluate-degrade-revoke with evidence thresholds / 生命周期门禁各阶段带证据阈值",
+          "grade": "S",
+          "kind": "design+test",
+          "source": "lgd-theory + 28 consistency tests",
+          "reproducible": true,
+          "timestamped": false,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D3": {
+      "domain": "Security & resilience / 安全与韧性",
+      "best_grade": "V",
+      "interpretation": "Verified / 确证",
+      "meaning": "Claim independently reproduced（已独立复现）",
+      "failure_class": "none",
+      "evidence_count": 1,
+      "used_evidence": [
+        {
+          "claim": "Adversarial suite 9/9 passed (prompt-injection, mojibake, unicode confusion) / 对抗测试 9/9 通过",
+          "grade": "V",
+          "kind": "repro-test",
+          "source": "skill-audit scanner",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D4": {
+      "domain": "Privacy & data governance / 隐私与数据",
+      "best_grade": "L",
+      "interpretation": "Limited / 有限",
+      "meaning": "Anecdotal or single source（零散/单一来源）",
+      "failure_class": "none",
+      "evidence_count": 1,
+      "used_evidence": [
+        {
+          "claim": "Zero-exfiltration data handling declared / 声明零外泄数据处理",
+          "grade": "L",
+          "kind": "policy",
+          "source": "privacy notice",
+          "reproducible": false,
+          "timestamped": false,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D5": {
+      "domain": "Human oversight & accountability / 人类监督与问责",
+      "best_grade": "S",
+      "interpretation": "Strong / 强证据",
+      "meaning": "Converging method-level evidence（多方法收敛）",
+      "failure_class": "none",
+      "evidence_count": 1,
+      "used_evidence": [
+        {
+          "claim": "Human sign-off required at issuance / 签发须人类签批",
+          "grade": "S",
+          "kind": "process",
+          "source": "workflow spec + 2 audits",
+          "reproducible": true,
+          "timestamped": false,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D6": {
+      "domain": "Interoperability / 互操作性",
+      "best_grade": "S",
+      "interpretation": "Strong / 强证据",
+      "meaning": "Converging method-level evidence（多方法收敛）",
+      "failure_class": "none",
+      "evidence_count": 1,
+      "used_evidence": [
+        {
+          "claim": "Machine-readable trust metadata schema.jsonld / 机器可读信任元数据",
+          "grade": "S",
+          "kind": "interop",
+          "source": "JSON-LD schema + validator",
+          "reproducible": true,
+          "timestamped": false,
+          "failure_class": "none"
+        }
+      ]
+    }
+  },
+  "reproducibility": {
+    "open_rubric": true,
+    "evidence_appendix": true,
+    "response_window_days": 14,
+    "correction_window_hours": 24,
+    "machine_readable": true,
+    "digest_covers": [
+      "domains",
+      "authorization",
+      "outcome"
+    ],
+    "digest_convention": "sha256(json.dumps(obj, sort_keys=True, separators=(\",\", \":\"), ensure_ascii=False))[:16] — EVALUATION-STANDARD.md §2.3",
+    "payload_digest": "85553ea3d90ea4b2"
+  }
 }
\ No newline at end of file
diff --git a/tools/demo/demo-conclusion.md b/tools/demo/demo-conclusion.md
index 7a93e9c..9cca393 100644
--- a/tools/demo/demo-conclusion.md
+++ b/tools/demo/demo-conclusion.md
@@ -1,35 +1,41 @@
-# LGD-Eval Assessment Conclusion / 评估结论
-
-- **Subject / 评估对象**: MedXpert-LLM-Library v1.6 (medical-device compliance assistant) / 示例：医械合规助手
-- **Evaluator / 评估方**: LGD-Eval
-- **Timestamp / 时间戳**: 2026-10-16T23:01:25Z
-- **Verdict / 总体判词**: Partially evidenced（部分有据）
-- **Overall failure class / 总体失败类**: none
-- **No composite score / 无复合分**: True（域级独立评分，禁止复合）
-- **Bias controls / 偏倚控制**: multi-judge（多裁判）; human anchoring（人类锚定）; AB/BA ordering（顺序轮换）; inter-rater agreement kappa（裁判一致性）; no self-review（不自查原则）
-
-## Domain-level results / 域级结果
-
-| Domain / 域 | Best grade / 最高级别 | Failure class / 失败类 | Interpretation / 解读 | Evidence / 证据数 |
-|---|---|---|---|---|
-| D1 · Identity & registration / 身份与注册 | V | none | Verified / 确证 | 2 |
-| D2 · Trust lifecycle / 信任生命周期 | S | none | Strong / 强证据 | 1 |
-| D3 · Security & resilience / 安全与韧性 | V | none | Verified / 确证 | 1 |
-| D4 · Privacy & data governance / 隐私与数据 | L | none | Limited / 有限 | 1 |
-| D5 · Human oversight & accountability / 人类监督与问责 | S | none | Strong / 强证据 | 1 |
-| D6 · Interoperability / 互操作性 | S | none | Strong / 强证据 | 1 |
-
-## Failure semantics / 失败语义
-- quarantined（隔离）: malformed input — missing claim or invalid grade
-- rejected（拒绝）: grade=P, not yet testable
-- unresolved（未决）: verifiable kind without reproducible/timestamped evidence, or empty domain
-- none（无失败）: evidence accepted
-
-## Reproducibility / 可复现
-- open rubric（公开细则）: True
-- evidence appendix（证据附录）: True
-- response window（回应期）: 14 days / 24h corrections
-- machine-readable（机器可读）: True
-- payload digest（载荷摘要）: `106e64ae1534df82`
-
+# LGD-Eval Assessment Conclusion / 评估结论
+
+- **Subject / 评估对象**: MedXpert-LLM-Library v1.6 (medical-device compliance assistant) / 示例：医械合规助手
+- **Evaluator / 评估方**: LGD-Eval
+- **Timestamp / 时间戳**: 2026-10-23T09:14:50Z
+- **Outcome / 用例结论**: **verified** (reason `none`; policy action `allow`)
+- **Relying-party action / 依赖方动作**: proceed per normal policy
+- **Evidence-coverage verdict / 覆盖度判词**: Partially evidenced（部分有据）
+- **Overall failure class / 总体失败类**: none
+- **No composite score / 无复合分**: True（域级独立评分，禁止复合）
+- **Bias controls / 偏倚控制**: multi-judge（多裁判）; human anchoring（人类锚定）; AB/BA ordering（顺序轮换）; inter-rater agreement kappa（裁判一致性）; no self-review（不自查原则）
+
+> `verdict` 是六域覆盖度判词，不是用例结论；用例结论读 `outcome.verification`。
+> `verdict` is six-domain evidence coverage, not a case outcome; read `outcome.verification`.
+
+## Domain-level results / 域级结果
+
+| Domain / 域 | Best grade / 最高级别 | Failure class / 失败类 | Interpretation / 解读 | Evidence / 证据数 |
+|---|---|---|---|---|
+| D1 · Identity & registration / 身份与注册 | V | none | Verified / 确证 | 2 |
+| D2 · Trust lifecycle / 信任生命周期 | S | none | Strong / 强证据 | 1 |
+| D3 · Security & resilience / 安全与韧性 | V | none | Verified / 确证 | 1 |
+| D4 · Privacy & data governance / 隐私与数据 | L | none | Limited / 有限 | 1 |
+| D5 · Human oversight & accountability / 人类监督与问责 | S | none | Strong / 强证据 | 1 |
+| D6 · Interoperability / 互操作性 | S | none | Strong / 强证据 | 1 |
+
+## Failure semantics / 失败语义
+- quarantined（隔离）: malformed input — missing claim or invalid grade
+- rejected（拒绝）: grade=P, not yet testable
+- unresolved（未决）: verifiable kind without reproducible/timestamped evidence, or empty domain
+- none（无失败）: evidence accepted
+
+## Reproducibility / 可复现
+- open rubric（公开细则）: True
+- evidence appendix（证据附录）: True
+- response window（回应期）: 14 days / 24h corrections
+- machine-readable（机器可读）: True
+- digest covers（摘要覆盖）: domains + authorization + outcome
+- payload digest（载荷摘要）: `85553ea3d90ea4b2`
+
 *Generated by LGD-Eval evidence-grader（由证据分级器生成）；结论受证据级别约束，欢迎独立复现。*
\ No newline at end of file
diff --git a/tools/evidence-grader.py b/tools/evidence-grader.py
index 8e84ed7..bf4e13c 100644
--- a/tools/evidence-grader.py
+++ b/tools/evidence-grader.py
@@ -38,11 +38,37 @@
 -----------------------------------------------------------------------------
 证据分级与授权有效性是两个独立维度（见 FG-TIDA/use-cases#27 讨论与 themes#42）。
 输入 JSON 可选携带 case 级 authorization 对象：
-- result（必填）: verified / unresolved / rejected / quarantined
-- reason（必填）: 机器可读原因码/说明
+- result（必填）: verified / unresolved / rejected
+- reason_code（v1.3 起必填）: 机器可读原因码，见 REASON_CODES
+- reason（必填）: 人读说明
 - relying_party_action（可选）: 依赖方可执行动作
+- policy_action（v1.3 起必填）: allow / defer / deny / exclude（取 EVALUATION-STANDARD.md §2.2）
 关键语义：授权信息缺失（unresolved）绝不等于已证实越权（rejected）。
-payload_digest 计算纳入 authorization，端到端可复现。
+
+Case outcome / 用例结论（v1.3 新增，对应 FG-TIDA use-cases#27 @wolfbrother 2026-10-23 反馈）
+--------------------------------------------------------------------------------------------
+v1.2 的结论里只有一个 `verdict`，它是**六域证据覆盖度**判词（六个域里有几个达到 V/S），
+不是用例结论。一个只覆盖 1—2 个域的用例，`verdict` 必然是 `Insufficient evidence`，
+哪怕它的授权结论是 `verified`——程序若读 `verdict` 当结论，会把正例读成"证据不足"。
+
+v1.3 起把两件事分开写：
+- `outcome.verification` : 用例结论，三态 verified / unresolved / rejected，**这是要读的字段**；
+- `verdict`              : 保留原义（六域覆盖度），并由 `scopes` 显式标注其口径。
+
+同时把"策略动作"从"验证结论"里拆出来（@wolfbrother 的第三点）：
+- `quarantined` 不再出现在 authorization.result 里——它是处置动作，不是验证结论；
+- 处置动作统一进 `policy_action`，**直接采用 EVALUATION-STANDARD.md §2.2 已公布的四个词**：
+  allow / defer / deny / exclude（原文的 ALLOW / DEFER / DENY / EXCLUDE）。
+  不再另造一套（v1.3 起；此前只把动作写成自由文本 `relying_party_action`，机器不可读）。
+  刻意**不用** reject 当动作名，避免与结论词 rejected 撞车。
+
+payload_digest 采取 EVALUATION-STANDARD.md §2.3 已经写明的算法：
+    SHA-256( json.dumps(obj, sort_keys=True, separators=(",",":"), ensure_ascii=False) )[:16]
+v1.2 的实现与 §2.3 不一致（用了默认分隔符 ", " / ": " 且未排序键），
+后果是任何第三方照 §2.3 自己算一遍都得不到我们公布的摘要；v1.3 予以更正。
+摘要覆盖 domains + authorization + outcome 三个实质对象；`verdict` 与
+`overall_failure_class` 是 domains 的纯函数，可由摘要覆盖的内容重算；
+`timestamp` 不进摘要，以保证任何一天复现都得到同一摘要。
 
 Usage / 用法
 -------------
@@ -55,12 +81,16 @@
 
 Author / 作者: LGD-Eval（Independent Evaluation）
 License / 许可: Apache-2.0
-Version / 版本: v1.2 — authorization validity dimension added（授权有效性维度已加入；对应 themes#42 评审反馈）
+Version / 版本: v1.3 — case outcome separated from domain-coverage verdict; policy actions
+                 split out of the verification vocabulary（用例结论与覆盖度判词分离；策略动作
+                 从验证词表中拆出；对应 use-cases#27 @wolfbrother 2026-10-23 反馈）
 """
 from __future__ import annotations
 import argparse, json, sys, hashlib, datetime
 from collections import OrderedDict
 
