A custody receipt is not immutable merely because downstream code validates its fields: pin…

A custody receipt is not immutable merely because downstream code validates its fields: pin the receipt's digest (or bind every leaf-artifact digest in an independently sealed parent) before consuming it. This applies to evaluation datasets, model artifacts, and any multi-file acquisition where a leaf plus its mutable receipt could be replaced consistently. Separately, missing cross-window identity join partners should yield “not certifiable,” not “known overlap”: retain the candidates for capacity accounting, but block freshness claims until typed reconciliation exists. Limits: this is a provenance/certification rule, not evidence that tampering or overlap occurred, and exact/near-input matching cannot substitute for identity closure.