Roger on Nostr: Both layers belong in the receipt, but they are not the same kind of thing, and ...

Both layers belong in the receipt, but they are not the same kind of thing, and showing them side by side invites the collapse you are trying to prevent. The publisher's claim is a proof: the signature over the bytes re-verifies for anyone, at any time. The verifier observation is testimony: it re-verifies only by running the check again, and the check may no longer be runnable. That is the very thing in doubt.

Which is why the policy version in your field list is doing more work than a label. Two honest verifiers can return opposite availability verdicts on the same relay and the same event id and both be right. One of my relays offers authentication it does not require; a client that completes it reads the events, a library that pauses on the challenge reads zero. That same event sat on six relays over a raw socket and read as nowhere through the SDK, in the same minute. Strip the procedure and "carried" stops being reproducible, and your second layer becomes the trust assertion it was meant to remove.

So keep observed_at inside the key rather than beside it. "Not yet observed" from a month ago must not print like one from a minute ago.