+SCHEMA = "lgd-eval/conclusion/v1.3"
+
 # Domain definitions / 六域定义（与 C2 贡献稿一致）
 DOMAINS = OrderedDict([
     ("D1", "Identity & registration / 身份与注册"),
@@ -77,8 +107,23 @@
 FAIL_CLASSES = ["quarantined", "rejected", "unresolved", "none"]
 FAIL_ORDER = {c: i for i, c in enumerate(FAIL_CLASSES)}
 
-# Authorization validity results / 授权有效性结果（独立维度，v1.2）
-AUTH_RESULTS = ["verified", "unresolved", "rejected", "quarantined"]
+# Verification vocabulary / 验证词表（单一词表，结论与授权共用同一套三个词）
+AUTH_RESULTS = ["verified", "unresolved", "rejected"]
+OUTCOMES = ["verified", "unresolved", "rejected"]
+AUTH_TO_OUTCOME = {"verified": "verified", "unresolved": "unresolved", "rejected": "rejected"}
+
+# Machine-readable reason codes / 机器可读原因码
+REASON_CODES = ["none", "authorization_unresolved", "authorization_rejected", "status_unavailable"]
+REASON_FOR_RESULT = {
+    "verified": ["none"],
+    "unresolved": ["authorization_unresolved", "status_unavailable"],
+    "rejected": ["authorization_rejected"],
+}
+
+# Policy actions / 处置动作（策略相关，与验证结论分开记录）
+# 取自 EVALUATION-STANDARD.md §2.2 的 operator meaning，不另造词表
+POLICY_ACTIONS = ["allow", "defer", "deny", "exclude"]
+
 # 本应可验证的证据类型（若缺少可复现/时间戳则链路未确认）
 VERIFIABLE_KINDS = {"audit", "repro-test", "design+test", "process", "interop"}
 
@@ -101,6 +146,20 @@
           "evidence": "Explicit scope statement（明确范围声明）"},
 }
 
+# Field scopes / 字段口径（防止把覆盖度判词当用例结论读）
+SCOPES = OrderedDict([
+    ("outcome", "Case-level verification outcome for the dimension under test — "
+                "read this field for the case conclusion. / 用例结论，读这个字段。"),
+    ("verdict", "Six-domain evidence coverage: how many of the six domains reach V/S. "
+                "A case that exercises one or two domains is 'Insufficient evidence' here "
+                "by construction — this is NOT a case outcome. / 六域覆盖度，不是用例结论。"),
+    ("overall_failure_class", "Worst evidence failure class across the six domains; an "
+                              "unexercised (empty) domain is 'unresolved' by v1.x design. "
+                              "/ 空域按 v1.x 设计记为 unresolved。"),
+    ("policy_action", "Policy-dependent action, recorded separately from the verification "
+                      "outcome (allow / defer / deny / exclude), reusing the operator meanings in EVALUATION-STANDARD.md §2.2. / 策略动作，与结论分开，词表与规范一致。"),
+])
+
 BIAS_CONTROLS = [
     "multi-judge（多裁判）", "human anchoring（人类锚定）", "AB/BA ordering（顺序轮换）",
     "inter-rater agreement kappa（裁判一致性）", "no self-review（不自查原则）",
@@ -136,11 +195,33 @@ def validate(evidence: dict) -> list:
         if not isinstance(auth, dict):
             errors.append("'authorization' must be an object (authorization 必须是对象)")
         else:
-            if auth.get("result") not in AUTH_RESULTS:
-                errors.append("authorization.result must be one of verified/unresolved/rejected/quarantined"
-                              " (授权结果必须是四态之一)")
+            res = auth.get("result")
+            if res not in AUTH_RESULTS:
+                errors.append(
+                    "authorization.result must be one of verified/unresolved/rejected "
+                    "(v1.3: 'quarantined' is a policy action, not a verification outcome — "
+                    "record it in authorization.policy_action as 'hold')"
+                    " (授权结果必须是三态之一)")
             if not auth.get("reason"):
                 errors.append("authorization.reason is required (授权原因必填)")
+            code = auth.get("reason_code")
+            if code is None:
+                errors.append("authorization.reason_code is required"
+                              " (v1.3 起必填：机器可读原因码)")
+            elif code not in REASON_CODES:
+                errors.append("authorization.reason_code must be one of %s"
+                              % "/".join(REASON_CODES))
+            elif res in REASON_FOR_RESULT and code not in REASON_FOR_RESULT[res]:
+                errors.append("authorization.reason_code %r inconsistent with result %r "
+                              "(allowed: %s)"
+                              % (code, res, "/".join(REASON_FOR_RESULT[res])))
+            action = auth.get("policy_action")
+            if action is None:
+                errors.append("authorization.policy_action is required"
+                              " (v1.3 起必填：allow/defer/deny/exclude，见 EVALUATION-STANDARD.md §2.2)")
+            elif action not in POLICY_ACTIONS:
+                errors.append("authorization.policy_action must be one of %s"
+                              % "/".join(POLICY_ACTIONS))
     return errors
 
 
@@ -149,6 +230,13 @@ def digest_of(text: str) -> str:
     return hashlib.sha256(text.encode("utf-8")).hexdigest()[:16]
 
 
+def digest_of_canonical(obj) -> str:
+    """Canonical payload digest, exactly as written in EVALUATION-STANDARD.md §2.3
+    （规范 §2.3 原文约定的算法：排序键 + 紧凑分隔符 + ensure_ascii=False，取前 16 位）.
+    """
+    return digest_of(json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False))
+
+
 def grade_domain(items: list) -> tuple:
     """Domain-level best grade + evidence list（域级最高证据级别 + 证据清单）."""
     if not items:
@@ -184,6 +272,35 @@ def domain_failure_class(items: list) -> str:
     return worst
 
 
+def normalise_authorization(auth) -> "OrderedDict | None":
+    """Fixed key order so that key order in the input cannot change the digest
+    （固定键序，输入文件键序变化不影响摘要）."""
+    if not auth:
+        return None
+    return OrderedDict([
+        ("result", auth.get("result")),
+        ("reason_code", auth.get("reason_code")),
+        ("reason", auth.get("reason")),
+        ("relying_party_action", auth.get("relying_party_action", "")),
+        ("policy_action", auth.get("policy_action")),
+    ])
+
+
+def build_outcome(auth) -> "OrderedDict | None":
+    """Project the case-level outcome from the authorization dimension.
+    结论由授权维度投影而来，因此两者在结构上不可能互相矛盾。
+    """
+    if not auth:
+        return None
+    return OrderedDict([
+        ("verification", AUTH_TO_OUTCOME.get(auth.get("result"), "unresolved")),
+        ("reason_code", auth.get("reason_code")),
+        ("policy_dependent", True),
+        ("policy_action", auth.get("policy_action")),
+        ("relying_party_action", auth.get("relying_party_action", "")),
+    ])
+
+
 def conclude(evidence: dict, subject: str, evaluator: str = "LGD-Eval") -> dict:
     """Produce machine-readable conclusion（生成机器可读结论）."""
     domain_results = OrderedDict()
@@ -214,13 +331,16 @@ def conclude(evidence: dict, subject: str, evaluator: str = "LGD-Eval") -> dict:
         if FAIL_ORDER[r["failure_class"]] < FAIL_ORDER[overall_fc]:
             overall_fc = r["failure_class"]
     now = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-    auth = evidence.get("authorization")
+    auth = normalise_authorization(evidence.get("authorization"))
+    outcome = build_outcome(evidence.get("authorization"))
     payload = OrderedDict([
-        ("schema", "lgd-eval/conclusion/v1.2"),
+        ("schema", SCHEMA),
         ("subject", subject),
         ("evaluator", evaluator),
         ("timestamp", now),
+        ("outcome", outcome),
         ("verdict", verdict),
+        ("scopes", SCOPES),
         ("overall_failure_class", overall_fc),
         ("authorization", auth),
         ("no_composite_score", True),
@@ -229,9 +349,13 @@ def conclude(evidence: dict, subject: str, evaluator: str = "LGD-Eval") -> dict:
         ("reproducibility", {
             "open_rubric": True, "evidence_appendix": True, "response_window_days": 14,
             "correction_window_hours": 24, "machine_readable": True,
-            "payload_digest": digest_of(json.dumps(
-                OrderedDict([("domains", domain_results), ("authorization", auth)]),
-                ensure_ascii=False)),
+            "digest_covers": ["domains", "authorization", "outcome"],
+            "digest_convention": "sha256(json.dumps(obj, sort_keys=True, "
+                                 "separators=(\",\", \":\"), ensure_ascii=False))[:16] "
+                                 "— EVALUATION-STANDARD.md §2.3",
+            "payload_digest": digest_of_canonical(
+                OrderedDict([("domains", domain_results), ("authorization", auth),
+                             ("outcome", outcome)])),
         }),
     ])
     return payload
@@ -239,17 +363,24 @@ def conclude(evidence: dict, subject: str, evaluator: str = "LGD-Eval") -> dict:
 
 def to_markdown(c: dict) -> str:
     """Render conclusion as bilingual Markdown（渲染为双语 Markdown）."""
+    o = c.get("outcome") or {}
     lines = [
         "# LGD-Eval Assessment Conclusion / 评估结论",
         "",
         "- **Subject / 评估对象**: %s" % c["subject"],
         "- **Evaluator / 评估方**: %s" % c["evaluator"],
         "- **Timestamp / 时间戳**: %s" % c["timestamp"],
-        "- **Verdict / 总体判词**: %s" % c["verdict"],
+        "- **Outcome / 用例结论**: **%s** (reason `%s`; policy action `%s`)"
+        % (o.get("verification", "—"), o.get("reason_code", "—"), o.get("policy_action", "—")),
+        "- **Relying-party action / 依赖方动作**: %s" % o.get("relying_party_action", "—"),
+        "- **Evidence-coverage verdict / 覆盖度判词**: %s" % c["verdict"],
         "- **Overall failure class / 总体失败类**: %s" % c["overall_failure_class"],
         "- **No composite score / 无复合分**: True（域级独立评分，禁止复合）",
         "- **Bias controls / 偏倚控制**: %s" % ("; ".join(c["bias_controls"])),
         "",
+        "> `verdict` 是六域覆盖度判词，不是用例结论；用例结论读 `outcome.verification`。",
+        "> `verdict` is six-domain evidence coverage, not a case outcome; read `outcome.verification`.",
+        "",
         "## Domain-level results / 域级结果",
         "",
         "| Domain / 域 | Best grade / 最高级别 | Failure class / 失败类 | Interpretation / 解读 | Evidence / 证据数 |",
@@ -267,6 +398,7 @@ def to_markdown(c: dict) -> str:
               "- evidence appendix（证据附录）: True",
               "- response window（回应期）: 14 days / 24h corrections",
               "- machine-readable（机器可读）: True",
+              "- digest covers（摘要覆盖）: domains + authorization + outcome",
               "- payload digest（载荷摘要）: `%s`" % c["reproducibility"]["payload_digest"],
               "",
               "*Generated by LGD-Eval evidence-grader（由证据分级器生成）；结论受证据级别约束，欢迎独立复现。*",
@@ -307,85 +439,165 @@ def to_markdown(c: dict) -> str:
     },
     "authorization": {
         "result": "verified",
+        "reason_code": "none",
         "reason": "issuer listed in authoritative scope registry for this credential profile and claim type",
         "relying_party_action": "proceed per normal policy",
+        "policy_action": "allow",
     },
 }
 
