diff --git a/src/xrpld/app/consensus/ConsensusEntropyIntent.md b/src/xrpld/app/consensus/ConsensusEntropyIntent.md
index e238fc159..402c4d531 100644
--- a/src/xrpld/app/consensus/ConsensusEntropyIntent.md
+++ b/src/xrpld/app/consensus/ConsensusEntropyIntent.md
@@ -150,12 +150,14 @@ bounded deadline. *Anti-pattern:* requiring `fullObservation()` before ignoring
 below-quorum conflict, which lets a minority equivocation recreate a veto.
 
 **INV-4A — Every counted position is authenticated; every reveal is proofed.**
-Proposal sidecars are validator statements. Before a proposal position may enter
-the peer-position store, count toward root alignment, or contribute a commitment
-or reveal, its signature must verify and its signing key must resolve to the
-claimed active-view master `NodeID`. Cluster-peer transport trust never
-substitutes for either check. This authenticated active-view cohort is the only
-universe alignment and contribution counts may observe.
+Proposal sidecars are validator statements. A proposal signature must verify
+before its position enters the peer-position store; cluster-peer transport trust
+never substitutes for that check. Before a stored position may count toward root
+alignment, its captured master `NodeID` must belong to the active view. Before it
+may contribute a commitment or reveal, ingress additionally verifies that its
+signing key resolves to that active-view master. These authenticated,
+active-view-filtered cohorts are the only universes alignment and contribution
+counts may observe.
 
 In this document, a *proofed commitment* is a commitment from proposal sequence
 zero accompanied by a self-contained serialized `ExtendedPosition` whose
diff --git a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md
index 18d75609f..d32ee5f15 100644
--- a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md
+++ b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md
@@ -257,13 +257,14 @@ commit transport path.
 Commit quorum counts only proofed commits from active validators. A commit that
 cannot be emitted as a verifiable sidecar leaf does not count.
 
-Every proposal position used for commitment/reveal harvest or sidecar-root
-alignment has already passed proposal-signature verification and active-view
-master/signing-key attribution before entering consensus peer-position state.
-Cluster transport trust does not bypass that boundary. Here, *proofed* means a
-sequence-zero commitment accompanied by a self-contained serialized signed
-`ExtendedPosition` whose signature and attribution both verify; a bare digest is
-not a proofed commitment.
+Every proposal signature is verified before its position enters consensus
+peer-position state; cluster transport trust does not bypass that boundary.
+Sidecar-root alignment then counts only stored positions whose captured master
+belongs to the active view, while commitment/reveal harvest additionally verifies
+the live signing-key-to-master attribution. Here, *proofed* means a sequence-zero
+commitment accompanied by a self-contained serialized signed `ExtendedPosition`
+whose signature and attribution both verify; a bare digest is not a proofed
+commitment.
 
 Reveal collection targets all known committers, because the commit sidecar set
 defines who is expected to reveal. The reveal wait is still bounded. A node