[Maurice1969DB]

Test only; no code changes, no release.

tests/Fixtures/spec045-c2patool027-rogue.png carried a rogue CA and signer valid for 30 days, until 2026-11-09 06:38:52 UTC. Since then the file reads Invalid (signingCredential.expired, no time-stamp) instead of a trusted file over an untrusted ingredient. AC3's table row kept passing, because under Amendment 2 nothing below an untrusted report is trusted, so it passed for a reason it was not written for. The Drupal module, which copied the file, went red on it (content_credentials #3636349).

• The fixture is replaced by the module's rebuild: rogue CA and signer valid to 2036-11-05, re-signed with c2patool 0.27.22 and the C2PA test signer, no time-stamp. It expires with the test signer on 2030-08-26.
• New test "keeps a trusted file trusted over its untrusted ingredient" (verifier, extension) pins the precondition the row relies on. Run red on the expired file (2 failed), green on the rebuild.
• SPEC-045 Amendment 5 (approved 2026-11-09) with Traceability; NOTES Step 78.

composer check: 530 passed, 7 skipped.