Certified extract: value + citation + archived-source sha256 + verification chain, Ed25519-signed. Refuses uncharged without evidence