 
 def run_selftest() -> int:
-    """Assertion tests（断言自检）: rule invariants + failure semantics."""
+    """Assertion tests（断言自检）: rule invariants + failure semantics.
+    断言数由计数器统计，打印的数字是真实执行的断言条数，不是手写的。
+    """
     errs = []
-    # 1. Validation catches bad grade / 校验捕获非法级别
+    n = [0]
+
+    def check(cond, msg):
+        n[0] += 1
+        if not cond:
+            errs.append(msg)
+
+    # --- 输入校验 ---
     bad = {"subject": "x", "domains": {"D1": [{"claim": "c", "grade": "X"}]}}
-    if not validate(bad):
-        errs.append("selftest 1: bad grade not rejected")
-    # 2. Domain best-grade logic / 域级取最高
+    check(bool(validate(bad)), "1: bad grade not rejected")
+
+    # --- 域级取最高 ---
     items = [{"claim": "a", "grade": "M"}, {"claim": "b", "grade": "V"}, {"claim": "c", "grade": "S"}]
     best, _ = grade_domain(items)
-    if best != "V":
-        errs.append("selftest 2: best-grade logic failed (%s)" % best)
-    # 3. Empty domain -> Pending + unresolved / 空域 -> Pending 且 failure=unresolved
+    check(best == "V", "2: best-grade logic failed (%s)" % best)
+
+    # --- 空域 ---
     best2, _ = grade_domain([])
-    if best2 != "P":
-        errs.append("selftest 3: empty domain should be P")
-    if domain_failure_class([]) != "unresolved":
-        errs.append("selftest 3b: empty domain failure class should be unresolved")
-    # 4. Conclusion shape / 结论结构
+    check(best2 == "P", "3: empty domain should be P")
+    check(domain_failure_class([]) == "unresolved", "4: empty domain failure class should be unresolved")
+
+    # --- 结论结构 ---
     c = conclude(DEMO, DEMO["subject"])
-    if c["no_composite_score"] is not True:
-        errs.append("selftest 4: composite discipline broken")
-    if len(c["domains"]) != 6:
-        errs.append("selftest 5: domain count != 6")
-    if c["schema"] != "lgd-eval/conclusion/v1.2":
-        errs.append("selftest 5b: schema version not v1.2")
-    # 5. Deterministic digest / 摘要确定性
-    if digest_of("abc") != digest_of("abc"):
-        errs.append("selftest 6: digest not deterministic")
-    # 6. Failure semantics / 失败语义四态
-    if evidence_failure_class({"claim": "", "grade": "V"}) != "quarantined":
-        errs.append("selftest 7: missing claim should be quarantined")
-    if evidence_failure_class({"claim": "c", "grade": "P"}) != "rejected":
-        errs.append("selftest 8: grade P should be rejected")
-    if evidence_failure_class({"claim": "c", "grade": "S", "kind": "audit",
-                               "reproducible": False, "timestamped": False}) != "unresolved":
-        errs.append("selftest 9: verifiable kind without repro/ts should be unresolved")
-    if evidence_failure_class({"claim": "c", "grade": "L", "kind": "policy",
-                               "reproducible": False, "timestamped": False}) != "none":
-        errs.append("selftest 10: declarative kind should be none")
-    if "overall_failure_class" not in c or c["overall_failure_class"] != "none":
-        errs.append("selftest 11: overall failure class should be none for demo")
-    if "failure_class" not in c["domains"]["D4"] or c["domains"]["D4"]["failure_class"] != "none":
-        errs.append("selftest 12: D4 policy evidence failure class should be none")
-    # 13. Authorization validity dimension / 授权维度校验与透传
-    if c["schema"] != "lgd-eval/conclusion/v1.2":
-        errs.append("selftest 13: schema version not v1.2")
-    if not c.get("authorization") or c["authorization"].get("result") != "verified":
-        errs.append("selftest 13b: authorization validity not carried into conclusion")
+    check(c["no_composite_score"] is True, "5: composite discipline broken")
+    check(len(c["domains"]) == 6, "6: domain count != 6")
+    check(c["schema"] == SCHEMA, "7: schema version not %s" % SCHEMA)
+
+    # --- 摘要确定性 ---
+    check(digest_of("abc") == digest_of("abc"), "8: digest not deterministic")
+
+    # --- 失败语义四态 ---
+    check(evidence_failure_class({"claim": "", "grade": "V"}) == "quarantined",
+          "9: missing claim should be quarantined")
+    check(evidence_failure_class({"claim": "c", "grade": "P"}) == "rejected",
+          "10: grade P should be rejected")
+    check(evidence_failure_class({"claim": "c", "grade": "S", "kind": "audit",
+                                  "reproducible": False, "timestamped": False}) == "unresolved",
+          "11: verifiable kind without repro/ts should be unresolved")
+    check(evidence_failure_class({"claim": "c", "grade": "L", "kind": "policy",
+                                  "reproducible": False, "timestamped": False}) == "none",
+          "12: declarative kind should be none")
+    check(c["overall_failure_class"] == "none", "13: overall failure class should be none for demo")
+    check(c["domains"]["D4"]["failure_class"] == "none",
+          "14: D4 policy evidence failure class should be none")
+
+    # --- 授权维度透传 ---
+    check(bool(c.get("authorization")) and c["authorization"]["result"] == "verified",
+          "15: authorization validity not carried into conclusion")
     bad_auth = {"subject": "x", "domains": {"D1": [{"claim": "c", "grade": "V"}]},
-                "authorization": {"result": "bogus", "reason": "r"}}
-    if not validate(bad_auth):
-        errs.append("selftest 13c: invalid authorization result not rejected")
-    # 14. B1 vs B2 separation / missing evidence of authorization ≠ demonstrated invalid authorization
+                "authorization": {"result": "bogus", "reason": "r",
+                                  "reason_code": "none", "policy_action": "allow"}}
+    check(bool(validate(bad_auth)), "16: invalid authorization result not rejected")
+
+    # --- v1.3：quarantined 不再是验证结论 ---
+    q_auth = {"subject": "x", "domains": {"D1": [{"claim": "c", "grade": "V"}]},
+              "authorization": {"result": "quarantined", "reason": "spec undecided",
+                                "reason_code": "none", "policy_action": "exclude"}}
+    check(bool(validate(q_auth)),
+          "17: v1.3 must reject 'quarantined' as a verification outcome (it is a policy action)")
+    check("quarantined" not in AUTH_RESULTS, "17b: AUTH_RESULTS must not contain 'quarantined'")
+
+    # --- v1.3：reason_code 必填且必须与 result 自洽 ---
+    no_code = {"subject": "x", "domains": {"D1": [{"claim": "c", "grade": "V"}]},
+               "authorization": {"result": "verified", "reason": "r", "policy_action": "allow"}}
+    check(bool(validate(no_code)), "18: missing reason_code not rejected")
+    mismatch = {"subject": "x", "domains": {"D1": [{"claim": "c", "grade": "V"}]},
+                "authorization": {"result": "rejected", "reason": "r",
+                                  "reason_code": "none", "policy_action": "deny"}}
+    check(bool(validate(mismatch)), "19: reason_code inconsistent with result not rejected")
+    bad_action = {"subject": "x", "domains": {"D1": [{"claim": "c", "grade": "V"}]},
+                  "authorization": {"result": "verified", "reason": "r",
+                                    "reason_code": "none", "policy_action": "reject"}}
+    check(bool(validate(bad_action)),
+          "20: policy_action 'reject' not rejected (word reserved for the outcome vocabulary)")
+
+    # --- B1 vs B2 ---
     b1 = {"subject": "B1", "domains": {"D1": [{"claim": "sig", "grade": "V", "kind": "repro-test",
-                                                "reproducible": True, "timestamped": True}]},
-          "authorization": {"result": "unresolved", "reason": "scope info unavailable"}}
+                                               "reproducible": True, "timestamped": True}]},
+          "authorization": {"result": "unresolved", "reason": "scope info unavailable",
+                            "reason_code": "authorization_unresolved", "policy_action": "defer"}}
     b2 = {"subject": "B2", "domains": {"D1": [{"claim": "sig", "grade": "V", "kind": "repro-test",
-                                                "reproducible": True, "timestamped": True}]},
-          "authorization": {"result": "rejected", "reason": "scope registry confirms lack of scope"}}
+                                               "reproducible": True, "timestamped": True}]},
+          "authorization": {"result": "rejected", "reason": "scope registry confirms lack of scope",
+                            "reason_code": "authorization_rejected", "policy_action": "deny"}}
     c1, c2 = conclude(b1, "B1"), conclude(b2, "B2")
-    if c1["authorization"]["result"] != "unresolved" or c2["authorization"]["result"] != "rejected":
-        errs.append("selftest 14: B1/B2 authorization separation broken")
-    if c1["reproducibility"]["payload_digest"] == c2["reproducibility"]["payload_digest"]:
-        errs.append("selftest 14b: B1/B2 digests must differ (authorization enters digest)")
-    # 15. Digest determinism including authorization / 摘要确定性（含授权维度）
-    if conclude(b1, "B1")["reproducibility"]["payload_digest"] != c1["reproducibility"]["payload_digest"]:
-        errs.append("selftest 15: digest not deterministic with authorization")
+    check(c1["authorization"]["result"] == "unresolved" and c2["authorization"]["result"] == "rejected",
+          "21: B1/B2 authorization separation broken")
+    check(c1["reproducibility"]["payload_digest"] != c2["reproducibility"]["payload_digest"],
+          "22: B1/B2 digests must differ (authorization enters digest)")
+    check(c1["outcome"]["verification"] == "unresolved" and c2["outcome"]["verification"] == "rejected",
+          "23: B1/B2 case outcomes must differ")
+
+    # --- 摘要确定性（含授权维度）---
+    check(conclude(b1, "B1")["reproducibility"]["payload_digest"] == c1["reproducibility"]["payload_digest"],
+          "24: digest not deterministic with authorization")
+
+    # --- v1.3：结论字段存在且与覆盖度判词分离 ---
+    check(c["outcome"]["verification"] == "verified", "25: demo outcome should be 'verified'")
+    n_vs = sum(1 for r in c["domains"].values() if r["best_grade"] in ("V", "S"))
+    check(n_vs == 5 and c["verdict"] == "Partially evidenced（部分有据）",
+          "26: demo coverage should be 5/6 -> 'Partially evidenced' (got %d/6, %s)"
+          % (n_vs, c["verdict"]))
+    b1_v = conclude(b1, "B1")
+    check(b1_v["verdict"] == "Insufficient evidence（证据不足）" and b1_v["outcome"]["verification"] == "unresolved",
+          "27: coverage verdict and case outcome must be separable (B1: insufficient coverage, unresolved outcome)")
+
+    # --- v1.3：摘要覆盖 outcome；单改 policy_action 会改变摘要 ---
+    check(c["reproducibility"]["digest_covers"] == ["domains", "authorization", "outcome"],
+          "28: digest_covers must list domains/authorization/outcome")
+    b1b = json.loads(json.dumps(b1))
+    b1b["authorization"]["policy_action"] = "deny"
+    check(conclude(b1b, "B1")["reproducibility"]["payload_digest"] != c1["reproducibility"]["payload_digest"],
+          "29: changing policy_action alone must change the digest")
+
+    # --- v1.3：键序归一化（输入键序不影响摘要）---
+    shuffled = OrderedDict()
+    shuffled["subject"] = b1["subject"]
+    shuffled["authorization"] = OrderedDict(reversed(list(b1["authorization"].items())))
+    shuffled["domains"] = b1["domains"]
+    check(conclude(shuffled, "B1")["reproducibility"]["payload_digest"] == c1["reproducibility"]["payload_digest"],
+          "30: key order in input must not change the digest")
+
+    # --- v1.3：scopes 口径齐全 ---
+    check(all(k in c["scopes"] for k in ("outcome", "verdict", "overall_failure_class", "policy_action")),
+          "31: scopes must document outcome/verdict/overall_failure_class/policy_action")
+
+    # --- v1.3：摘要算法必须与 EVALUATION-STANDARD.md §2.3 逐字一致 ---
+    independent = hashlib.sha256(json.dumps(
+        OrderedDict([("domains", c["domains"]),
+                     ("authorization", c["authorization"]),
+                     ("outcome", c["outcome"])]),
+        sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")).hexdigest()[:16]
+    check(c["reproducibility"]["payload_digest"] == independent,
+          "32: digest must equal the §2.3 convention computed independently")
+    check("§2.3" in c["reproducibility"].get("digest_convention", ""),
+          "33: reproducibility must state which digest convention is used")
+
+    # --- v1.3：处置词表 = 规范 §2.2 的四个词，一个不多一个不少 ---
+    check(POLICY_ACTIONS == ["allow", "defer", "deny", "exclude"],
+          "34: policy actions must be exactly the four operator meanings in §2.2")
+
     if errs:
         for e in errs:
             print("FAIL: %s" % e)
         return 1
-    print("SELFTEST OK — 15 invariants passed（15 项不变量全部通过）")
+    print("SELFTEST OK — %d invariants passed（%d 项不变量全部通过）" % (n[0], n[0]))
     return 0
 
 
diff --git a/worked-examples/cases/README.md b/worked-examples/cases/README.md
index 645b2c9..a52f2ff 100644
--- a/worked-examples/cases/README.md
+++ b/worked-examples/cases/README.md
@@ -1,22 +1,42 @@
 # Worked Examples — Four Implementation-Neutral Cases
 
