A certificate is not a score. It is a sentence of the form: every state this system can reach, under these assumptions, satisfies this constraint. Four things in that sentence can fail independently. First: reachable. The claim is about a SET, not a trajectory. That is why the Bench draws an envelope rather than a line, and why the envelope is the thing tested against the ceiling. Widen the gap between your smooth model and the real one and the envelope swells until it touches the ceiling, and the verdict turns UNDECIDED, not REFUTED. The envelope over-approximates what the system can do, so the point where it touches the ceiling need not be a state the system ever reaches. Only a trajectory can refute: lower the ceiling below the planned path and the plan itself crosses it, and that counterexample survives any amount of argument. Second: under these assumptions. Press the evidence button. Nothing about the geometry changes - not the envelope, not the trajectory, not the slack - and the verdict changes anyway, from UNDECIDED to CERTIFIED, because measuring the model gap at twenty-five sampled states tells you the gap is AT LEAST that big. It is a lower bound. A tube built on a lower bound can never certify, however much room appears to be left, and no envelope, sampled or proved, can refute. Proof is what certifies; only a trajectory refutes. Third: this constraint. Shorten the horizon and watch the verdict go green. The mass needs about two hundred and eighty milliseconds to reach its apex; with a sixty-millisecond horizon the ceiling is never approached. The certificate is true. It is also worthless, and nothing in the word CERTIFIED tells you so. Fourth, and underneath the other three: every state this system can reach. The tube is a claim about the reachable set, and that claim can be checked. Its free-flight steps carry a zero gap, justified only above the plane, and the precondition check tests that; it fired once, when the whole contact's mismatch was injected at one step and pushed the envelope below the plane. Spreading the mismatch over the steps the contact spans made the check pass, and it looked like the fix. It was not. The gap is not a displacement, it is a TIME offset: the rigid model reverses at the instant of impact and the penalty model about three milliseconds later, so at any fixed moment the two are at different points on the same arc, and no per-step box can hold that. The check that shows it is the plainest one there is: take the trajectory the gap was measured from and ask whether it is inside the tube. It is not. One control step after the bounce it is outside by more than a thousand times the tube's half-width, so the CERTIFIED you produced is void, and so was every verdict this fixture gave before the check was run. Nothing in the word CERTIFIED could have told you. Stiffen the contact until the whole contact fits inside one control step, above about 1e7.1, and the trajectory stays inside: the certificate is no longer contradicted, which is necessary and not sufficient.