## 3. A check that can prove it can fail

A check that has never said no is not known to be a check. It might be one. It might be a rubber stamp with good posture. From the outside the two are indistinguishable until the day it matters.

So the negative fixtures are first-class citizens of the suite. For every way a receipt or a chain of receipts could be forged, there is a test that forges it and demands the right refusal by name. Tamper with one sealed count inside a chained bundle and verification has to fail, and fail with the specific name for that tampering, `CHAIN_LINK_UNVERIFIED`, not a shrug and a generic error. Reorder the members, drop one, substitute one: each sabotage has its own named failure, and each name is exercised end to end in the ordinary test run. The verifier also carries a self-test whose whole job is to demonstrate, on demand, that the rejections still fire.

That sounds paranoid until you notice which way verification systems rot. They rot toward yes. Deadlines, demos, the slow annoyance of false alarms, every pressure on a checking system pushes in the same direction, and nothing pushes back except deliberately maintained proof that no still works. The yes is the pleasant output. The named no is the product.