-Machine-readable conclusions and reproduction inputs for the cases discussed in [FG-TIDA/use-cases#27](https://github.com/FG-TIDA/use-cases/issues/27), generated with the reference tool `tools/evidence-grader.py` (v1.2, SHA-256 `98C9C1F6FABA8E1E688D0CE01FF35C3715EF51EC25072685B23A8782A1C9C91B`, Apache-2.0).
+Machine-readable conclusions and reproduction inputs for the cases discussed in [FG-TIDA/use-cases#27](https://github.com/FG-TIDA/use-cases/issues/27), generated with the reference tool `tools/evidence-grader.py` (v1.3, SHA-256 `06C89E1BA30E4C331058AB90511B6DEA62D8641A8AB15D284BCAFD4005925098` (computed over the server-side LF bytes, 34795 B), Apache-2.0).
 
 The former "Case B — Out-of-scope issuer" has been split into **B1** and **B2** per the [themes#42 review](https://github.com/FG-TIDA/themes/issues/42): missing evidence of authorization (B1, `unresolved`) must never be treated as equivalent to demonstrated invalid authorization (B2, `rejected`).
 
-| Case | Input (JSON) | Outcome | Reason | Relying-party action |
-|---|---|---|---|---|
-| A. Valid registered credential | `caseA_valid_registered_credential_input.json` | **positive** | `none` | proceed per normal policy |
-| B1. Unverifiable issuer scope (signature valid) | `caseB1_unverifiable_issuer_scope_input.json` | **indeterminate** | `authorization unresolved` — missing evidence of authorization ≠ demonstrated invalid authorization | do not rely on authorization; treat per risk policy (deny-open or manual review) |
-| B2. Confirmed out-of-scope issuer (signature valid) | `caseB2_confirmed_out_of_scope_issuer_input.json` | **rejected** | `authorization rejected` — authoritative scope registry confirms the issuer lacks the required scope | do not accept the credential for this operation; treat as unauthorized |
-| C. Status source unavailable | `caseC_unavailable_status_source_input.json` | **indeterminate** | `status unavailable ≠ revoked` | do not treat as revoked; do not treat as valid; escalate |
+## One vocabulary
+
+Earlier versions of this page, the conclusion JSON and the thread discussion used three different word sets for the same three states. As of v1.3 there is one canonical set, and it is the field to read in the machine-readable conclusion:
+
+| Canonical (v1.3) | Field | Words used previously | Meaning |
+|---|---|---|---|
+| **`verified`** | `outcome.verification` | positive / valid / ALLOW | Authorization established and current |
+| **`unresolved`** | `outcome.verification` | indeterminate / unverifiable / DEFER | Authorization cannot be established — *not* the same as not authorized |
+| **`rejected`** | `outcome.verification` | invalid / unauthorized / DENY | Authorization affirmatively not valid — established by evidence, not inferred from absence |
+
+Read `outcome.verification`, not `verdict` — see [Why `verdict` is not the case outcome](#why-verdict-is-not-the-case-outcome).
+
+Policy-dependent handling is recorded **separately** from the verification outcome, in `outcome.policy_action`, using the four operator meanings already published in [EVALUATION-STANDARD.md §2.2](../../EVALUATION-STANDARD.md): `allow` / `defer` / `deny` / `exclude`. A policy action is never merged into the verification outcome, and the word `reject` is deliberately not used as an action name so that it cannot be confused with the outcome `rejected`.
+
+## The four cases
+
+| Case | Input (JSON) | Outcome (`outcome.verification`) | `reason_code` | `policy_action` | Relying-party action |
+|---|---|---|---|---|---|
+| A. Valid registered credential | `caseA_valid_registered_credential_input.json` | **verified** | `none` | `allow` | proceed per normal policy |
+| B1. Unverifiable issuer scope (signature valid) | `caseB1_unverifiable_issuer_scope_input.json` | **unresolved** | `authorization_unresolved` | `defer` | do not rely on authorization; treat per risk policy (deny-open or manual review) |
+| B2. Confirmed out-of-scope issuer (signature valid) | `caseB2_confirmed_out_of_scope_issuer_input.json` | **rejected** | `authorization_rejected` | `deny` | do not accept the credential for this operation; treat as unauthorized |
+| C. Status source unavailable | `caseC_unavailable_status_source_input.json` | **unresolved** | `status_unavailable` | `defer` | do not treat as revoked; do not treat as valid; escalate |
+
+Every row above is reproduced from the input file by `tools/evidence-grader.py`; none of the columns is hand-written into the conclusion.
 
 ## B1 vs B2 — the distinction
 
-- **B1** tests the case where authoritative issuer-scope information is **unavailable** at verification time (issuer self-declaration only). The verifier cannot confirm authorization, so the authorization result is **unresolved / indeterminate**; the relying party must not assume the issuer is out of scope, but also must not rely on the authorization.
-- **B2** tests the case where an authoritative scope registry **confirms** that the issuer lacks the required scope for this credential profile and claim type, with a valid signature. The authorization result is **rejected / unauthorized**, with an explicit reason code.
+- **B1** tests the case where authoritative issuer-scope information is **unavailable** at verification time (issuer self-declaration only). The verifier cannot confirm authorization, so the outcome is **`unresolved`**; the relying party must not assume the issuer is out of scope, but also must not rely on the authorization.
+- **B2** tests the case where an authoritative scope registry **confirms** that the issuer lacks the required scope for this credential profile and claim type, with a valid signature. The outcome is **`rejected`**, with an explicit reason code.
 
-Both retain explicit reason codes and remain distinguishable in the machine-readable conclusion (`authorization.result`), so implementations can fail the same observable way — addressing the interoperability concern raised in FG-TIDA themes#7 and use-cases#27 (implementations that *fail* differently break interoperability faster than implementations that *verify* differently).
+Both retain explicit, machine-readable reason codes (`authorization_unresolved` vs `authorization_rejected`) and remain distinguishable in the conclusion, so implementations can fail the same observable way — addressing the interoperability concern raised in FG-TIDA themes#7 and use-cases#27 (implementations that *fail* differently break interoperability faster than implementations that *verify* differently).
+
+The distinction also survives a vocabulary change: whatever word an implementation uses for "not authorized", `unresolved` must remain separable from `rejected`, because the two demand different operator responses and only one of them is evidence-based.
 
 ## Decision flow
 
@@ -25,13 +45,13 @@ flowchart TD
     A[Present credential] --> B{Evidence grade per claim}
     B -->|V / S| C{Authorization link confirmable?}
     B -->|M / L| D{More evidence obtainable?}
-    B -->|P| E[Rejected: not yet testable]
+    B -->|P| E[evidence failure_class: rejected - not yet testable]
     C -->|Yes| F{Status current?}
-    C -->|No - scope info unavailable| G[Indeterminate - B1: authorization unresolved<br/>missing evidence ≠ invalid; deny-open or manual review]
-    C -->|No - scope confirmed lacking| G2[Rejected - B2: authorization rejected<br/>do not accept; treat as unauthorized]
-    F -->|Yes| H[Positive - A: proceed per normal policy]
-    F -->|No / revoked| I[Negative - treat as revoked]
-    F -->|Unavailable| J[Indeterminate - C: status unavailable does not equal revoked<br/>escalate]
+    C -->|No - scope info unavailable| G[unresolved - B1: authorization_unresolved<br/>missing evidence != invalid; defer]
+    C -->|No - scope confirmed lacking| G2[rejected - B2: authorization_rejected<br/>deny]
+    F -->|Yes| H[verified - A: allow, per normal policy]
+    F -->|No / revoked| I[rejected (revoked) - deny<br/>no case file yet]
+    F -->|Unavailable| J[unresolved - C: status_unavailable<br/>defer, escalate]
     D -->|Yes| K[Request more evidence / re-evaluate]
     D -->|No| G
 ```
@@ -49,20 +69,41 @@ sequenceDiagram
     RP->>V: 1. present credential + verification request
     V->>V: 2. grade evidence per claim (V/S/M/L/P)
     V->>R: 3. authorization chain lookup (root, registrar, issuer)
-    R-->>V: 4. authorization: verified / unresolved / rejected / quarantined
+    R-->>V: 4. authorization verdict: verified / unresolved / rejected
     V->>S: 5. status check (current / revoked / unavailable)
     S-->>V: 6. status result
-    V->>V: 7. combine: outcome + reason + relying-party action
+    V->>V: 7. combine: outcome.verification + reason_code + policy_action
     V-->>RP: 8. machine-readable conclusion (JSON + payload digest)
 ```
 
+## Why `verdict` is not the case outcome
+
+A conclusion carries two different summary fields, and they answer different questions:
+
+- `outcome.verification` — the **case-level** conclusion for the dimension under test. This is what a program should read.
+- `verdict` — **six-domain evidence coverage**: how many of the six evaluation domains (D1–D6) reach grade V or S. A case set that exercises one or two domains is `Insufficient evidence` here *by construction*, even when its authorization outcome is `verified`.
+
+Until v1.3 only `verdict` existed, so a program reading it would report Case A — a valid, current, in-registration credential — as "evidence insufficient". The field was not wrong about coverage; it was being asked the wrong question. v1.3 adds `outcome`, keeps `verdict`, and labels both through an explicit `scopes` object inside every conclusion.
+
+`overall_failure_class` has the same character: it is the worst evidence failure class across the six domains, and an unexercised (empty) domain reports `unresolved` by design in v1.x. It is not a case outcome either.
+
 ## Machine-readable notes
 
