Where the claim can be true

Before you start

A control truth is produced by exactly one tier and can only be read where that tier produces it. You are handed a real HTTP request as it crosses the three-tier path (edge → app → data) and the real headers it accretes, and asked to read each control claim off the header the owning tier writes — the client's protocol from Forwarded proto=, the session from Set-Cookie, the token from the JWT — then diagnose, in clean/broken pairs, the single field where a control breaks at its tier. Every value you reveal is the header parser's real decode of the real header bytes (per RFC 7239 / 6265 / 9111) or the JWT decoder over the real token segments (RFC 7519 / 8725). Nothing is invented; the parser's parse tree is the answer key. Start on the clean provenance panel.