Function weakened_by 

pub fn weakened_by(
    judgement: Judgement,
    records: &[Supplementary<'_>],
) -> Judgement

The monotone rule: a supplementary record may withhold proven and never grant it.

It changes a judgement only when the judgement is proven or inputs_unchanged and some record failed, timed out or errored on a clean tree, at a commit that contains the evidence commit and that the presented revision contains. Then the state becomes stale, naming the record. The cap is stale and not failing: a supplementary record withholds proven and never decides a verdict.

use majordomus_cli::evidence::freshness::{weakened_by, Judgement, Supplementary, UNCOMMITTED_RUN};
use majordomus_cli::evidence::{Execution, ProofState};
use majordomus_cli::git::Containment;

let failed: Execution = serde_json::from_value(serde_json::json!({
    "test": "suite:07_scope", "runner": "suite", "source": "test/cases/07_scope.sh",
    "outcome": "fail", "seconds": 1, "commit": "b".repeat(40), "working_tree": "clean",
    "digest": "sha256:0", "at": "2026-09-26T00:00:00Z", "origin": "local",
    "command": "bash test/run.sh 07_scope"
}))
.unwrap();
let record = Supplementary {
    execution: &failed,
    named: UNCOMMITTED_RUN,
    after_evidence: Containment::Contains,
    in_presented: Containment::Contains,
};
let proven = Judgement { state: ProofState::Proven, changed: vec![], detail: None };
let j = weakened_by(proven, &[record]);
assert_eq!(j.state, ProofState::Stale);
assert!(j.detail.unwrap().contains(&"b".repeat(12)));

// and never the other way
let failing = Judgement { state: ProofState::Failing, changed: vec![], detail: None };
assert_eq!(weakened_by(failing.clone(), &[record]), failing);