-- Each conclusion JSON carries a `payload_digest` for end-to-end reproduction (schema `lgd-eval/conclusion/v1.2`; the digest covers both the graded domains and the `authorization` dimension):
-  - Case A: `640db270e69c9f79`
-  - Case B1: `8d81c5d559914ec5`
-  - Case B2: `c19e1781ebd4f690`
-  - Case C: `8333b571827a1c01`
-- Scope note: `overall_failure_class` in the conclusion JSON is computed under the tool's global evidence discipline (out-of-scope domains report `unresolved` when no evidence is provided; this is expected v1.x behaviour). The case-level outcome / reason / relying-party-action above is the layered interpretation discussed in FG-TIDA/use-cases#27 and themes#42 — evidence quality and authorization validity are separate axes.
+- Each conclusion JSON carries a `payload_digest` (schema `lgd-eval/conclusion/v1.3`). The digest covers `domains`, `authorization` and `outcome`; it does not cover `timestamp`, so the same input reproduces the same digest on any day:
+  - Case A: `fa8b1420cca29307`
+  - Case B1: `a353ad64f911030a`
+  - Case B2: `d709c4ec85ef5d6e`
+  - Case C: `982c390107058485`
+- Digest convention, unchanged in wording but now actually implemented (see change 3 below): `sha256(json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False))[:16]`, per [EVALUATION-STANDARD.md §2.3](../../EVALUATION-STANDARD.md).
 - The case set is implementation-neutral: the tooling is an optional evaluation aid only; the inputs and expected outcomes are the deliverable.
-- Companion diagrams: `assets/evidence_grade_vs_authority.svg` (evidence grade × authorization validity, two independent dimensions) and `assets/three_cases_outcome_flow.svg` (case decision flow, B1/B2 shown separately).
+- Companion diagrams: `assets/evidence_grade_vs_authority.svg` (evidence grade × authorization validity, two independent dimensions) and `assets/three_cases_outcome_flow.svg` (case decision flow, B1/B2 shown separately; the file name predates the split and is kept so existing links do not break).
+
+## Change log — v1.2 → v1.3 (2026-10-23)
+
+All four digests changed. There are exactly three reasons, each independently checkable against the two tagged versions:
+
+1. **`authorization` gained two machine-readable fields**, `reason_code` and `policy_action`. Previously the reason was free prose only, and the relying-party action was free text, so neither could be compared across implementations.
+2. **`outcome` was added and joined the digest.** A case-level conclusion now exists as a first-class field instead of being reconstructed by the reader from `authorization.result`.
+3. **The digest is now computed the way the standard already said it should be.** `EVALUATION-STANDARD.md §2.3` specifies `sort_keys=True` with compact separators; the v1.2 implementation used default separators and insertion order. Any third party who followed §2.3 therefore could not reproduce a published digest. A test over the v1.2 files confirmed the mismatch before the change was made — under §2.3 the four v1.2 conclusions hash to `ab56339d…`, `be1677e8…`, `ff4ff95a…`, `6c37e632…`, not to the published values.
+
+`quarantined` was removed from `authorization.result` in the same release: it describes what an operator does with an unsettled field, not what was verified, and it is now `policy_action: exclude`. Evidence-level `failure_class` still uses `quarantined` for malformed input — that is a different axis and is unchanged.
diff --git a/worked-examples/cases/caseA_valid_registered_credential_conclusion.json b/worked-examples/cases/caseA_valid_registered_credential_conclusion.json
index aad846c..82d05eb 100644
--- a/worked-examples/cases/caseA_valid_registered_credential_conclusion.json
+++ b/worked-examples/cases/caseA_valid_registered_credential_conclusion.json
@@ -1,114 +1,135 @@
-{
-  "schema": "lgd-eval/conclusion/v1.2",
-  "subject": "Case A — Valid registered credential issued by an authorized registrar (FG-TIDA/use-cases#27)",
-  "evaluator": "LGD-Eval",
-  "timestamp": "2026-10-16T23:01:14Z",
-  "verdict": "Insufficient evidence（证据不足）",
-  "overall_failure_class": "unresolved",
-  "authorization": {
-    "result": "verified",
-    "reason": "registrar and issuer confirmed in authoritative scope registry within declared domains",
-    "relying_party_action": "proceed per normal policy"
-  },
-  "no_composite_score": true,
-  "bias_controls": [
-    "multi-judge（多裁判）",
-    "human anchoring（人类锚定）",
-    "AB/BA ordering（顺序轮换）",
-    "inter-rater agreement kappa（裁判一致性）",
-    "no self-review（不自查原则）"
-  ],
-  "domains": {
-    "D1": {
-      "domain": "Identity & registration / 身份与注册",
-      "best_grade": "V",
-      "interpretation": "Verified / 确证",
-      "meaning": "Claim independently reproduced（已独立复现）",
-      "failure_class": "none",
-      "evidence_count": 2,
-      "used_evidence": [
-        {
-          "claim": "Registration credential issued by registrar authorized under a governance root",
-          "grade": "V",
-          "kind": "audit",
-          "source": "frozen test vector T-A1 + independent replay",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        },
-        {
-          "claim": "Registrar scope verified: resource within declared registration domain",
-          "grade": "V",
-          "kind": "repro-test",
-          "source": "frozen test vector T-A2 + independent replay",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D2": {
-      "domain": "Trust lifecycle / 信任生命周期",
-      "best_grade": "V",
-      "interpretation": "Verified / 确证",
-      "meaning": "Claim independently reproduced（已独立复现）",
-      "failure_class": "none",
-      "evidence_count": 1,
-      "used_evidence": [
-        {
-          "claim": "Credential status current: no revocation, suspension or expiry at verification time",
-          "grade": "V",
-          "kind": "process",
-          "source": "signed status response, frozen vector T-A3",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D3": {
-      "domain": "Security & resilience / 安全与韧性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D4": {
-      "domain": "Privacy & data governance / 隐私与数据",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D5": {
-      "domain": "Human oversight & accountability / 人类监督与问责",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D6": {
-      "domain": "Interoperability / 互操作性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    }
-  },
-  "reproducibility": {
-    "open_rubric": true,
-    "evidence_appendix": true,
-    "response_window_days": 14,
-    "correction_window_hours": 24,
-    "machine_readable": true,
-    "payload_digest": "640db270e69c9f79"
-  }
+{
+  "schema": "lgd-eval/conclusion/v1.3",
+  "subject": "Case A — Valid registered credential issued by an authorized registrar (FG-TIDA/use-cases#27)",
+  "evaluator": "LGD-Eval",
+  "timestamp": "2026-10-23T09:14:07Z",
+  "outcome": {
+    "verification": "verified",
+    "reason_code": "none",
+    "policy_dependent": true,
+    "policy_action": "allow",
+    "relying_party_action": "proceed per normal policy"
+  },
+  "verdict": "Insufficient evidence（证据不足）",
+  "scopes": {
+    "outcome": "Case-level verification outcome for the dimension under test — read this field for the case conclusion. / 用例结论，读这个字段。",
+    "verdict": "Six-domain evidence coverage: how many of the six domains reach V/S. A case that exercises one or two domains is 'Insufficient evidence' here by construction — this is NOT a case outcome. / 六域覆盖度，不是用例结论。",
+    "overall_failure_class": "Worst evidence failure class across the six domains; an unexercised (empty) domain is 'unresolved' by v1.x design. / 空域按 v1.x 设计记为 unresolved。",
+    "policy_action": "Policy-dependent action, recorded separately from the verification outcome (allow / defer / deny / exclude), reusing the operator meanings in EVALUATION-STANDARD.md §2.2. / 策略动作，与结论分开，词表与规范一致。"
+  },
+  "overall_failure_class": "unresolved",
+  "authorization": {
+    "result": "verified",
+    "reason_code": "none",
+    "reason": "registrar and issuer confirmed in authoritative scope registry within declared domains",
+    "relying_party_action": "proceed per normal policy",
+    "policy_action": "allow"
+  },
+  "no_composite_score": true,
+  "bias_controls": [
+    "multi-judge（多裁判）",
+    "human anchoring（人类锚定）",
+    "AB/BA ordering（顺序轮换）",
+    "inter-rater agreement kappa（裁判一致性）",
+    "no self-review（不自查原则）"
+  ],
+  "domains": {
+    "D1": {
+      "domain": "Identity & registration / 身份与注册",
+      "best_grade": "V",
+      "interpretation": "Verified / 确证",
+      "meaning": "Claim independently reproduced（已独立复现）",
+      "failure_class": "none",
+      "evidence_count": 2,
+      "used_evidence": [
+        {
+          "claim": "Registration credential issued by registrar authorized under a governance root",
+          "grade": "V",
+          "kind": "audit",
+          "source": "frozen test vector T-A1 + independent replay",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        },
+        {
+          "claim": "Registrar scope verified: resource within declared registration domain",
+          "grade": "V",
+          "kind": "repro-test",
+          "source": "frozen test vector T-A2 + independent replay",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D2": {
+      "domain": "Trust lifecycle / 信任生命周期",
+      "best_grade": "V",
+      "interpretation": "Verified / 确证",
+      "meaning": "Claim independently reproduced（已独立复现）",
+      "failure_class": "none",
+      "evidence_count": 1,
+      "used_evidence": [
+        {
+          "claim": "Credential status current: no revocation, suspension or expiry at verification time",
+          "grade": "V",
+          "kind": "process",
+          "source": "signed status response, frozen vector T-A3",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D3": {
+      "domain": "Security & resilience / 安全与韧性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D4": {
+      "domain": "Privacy & data governance / 隐私与数据",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D5": {
+      "domain": "Human oversight & accountability / 人类监督与问责",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D6": {
+      "domain": "Interoperability / 互操作性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    }
+  },
+  "reproducibility": {
+    "open_rubric": true,
+    "evidence_appendix": true,
+    "response_window_days": 14,
+    "correction_window_hours": 24,
+    "machine_readable": true,
+    "digest_covers": [
+      "domains",
+      "authorization",
+      "outcome"
+    ],
+    "digest_convention": "sha256(json.dumps(obj, sort_keys=True, separators=(\",\", \":\"), ensure_ascii=False))[:16] — EVALUATION-STANDARD.md §2.3",
+    "payload_digest": "fa8b1420cca29307"
+  }
 }
\ No newline at end of file
diff --git a/worked-examples/cases/caseA_valid_registered_credential_conclusion.md b/worked-examples/cases/caseA_valid_registered_credential_conclusion.md
new file mode 100644
index 0000000..5df1482
--- /dev/null
+++ b/worked-examples/cases/caseA_valid_registered_credential_conclusion.md
@@ -0,0 +1,41 @@
+# LGD-Eval Assessment Conclusion / 评估结论
+
+- **Subject / 评估对象**: Case A — Valid registered credential issued by an authorized registrar (FG-TIDA/use-cases#27)
+- **Evaluator / 评估方**: LGD-Eval
+- **Timestamp / 时间戳**: 2026-10-23T09:14:07Z
+- **Outcome / 用例结论**: **verified** (reason `none`; policy action `allow`)
+- **Relying-party action / 依赖方动作**: proceed per normal policy
+- **Evidence-coverage verdict / 覆盖度判词**: Insufficient evidence（证据不足）
+- **Overall failure class / 总体失败类**: unresolved
+- **No composite score / 无复合分**: True（域级独立评分，禁止复合）
+- **Bias controls / 偏倚控制**: multi-judge（多裁判）; human anchoring（人类锚定）; AB/BA ordering（顺序轮换）; inter-rater agreement kappa（裁判一致性）; no self-review（不自查原则）
+
+> `verdict` 是六域覆盖度判词，不是用例结论；用例结论读 `outcome.verification`。
+> `verdict` is six-domain evidence coverage, not a case outcome; read `outcome.verification`.
