Read the control on the log line

Before you start

A control's continuous evidence is born once, at the source, in a single structured log line — at a field you can point to. You are handed the real RFC 5424 example lines and asked to read three control claims directly off the slots: "auth failures are recorded at an alertable Severity" (the PRI byte), "audit records attribute the actor" (a NILVALUE where a value belongs), and "machine evidence lives in named fields" (STRUCTURED-DATA) — then trace where evidence is born versus queried, map each field to the control it evidences, and diagnose the single field where a real downgraded line breaks its claim. This surface is the log line itself, rendered as nested named regions (the OSI move applied to a log). Selecting a region reveals the parser's real decode — including the PRI bit-unpack into its Facility (PRIVAL / 8) and Severity (PRIVAL mod 8). Every value is the parser's computation over the real characters; nothing is invented; the line is the answer key. Start on the clean auth-failure line (ex1-clean).