Function validated_state_cert 

pub fn validated_state_cert<T: NodeType>(
    proposal: &Proposal<T>,
    epoch_height: u64,
) -> Option<&LightClientStateUpdateCertificateV2<T>>

The proposal’s state_cert, if Validator::state_cert actually checked it.

The validator skips the field unless the parent QC sits at an epoch root, and the proposal signature does not cover it (Leaf2 discards it), so anyone relaying a proposal can substitute it. Every store site must gate on this, or it files away a certificate nobody verified, under an epoch of the sender’s choosing.

Re-running the correspondence check binds the certificate’s epoch and view to the QC here rather than trusting that the validator did it, so the epoch the store sites key by cannot be chosen by the sender. Callers must still pass a validated proposal: the threshold signature check only happens there.