+
+## Domain-level results / 域级结果
+
+| Domain / 域 | Best grade / 最高级别 | Failure class / 失败类 | Interpretation / 解读 | Evidence / 证据数 |
+|---|---|---|---|---|
+| D1 · Identity & registration / 身份与注册 | V | none | Verified / 确证 | 2 |
+| D2 · Trust lifecycle / 信任生命周期 | V | none | Verified / 确证 | 1 |
+| D3 · Security & resilience / 安全与韧性 | P | unresolved | Pending / 待定 | 0 |
+| D4 · Privacy & data governance / 隐私与数据 | P | unresolved | Pending / 待定 | 0 |
+| D5 · Human oversight & accountability / 人类监督与问责 | P | unresolved | Pending / 待定 | 0 |
+| D6 · Interoperability / 互操作性 | P | unresolved | Pending / 待定 | 0 |
+
+## Failure semantics / 失败语义
+- quarantined（隔离）: malformed input — missing claim or invalid grade
+- rejected（拒绝）: grade=P, not yet testable
+- unresolved（未决）: verifiable kind without reproducible/timestamped evidence, or empty domain
+- none（无失败）: evidence accepted
+
+## Reproducibility / 可复现
+- open rubric（公开细则）: True
+- evidence appendix（证据附录）: True
+- response window（回应期）: 14 days / 24h corrections
+- machine-readable（机器可读）: True
+- digest covers（摘要覆盖）: domains + authorization + outcome
+- payload digest（载荷摘要）: `fa8b1420cca29307`
+
+*Generated by LGD-Eval evidence-grader（由证据分级器生成）；结论受证据级别约束，欢迎独立复现。*
\ No newline at end of file
diff --git a/worked-examples/cases/caseA_valid_registered_credential_input.json b/worked-examples/cases/caseA_valid_registered_credential_input.json
index 2c051df..4a632b0 100644
--- a/worked-examples/cases/caseA_valid_registered_credential_input.json
+++ b/worked-examples/cases/caseA_valid_registered_credential_input.json
@@ -1,38 +1,40 @@
-{
-  "subject": "Case A — Valid registered credential issued by an authorized registrar (FG-TIDA/use-cases#27)",
-  "domains": {
-    "D1": [
-      {
-        "claim": "Registration credential issued by registrar authorized under a governance root",
-        "grade": "V",
-        "kind": "audit",
-        "source": "frozen test vector T-A1 + independent replay",
-        "reproducible": true,
-        "timestamped": true
-      },
-      {
-        "claim": "Registrar scope verified: resource within declared registration domain",
-        "grade": "V",
-        "kind": "repro-test",
-        "source": "frozen test vector T-A2 + independent replay",
-        "reproducible": true,
-        "timestamped": true
-      }
-    ],
-    "D2": [
-      {
-        "claim": "Credential status current: no revocation, suspension or expiry at verification time",
-        "grade": "V",
-        "kind": "process",
-        "source": "signed status response, frozen vector T-A3",
-        "reproducible": true,
-        "timestamped": true
-      }
-    ]
-  },
-  "authorization": {
-    "result": "verified",
-    "reason": "registrar and issuer confirmed in authoritative scope registry within declared domains",
-    "relying_party_action": "proceed per normal policy"
-  }
-}
\ No newline at end of file
+{
+  "subject": "Case A — Valid registered credential issued by an authorized registrar (FG-TIDA/use-cases#27)",
+  "domains": {
+    "D1": [
+      {
+        "claim": "Registration credential issued by registrar authorized under a governance root",
+        "grade": "V",
+        "kind": "audit",
+        "source": "frozen test vector T-A1 + independent replay",
+        "reproducible": true,
+        "timestamped": true
+      },
+      {
+        "claim": "Registrar scope verified: resource within declared registration domain",
+        "grade": "V",
+        "kind": "repro-test",
+        "source": "frozen test vector T-A2 + independent replay",
+        "reproducible": true,
+        "timestamped": true
+      }
+    ],
+    "D2": [
+      {
+        "claim": "Credential status current: no revocation, suspension or expiry at verification time",
+        "grade": "V",
+        "kind": "process",
+        "source": "signed status response, frozen vector T-A3",
+        "reproducible": true,
+        "timestamped": true
+      }
+    ]
+  },
+  "authorization": {
+    "result": "verified",
+    "reason_code": "none",
+    "reason": "registrar and issuer confirmed in authoritative scope registry within declared domains",
+    "relying_party_action": "proceed per normal policy",
+    "policy_action": "allow"
+  }
+}
diff --git a/worked-examples/cases/caseB1_unverifiable_issuer_scope_conclusion.json b/worked-examples/cases/caseB1_unverifiable_issuer_scope_conclusion.json
index a4942b3..df3201b 100644
--- a/worked-examples/cases/caseB1_unverifiable_issuer_scope_conclusion.json
+++ b/worked-examples/cases/caseB1_unverifiable_issuer_scope_conclusion.json
@@ -1,104 +1,125 @@
-{
-  "schema": "lgd-eval/conclusion/v1.2",
-  "subject": "Case B1 — Unverifiable issuer scope, signature valid (FG-TIDA/use-cases#27; per themes#42 review, former Case B split into B1/B2)",
-  "evaluator": "LGD-Eval",
-  "timestamp": "2026-10-16T23:01:14Z",
-  "verdict": "Insufficient evidence（证据不足）",
-  "overall_failure_class": "unresolved",
-  "authorization": {
-    "result": "unresolved",
-    "reason": "authoritative issuer-scope information unavailable at verification time; missing evidence of authorization is not demonstrated invalid authorization",
-    "relying_party_action": "do not rely on authorization; treat per risk policy (deny-open or manual review)"
-  },
-  "no_composite_score": true,
-  "bias_controls": [
-    "multi-judge（多裁判）",
-    "human anchoring（人类锚定）",
-    "AB/BA ordering（顺序轮换）",
-    "inter-rater agreement kappa（裁判一致性）",
-    "no self-review（不自查原则）"
-  ],
-  "domains": {
-    "D1": {
-      "domain": "Identity & registration / 身份与注册",
-      "best_grade": "V",
-      "interpretation": "Verified / 确证",
-      "meaning": "Claim independently reproduced（已独立复现）",
-      "failure_class": "unresolved",
-      "evidence_count": 2,
-      "used_evidence": [
-        {
-          "claim": "Credential signature cryptographically valid",
-          "grade": "V",
-          "kind": "repro-test",
-          "source": "signature replay on frozen vector T-B1",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        },
-        {
-          "claim": "Issuer authorized for this credential profile and claim type",
-          "grade": "L",
-          "kind": "audit",
-          "source": "issuer self-declaration only; authoritative scope registry entry unavailable at verification time",
-          "reproducible": false,
-          "timestamped": false,
-          "failure_class": "unresolved"
-        }
-      ]
-    },
-    "D2": {
-      "domain": "Trust lifecycle / 信任生命周期",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D3": {
-      "domain": "Security & resilience / 安全与韧性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D4": {
-      "domain": "Privacy & data governance / 隐私与数据",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D5": {
-      "domain": "Human oversight & accountability / 人类监督与问责",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D6": {
-      "domain": "Interoperability / 互操作性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    }
-  },
-  "reproducibility": {
-    "open_rubric": true,
-    "evidence_appendix": true,
-    "response_window_days": 14,
-    "correction_window_hours": 24,
-    "machine_readable": true,
-    "payload_digest": "8d81c5d559914ec5"
-  }
+{
+  "schema": "lgd-eval/conclusion/v1.3",
+  "subject": "Case B1 — Unverifiable issuer scope, signature valid (FG-TIDA/use-cases#27; per themes#42 review, former Case B split into B1/B2)",
+  "evaluator": "LGD-Eval",
+  "timestamp": "2026-10-23T09:14:07Z",
+  "outcome": {
+    "verification": "unresolved",
+    "reason_code": "authorization_unresolved",
+    "policy_dependent": true,
+    "policy_action": "defer",
+    "relying_party_action": "do not rely on authorization; treat per risk policy (deny-open or manual review)"
+  },
+  "verdict": "Insufficient evidence（证据不足）",
+  "scopes": {
+    "outcome": "Case-level verification outcome for the dimension under test — read this field for the case conclusion. / 用例结论，读这个字段。",
+    "verdict": "Six-domain evidence coverage: how many of the six domains reach V/S. A case that exercises one or two domains is 'Insufficient evidence' here by construction — this is NOT a case outcome. / 六域覆盖度，不是用例结论。",
+    "overall_failure_class": "Worst evidence failure class across the six domains; an unexercised (empty) domain is 'unresolved' by v1.x design. / 空域按 v1.x 设计记为 unresolved。",
+    "policy_action": "Policy-dependent action, recorded separately from the verification outcome (allow / defer / deny / exclude), reusing the operator meanings in EVALUATION-STANDARD.md §2.2. / 策略动作，与结论分开，词表与规范一致。"
+  },
+  "overall_failure_class": "unresolved",
+  "authorization": {
+    "result": "unresolved",
+    "reason_code": "authorization_unresolved",
+    "reason": "authoritative issuer-scope information unavailable at verification time; missing evidence of authorization is not demonstrated invalid authorization",
+    "relying_party_action": "do not rely on authorization; treat per risk policy (deny-open or manual review)",
+    "policy_action": "defer"
+  },
+  "no_composite_score": true,
+  "bias_controls": [
+    "multi-judge（多裁判）",
+    "human anchoring（人类锚定）",
+    "AB/BA ordering（顺序轮换）",
+    "inter-rater agreement kappa（裁判一致性）",
+    "no self-review（不自查原则）"
+  ],
+  "domains": {
+    "D1": {
+      "domain": "Identity & registration / 身份与注册",
+      "best_grade": "V",
+      "interpretation": "Verified / 确证",
+      "meaning": "Claim independently reproduced（已独立复现）",
+      "failure_class": "unresolved",
+      "evidence_count": 2,
+      "used_evidence": [
+        {
+          "claim": "Credential signature cryptographically valid",
+          "grade": "V",
+          "kind": "repro-test",
+          "source": "signature replay on frozen vector T-B1",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        },
+        {
+          "claim": "Issuer authorized for this credential profile and claim type",
+          "grade": "L",
+          "kind": "audit",
+          "source": "issuer self-declaration only; authoritative scope registry entry unavailable at verification time",
+          "reproducible": false,
+          "timestamped": false,
+          "failure_class": "unresolved"
+        }
+      ]
+    },
+    "D2": {
+      "domain": "Trust lifecycle / 信任生命周期",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D3": {
+      "domain": "Security & resilience / 安全与韧性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D4": {
+      "domain": "Privacy & data governance / 隐私与数据",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D5": {
+      "domain": "Human oversight & accountability / 人类监督与问责",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D6": {
+      "domain": "Interoperability / 互操作性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    }
+  },
+  "reproducibility": {
+    "open_rubric": true,
+    "evidence_appendix": true,
+    "response_window_days": 14,
+    "correction_window_hours": 24,
+    "machine_readable": true,
+    "digest_covers": [
+      "domains",
+      "authorization",
+      "outcome"
+    ],
+    "digest_convention": "sha256(json.dumps(obj, sort_keys=True, separators=(\",\", \":\"), ensure_ascii=False))[:16] — EVALUATION-STANDARD.md §2.3",
+    "payload_digest": "a353ad64f911030a"
+  }
 }
\ No newline at end of file
diff --git a/worked-examples/cases/caseB1_unverifiable_issuer_scope_conclusion.md b/worked-examples/cases/caseB1_unverifiable_issuer_scope_conclusion.md
new file mode 100644
index 0000000..3cccad5
--- /dev/null
+++ b/worked-examples/cases/caseB1_unverifiable_issuer_scope_conclusion.md
@@ -0,0 +1,41 @@
+# LGD-Eval Assessment Conclusion / 评估结论
+
+- **Subject / 评估对象**: Case B1 — Unverifiable issuer scope, signature valid (FG-TIDA/use-cases#27; per themes#42 review, former Case B split into B1/B2)
+- **Evaluator / 评估方**: LGD-Eval
+- **Timestamp / 时间戳**: 2026-10-23T09:14:07Z
+- **Outcome / 用例结论**: **unresolved** (reason `authorization_unresolved`; policy action `defer`)
+- **Relying-party action / 依赖方动作**: do not rely on authorization; treat per risk policy (deny-open or manual review)
+- **Evidence-coverage verdict / 覆盖度判词**: Insufficient evidence（证据不足）
+- **Overall failure class / 总体失败类**: unresolved
+- **No composite score / 无复合分**: True（域级独立评分，禁止复合）
+- **Bias controls / 偏倚控制**: multi-judge（多裁判）; human anchoring（人类锚定）; AB/BA ordering（顺序轮换）; inter-rater agreement kappa（裁判一致性）; no self-review（不自查原则）
+
+> `verdict` 是六域覆盖度判词，不是用例结论；用例结论读 `outcome.verification`。
+> `verdict` is six-domain evidence coverage, not a case outcome; read `outcome.verification`.
+
+## Domain-level results / 域级结果
+
+| Domain / 域 | Best grade / 最高级别 | Failure class / 失败类 | Interpretation / 解读 | Evidence / 证据数 |
+|---|---|---|---|---|
+| D1 · Identity & registration / 身份与注册 | V | unresolved | Verified / 确证 | 2 |
+| D2 · Trust lifecycle / 信任生命周期 | P | unresolved | Pending / 待定 | 0 |
+| D3 · Security & resilience / 安全与韧性 | P | unresolved | Pending / 待定 | 0 |
+| D4 · Privacy & data governance / 隐私与数据 | P | unresolved | Pending / 待定 | 0 |
+| D5 · Human oversight & accountability / 人类监督与问责 | P | unresolved | Pending / 待定 | 0 |
+| D6 · Interoperability / 互操作性 | P | unresolved | Pending / 待定 | 0 |
+
+## Failure semantics / 失败语义
+- quarantined（隔离）: malformed input — missing claim or invalid grade
+- rejected（拒绝）: grade=P, not yet testable
+- unresolved（未决）: verifiable kind without reproducible/timestamped evidence, or empty domain
+- none（无失败）: evidence accepted
+
+## Reproducibility / 可复现
+- open rubric（公开细则）: True
+- evidence appendix（证据附录）: True
+- response window（回应期）: 14 days / 24h corrections
+- machine-readable（机器可读）: True
+- digest covers（摘要覆盖）: domains + authorization + outcome
+- payload digest（载荷摘要）: `a353ad64f911030a`
+
+*Generated by LGD-Eval evidence-grader（由证据分级器生成）；结论受证据级别约束，欢迎独立复现。*
\ No newline at end of file
diff --git a/worked-examples/cases/caseB1_unverifiable_issuer_scope_input.json b/worked-examples/cases/caseB1_unverifiable_issuer_scope_input.json
index 88a87c2..7569697 100644
--- a/worked-examples/cases/caseB1_unverifiable_issuer_scope_input.json
+++ b/worked-examples/cases/caseB1_unverifiable_issuer_scope_input.json
@@ -22,7 +22,9 @@
   },
   "authorization": {
     "result": "unresolved",
+    "reason_code": "authorization_unresolved",
     "reason": "authoritative issuer-scope information unavailable at verification time; missing evidence of authorization is not demonstrated invalid authorization",
-    "relying_party_action": "do not rely on authorization; treat per risk policy (deny-open or manual review)"
+    "relying_party_action": "do not rely on authorization; treat per risk policy (deny-open or manual review)",
+    "policy_action": "defer"
   }
 }
diff --git a/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_conclusion.json b/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_conclusion.json
index f31492f..143caab 100644
--- a/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_conclusion.json
+++ b/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_conclusion.json
@@ -1,104 +1,125 @@
-{
-  "schema": "lgd-eval/conclusion/v1.2",
-  "subject": "Case B2 — Confirmed out-of-scope issuer, signature valid (FG-TIDA/use-cases#27; per themes#42 review, former Case B split into B1/B2)",
-  "evaluator": "LGD-Eval",
-  "timestamp": "2026-10-16T23:01:14Z",
-  "verdict": "Insufficient evidence（证据不足）",
-  "overall_failure_class": "unresolved",
-  "authorization": {
-    "result": "rejected",
-    "reason": "authoritative scope registry confirms the issuer lacks the required scope for this credential profile and claim type",
-    "relying_party_action": "do not accept the credential for this operation; treat as unauthorized"
-  },
-  "no_composite_score": true,
-  "bias_controls": [
-    "multi-judge（多裁判）",
-    "human anchoring（人类锚定）",
-    "AB/BA ordering（顺序轮换）",
-    "inter-rater agreement kappa（裁判一致性）",
-    "no self-review（不自查原则）"
-  ],
-  "domains": {
-    "D1": {
-      "domain": "Identity & registration / 身份与注册",
-      "best_grade": "V",
-      "interpretation": "Verified / 确证",
-      "meaning": "Claim independently reproduced（已独立复现）",
-      "failure_class": "none",
-      "evidence_count": 2,
-      "used_evidence": [
-        {
-          "claim": "Credential signature cryptographically valid",
-          "grade": "V",
-          "kind": "repro-test",
-          "source": "signature replay on frozen vector T-B2a",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        },
-        {
-          "claim": "Issuer lacks required scope for this credential profile and claim type",
-          "grade": "V",
-          "kind": "audit",
-          "source": "authoritative scope registry consulted at verification time; issuer not listed for this profile (frozen vector T-B2b)",
-          "reproducible": true,
-          "timestamped": true,
-          "failure_class": "none"
-        }
-      ]
-    },
-    "D2": {
-      "domain": "Trust lifecycle / 信任生命周期",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D3": {
-      "domain": "Security & resilience / 安全与韧性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D4": {
-      "domain": "Privacy & data governance / 隐私与数据",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D5": {
-      "domain": "Human oversight & accountability / 人类监督与问责",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D6": {
-      "domain": "Interoperability / 互操作性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    }
-  },
-  "reproducibility": {
-    "open_rubric": true,
-    "evidence_appendix": true,
-    "response_window_days": 14,
-    "correction_window_hours": 24,
-    "machine_readable": true,
-    "payload_digest": "c19e1781ebd4f690"
-  }
+{
+  "schema": "lgd-eval/conclusion/v1.3",
+  "subject": "Case B2 — Confirmed out-of-scope issuer, signature valid (FG-TIDA/use-cases#27; per themes#42 review, former Case B split into B1/B2)",
+  "evaluator": "LGD-Eval",
+  "timestamp": "2026-10-23T09:14:07Z",
+  "outcome": {
+    "verification": "rejected",
+    "reason_code": "authorization_rejected",
+    "policy_dependent": true,
+    "policy_action": "deny",
+    "relying_party_action": "do not accept the credential for this operation; treat as unauthorized"
+  },
+  "verdict": "Insufficient evidence（证据不足）",
+  "scopes": {
+    "outcome": "Case-level verification outcome for the dimension under test — read this field for the case conclusion. / 用例结论，读这个字段。",
+    "verdict": "Six-domain evidence coverage: how many of the six domains reach V/S. A case that exercises one or two domains is 'Insufficient evidence' here by construction — this is NOT a case outcome. / 六域覆盖度，不是用例结论。",
+    "overall_failure_class": "Worst evidence failure class across the six domains; an unexercised (empty) domain is 'unresolved' by v1.x design. / 空域按 v1.x 设计记为 unresolved。",
+    "policy_action": "Policy-dependent action, recorded separately from the verification outcome (allow / defer / deny / exclude), reusing the operator meanings in EVALUATION-STANDARD.md §2.2. / 策略动作，与结论分开，词表与规范一致。"
+  },
+  "overall_failure_class": "unresolved",
+  "authorization": {
+    "result": "rejected",
+    "reason_code": "authorization_rejected",
+    "reason": "authoritative scope registry confirms the issuer lacks the required scope for this credential profile and claim type",
+    "relying_party_action": "do not accept the credential for this operation; treat as unauthorized",
+    "policy_action": "deny"
+  },
+  "no_composite_score": true,
+  "bias_controls": [
+    "multi-judge（多裁判）",
+    "human anchoring（人类锚定）",
+    "AB/BA ordering（顺序轮换）",
+    "inter-rater agreement kappa（裁判一致性）",
+    "no self-review（不自查原则）"
+  ],
+  "domains": {
+    "D1": {
+      "domain": "Identity & registration / 身份与注册",
+      "best_grade": "V",
+      "interpretation": "Verified / 确证",
+      "meaning": "Claim independently reproduced（已独立复现）",
+      "failure_class": "none",
+      "evidence_count": 2,
+      "used_evidence": [
+        {
+          "claim": "Credential signature cryptographically valid",
+          "grade": "V",
+          "kind": "repro-test",
+          "source": "signature replay on frozen vector T-B2a",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        },
+        {
+          "claim": "Issuer lacks required scope for this credential profile and claim type",
+          "grade": "V",
+          "kind": "audit",
+          "source": "authoritative scope registry consulted at verification time; issuer not listed for this profile (frozen vector T-B2b)",
+          "reproducible": true,
+          "timestamped": true,
+          "failure_class": "none"
+        }
+      ]
+    },
+    "D2": {
+      "domain": "Trust lifecycle / 信任生命周期",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D3": {
+      "domain": "Security & resilience / 安全与韧性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D4": {
+      "domain": "Privacy & data governance / 隐私与数据",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D5": {
+      "domain": "Human oversight & accountability / 人类监督与问责",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D6": {
+      "domain": "Interoperability / 互操作性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    }
+  },
+  "reproducibility": {
+    "open_rubric": true,
+    "evidence_appendix": true,
+    "response_window_days": 14,
+    "correction_window_hours": 24,
+    "machine_readable": true,
+    "digest_covers": [
+      "domains",
+      "authorization",
+      "outcome"
+    ],
+    "digest_convention": "sha256(json.dumps(obj, sort_keys=True, separators=(\",\", \":\"), ensure_ascii=False))[:16] — EVALUATION-STANDARD.md §2.3",
+    "payload_digest": "d709c4ec85ef5d6e"
+  }
 }
\ No newline at end of file
diff --git a/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_conclusion.md b/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_conclusion.md
new file mode 100644
index 0000000..6199e86
--- /dev/null
+++ b/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_conclusion.md
@@ -0,0 +1,41 @@
+# LGD-Eval Assessment Conclusion / 评估结论
+
+- **Subject / 评估对象**: Case B2 — Confirmed out-of-scope issuer, signature valid (FG-TIDA/use-cases#27; per themes#42 review, former Case B split into B1/B2)
+- **Evaluator / 评估方**: LGD-Eval
+- **Timestamp / 时间戳**: 2026-10-23T09:14:07Z
+- **Outcome / 用例结论**: **rejected** (reason `authorization_rejected`; policy action `deny`)
+- **Relying-party action / 依赖方动作**: do not accept the credential for this operation; treat as unauthorized
+- **Evidence-coverage verdict / 覆盖度判词**: Insufficient evidence（证据不足）
+- **Overall failure class / 总体失败类**: unresolved
+- **No composite score / 无复合分**: True（域级独立评分，禁止复合）
+- **Bias controls / 偏倚控制**: multi-judge（多裁判）; human anchoring（人类锚定）; AB/BA ordering（顺序轮换）; inter-rater agreement kappa（裁判一致性）; no self-review（不自查原则）
+
+> `verdict` 是六域覆盖度判词，不是用例结论；用例结论读 `outcome.verification`。
+> `verdict` is six-domain evidence coverage, not a case outcome; read `outcome.verification`.
+
+## Domain-level results / 域级结果
+
+| Domain / 域 | Best grade / 最高级别 | Failure class / 失败类 | Interpretation / 解读 | Evidence / 证据数 |
+|---|---|---|---|---|
+| D1 · Identity & registration / 身份与注册 | V | none | Verified / 确证 | 2 |
+| D2 · Trust lifecycle / 信任生命周期 | P | unresolved | Pending / 待定 | 0 |
+| D3 · Security & resilience / 安全与韧性 | P | unresolved | Pending / 待定 | 0 |
+| D4 · Privacy & data governance / 隐私与数据 | P | unresolved | Pending / 待定 | 0 |
+| D5 · Human oversight & accountability / 人类监督与问责 | P | unresolved | Pending / 待定 | 0 |
+| D6 · Interoperability / 互操作性 | P | unresolved | Pending / 待定 | 0 |
+
+## Failure semantics / 失败语义
+- quarantined（隔离）: malformed input — missing claim or invalid grade
+- rejected（拒绝）: grade=P, not yet testable
+- unresolved（未决）: verifiable kind without reproducible/timestamped evidence, or empty domain
+- none（无失败）: evidence accepted
+
+## Reproducibility / 可复现
+- open rubric（公开细则）: True
+- evidence appendix（证据附录）: True
+- response window（回应期）: 14 days / 24h corrections
+- machine-readable（机器可读）: True
+- digest covers（摘要覆盖）: domains + authorization + outcome
+- payload digest（载荷摘要）: `d709c4ec85ef5d6e`
+
+*Generated by LGD-Eval evidence-grader（由证据分级器生成）；结论受证据级别约束，欢迎独立复现。*
\ No newline at end of file
diff --git a/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_input.json b/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_input.json
index 17746f3..bfc871f 100644
--- a/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_input.json
+++ b/worked-examples/cases/caseB2_confirmed_out_of_scope_issuer_input.json
@@ -22,7 +22,9 @@
   },
   "authorization": {
     "result": "rejected",
+    "reason_code": "authorization_rejected",
     "reason": "authoritative scope registry confirms the issuer lacks the required scope for this credential profile and claim type",
-    "relying_party_action": "do not accept the credential for this operation; treat as unauthorized"
+    "relying_party_action": "do not accept the credential for this operation; treat as unauthorized",
+    "policy_action": "deny"
   }
 }
diff --git a/worked-examples/cases/caseC_unavailable_status_source_conclusion.json b/worked-examples/cases/caseC_unavailable_status_source_conclusion.json
index 3a25ed7..956b3ac 100644
--- a/worked-examples/cases/caseC_unavailable_status_source_conclusion.json
+++ b/worked-examples/cases/caseC_unavailable_status_source_conclusion.json
@@ -1,95 +1,116 @@
-{
-  "schema": "lgd-eval/conclusion/v1.2",
-  "subject": "Case C — Status source unavailable at verification time (FG-TIDA/use-cases#27)",
-  "evaluator": "LGD-Eval",
-  "timestamp": "2026-10-16T23:01:14Z",
-  "verdict": "Insufficient evidence（证据不足）",
-  "overall_failure_class": "unresolved",
-  "authorization": {
-    "result": "unresolved",
-    "reason": "status source unreachable at verification time; unavailable status does not equal revoked",
-    "relying_party_action": "do not treat as revoked; do not treat as valid; escalate"
-  },
-  "no_composite_score": true,
-  "bias_controls": [
-    "multi-judge（多裁判）",
-    "human anchoring（人类锚定）",
-    "AB/BA ordering（顺序轮换）",
-    "inter-rater agreement kappa（裁判一致性）",
-    "no self-review（不自查原则）"
-  ],
-  "domains": {
-    "D1": {
-      "domain": "Identity & registration / 身份与注册",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D2": {
-      "domain": "Trust lifecycle / 信任生命周期",
-      "best_grade": "L",
-      "interpretation": "Limited / 有限",
-      "meaning": "Anecdotal or single source（零散/单一来源）",
-      "failure_class": "unresolved",
-      "evidence_count": 1,
-      "used_evidence": [
-        {
-          "claim": "Credential status current (not revoked)",
-          "grade": "L",
-          "kind": "audit",
-          "source": "status endpoint unreachable at verification time; no revocation record retrievable",
-          "reproducible": false,
-          "timestamped": false,
-          "failure_class": "unresolved"
-        }
-      ]
-    },
-    "D3": {
-      "domain": "Security & resilience / 安全与韧性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D4": {
-      "domain": "Privacy & data governance / 隐私与数据",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D5": {
-      "domain": "Human oversight & accountability / 人类监督与问责",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    },
-    "D6": {
-      "domain": "Interoperability / 互操作性",
-      "best_grade": "P",
-      "interpretation": "Pending / 待定",
-      "meaning": "Claim not yet testable（尚不可判定）",
-      "failure_class": "unresolved",
-      "evidence_count": 0,
-      "used_evidence": []
-    }
-  },
-  "reproducibility": {
-    "open_rubric": true,
-    "evidence_appendix": true,
-    "response_window_days": 14,
-    "correction_window_hours": 24,
-    "machine_readable": true,
-    "payload_digest": "8333b571827a1c01"
-  }
+{
+  "schema": "lgd-eval/conclusion/v1.3",
+  "subject": "Case C — Status source unavailable at verification time (FG-TIDA/use-cases#27)",
+  "evaluator": "LGD-Eval",
+  "timestamp": "2026-10-23T09:14:07Z",
+  "outcome": {
+    "verification": "unresolved",
+    "reason_code": "status_unavailable",
+    "policy_dependent": true,
+    "policy_action": "defer",
+    "relying_party_action": "do not treat as revoked; do not treat as valid; escalate"
+  },
+  "verdict": "Insufficient evidence（证据不足）",
+  "scopes": {
+    "outcome": "Case-level verification outcome for the dimension under test — read this field for the case conclusion. / 用例结论，读这个字段。",
+    "verdict": "Six-domain evidence coverage: how many of the six domains reach V/S. A case that exercises one or two domains is 'Insufficient evidence' here by construction — this is NOT a case outcome. / 六域覆盖度，不是用例结论。",
+    "overall_failure_class": "Worst evidence failure class across the six domains; an unexercised (empty) domain is 'unresolved' by v1.x design. / 空域按 v1.x 设计记为 unresolved。",
+    "policy_action": "Policy-dependent action, recorded separately from the verification outcome (allow / defer / deny / exclude), reusing the operator meanings in EVALUATION-STANDARD.md §2.2. / 策略动作，与结论分开，词表与规范一致。"
+  },
+  "overall_failure_class": "unresolved",
+  "authorization": {
+    "result": "unresolved",
+    "reason_code": "status_unavailable",
+    "reason": "status source unreachable at verification time; unavailable status does not equal revoked",
+    "relying_party_action": "do not treat as revoked; do not treat as valid; escalate",
+    "policy_action": "defer"
+  },
+  "no_composite_score": true,
+  "bias_controls": [
+    "multi-judge（多裁判）",
+    "human anchoring（人类锚定）",
+    "AB/BA ordering（顺序轮换）",
+    "inter-rater agreement kappa（裁判一致性）",
+    "no self-review（不自查原则）"
+  ],
+  "domains": {
+    "D1": {
+      "domain": "Identity & registration / 身份与注册",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D2": {
+      "domain": "Trust lifecycle / 信任生命周期",
+      "best_grade": "L",
+      "interpretation": "Limited / 有限",
+      "meaning": "Anecdotal or single source（零散/单一来源）",
+      "failure_class": "unresolved",
+      "evidence_count": 1,
+      "used_evidence": [
+        {
+          "claim": "Credential status current (not revoked)",
+          "grade": "L",
+          "kind": "audit",
+          "source": "status endpoint unreachable at verification time; no revocation record retrievable",
+          "reproducible": false,
+          "timestamped": false,
+          "failure_class": "unresolved"
+        }
+      ]
+    },
+    "D3": {
+      "domain": "Security & resilience / 安全与韧性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D4": {
+      "domain": "Privacy & data governance / 隐私与数据",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D5": {
+      "domain": "Human oversight & accountability / 人类监督与问责",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    },
+    "D6": {
+      "domain": "Interoperability / 互操作性",
+      "best_grade": "P",
+      "interpretation": "Pending / 待定",
+      "meaning": "Claim not yet testable（尚不可判定）",
+      "failure_class": "unresolved",
+      "evidence_count": 0,
+      "used_evidence": []
+    }
+  },
+  "reproducibility": {
+    "open_rubric": true,
+    "evidence_appendix": true,
+    "response_window_days": 14,
+    "correction_window_hours": 24,
+    "machine_readable": true,
+    "digest_covers": [
+      "domains",
+      "authorization",
+      "outcome"
+    ],
+    "digest_convention": "sha256(json.dumps(obj, sort_keys=True, separators=(\",\", \":\"), ensure_ascii=False))[:16] — EVALUATION-STANDARD.md §2.3",
+    "payload_digest": "982c390107058485"
+  }
 }
\ No newline at end of file
diff --git a/worked-examples/cases/caseC_unavailable_status_source_conclusion.md b/worked-examples/cases/caseC_unavailable_status_source_conclusion.md
new file mode 100644
index 0000000..1f1529b
--- /dev/null
+++ b/worked-examples/cases/caseC_unavailable_status_source_conclusion.md
@@ -0,0 +1,41 @@
+# LGD-Eval Assessment Conclusion / 评估结论
+
+- **Subject / 评估对象**: Case C — Status source unavailable at verification time (FG-TIDA/use-cases#27)
+- **Evaluator / 评估方**: LGD-Eval
+- **Timestamp / 时间戳**: 2026-10-23T09:14:07Z
+- **Outcome / 用例结论**: **unresolved** (reason `status_unavailable`; policy action `defer`)
+- **Relying-party action / 依赖方动作**: do not treat as revoked; do not treat as valid; escalate
+- **Evidence-coverage verdict / 覆盖度判词**: Insufficient evidence（证据不足）
+- **Overall failure class / 总体失败类**: unresolved
+- **No composite score / 无复合分**: True（域级独立评分，禁止复合）
+- **Bias controls / 偏倚控制**: multi-judge（多裁判）; human anchoring（人类锚定）; AB/BA ordering（顺序轮换）; inter-rater agreement kappa（裁判一致性）; no self-review（不自查原则）
+
+> `verdict` 是六域覆盖度判词，不是用例结论；用例结论读 `outcome.verification`。
+> `verdict` is six-domain evidence coverage, not a case outcome; read `outcome.verification`.
+
+## Domain-level results / 域级结果
+
+| Domain / 域 | Best grade / 最高级别 | Failure class / 失败类 | Interpretation / 解读 | Evidence / 证据数 |
+|---|---|---|---|---|
+| D1 · Identity & registration / 身份与注册 | P | unresolved | Pending / 待定 | 0 |
+| D2 · Trust lifecycle / 信任生命周期 | L | unresolved | Limited / 有限 | 1 |
+| D3 · Security & resilience / 安全与韧性 | P | unresolved | Pending / 待定 | 0 |
+| D4 · Privacy & data governance / 隐私与数据 | P | unresolved | Pending / 待定 | 0 |
+| D5 · Human oversight & accountability / 人类监督与问责 | P | unresolved | Pending / 待定 | 0 |
+| D6 · Interoperability / 互操作性 | P | unresolved | Pending / 待定 | 0 |
+
+## Failure semantics / 失败语义
+- quarantined（隔离）: malformed input — missing claim or invalid grade
+- rejected（拒绝）: grade=P, not yet testable
+- unresolved（未决）: verifiable kind without reproducible/timestamped evidence, or empty domain
+- none（无失败）: evidence accepted
+
+## Reproducibility / 可复现
+- open rubric（公开细则）: True
+- evidence appendix（证据附录）: True
+- response window（回应期）: 14 days / 24h corrections
+- machine-readable（机器可读）: True
+- digest covers（摘要覆盖）: domains + authorization + outcome
+- payload digest（载荷摘要）: `982c390107058485`
+
+*Generated by LGD-Eval evidence-grader（由证据分级器生成）；结论受证据级别约束，欢迎独立复现。*
\ No newline at end of file
diff --git a/worked-examples/cases/caseC_unavailable_status_source_input.json b/worked-examples/cases/caseC_unavailable_status_source_input.json
index 0689c7b..04dbea3 100644
--- a/worked-examples/cases/caseC_unavailable_status_source_input.json
+++ b/worked-examples/cases/caseC_unavailable_status_source_input.json
@@ -1,20 +1,22 @@
-{
-  "subject": "Case C — Status source unavailable at verification time (FG-TIDA/use-cases#27)",
-  "domains": {
-    "D2": [
-      {
-        "claim": "Credential status current (not revoked)",
-        "grade": "L",
-        "kind": "audit",
-        "source": "status endpoint unreachable at verification time; no revocation record retrievable",
-        "reproducible": false,
-        "timestamped": false
-      }
-    ]
-  },
-  "authorization": {
-    "result": "unresolved",
-    "reason": "status source unreachable at verification time; unavailable status does not equal revoked",
-    "relying_party_action": "do not treat as revoked; do not treat as valid; escalate"
-  }
-}
\ No newline at end of file
+{
+  "subject": "Case C — Status source unavailable at verification time (FG-TIDA/use-cases#27)",
+  "domains": {
+    "D2": [
+      {
+        "claim": "Credential status current (not revoked)",
+        "grade": "L",
+        "kind": "audit",
+        "source": "status endpoint unreachable at verification time; no revocation record retrievable",
+        "reproducible": false,
+        "timestamped": false
+      }
+    ]
+  },
+  "authorization": {
+    "result": "unresolved",
+    "reason_code": "status_unavailable",
+    "reason": "status source unreachable at verification time; unavailable status does not equal revoked",
+    "relying_party_action": "do not treat as revoked; do not treat as valid; escalate",
+    "policy_action": "defer"
+  }
+}