Document runtime-confirmed CI signer selection and crypto reuse

docs/mincrypt-contracts.md

@@ -158,6 +158,42 @@ later conversion failure. It is not owned by either policy object.
 Evidence: `MincryptFreePolicyInfo`, `MincryptCopyPolicyInfo`,
 `I_MincryptAddChainInfo`, `CiVerifyHashInCatalog`, and `CiGetCertPublisherName`.
 
+## Multiple signatures and selected results
+
+`CiValidateFileObject` returns one selected signature result and its timestamp
+policy. Those two policy outputs do not enumerate two file signatures. The
+output file digest and algorithm are not expected-certificate selectors.
+
+REA tracing of x64 CI 22621.2792 and the original 26100 sample found a
+flag-dependent distinction: ordinary `0x20` can continue nested-signature
+verification and retain a policy-preferred signing level. Adding `0x80` enters
+an early-exit path after the first successful full candidate verification.
+`0xA0` is therefore a concrete kernel experiment, not a proved stable
+"select primary signature" flag: `0x80` also affects other policy/fallback paths.
+An arbitrary signer index, expected-certificate predicate and continuation
+interface are not exposed by these examined wrappers.
+
+For the supplied BthPS3 fixture, host SignTool verifies a primary Nefarius
+SHA-256 signature and a nested Microsoft SHA-256 signature. On both examined CI
+builds, `CiCheckSignedFile` with the matching SHA-256 digest follows the primary
+signature directly. This gives a CI-based alternative worth testing without
+implementing RSA/ECDSA, chain or timestamp verification. A subsequent user-run
+probe on Windows 11 22631 x64 with TESTSIGNING enabled confirms that `0x20`
+returns Microsoft while `0xA0` and direct SHA-256 `CiCheckSignedFile` return the
+Nefarius leaf and its signing time. Every top-level and signer/timestamp policy
+status succeeds; the two company-signer routes have matching policy observations.
+The companion `signature-selection/runtime-22631-bthps3.json` retains exact
+fixture/trace identities. This does not establish TESTSIGNING-off or general
+cross-build behavior. A different layout may still require bounded signature
+framing/enumeration.
+
+The companion CodeIntegrity-RE `SIGNATURE-SELECTION.md` retains fixture hashes,
+56 procedure bodies, assembly, flag side effects and the kernel test plan.
+The 23H2 batch is
+`ev_049bd7d3aa492a9e3e4d8fcbf365ae00a6057751b26f93f3c1663c9436952ff7`;
+its primary-selection helper is in
+`ev_c867c73ca7eae7e4fbca2f44c6f6fb5904fb00459d0b84f2da8294b5b05a3866`.
+
 ## Digest-based verification inputs
 
 `CiCheckSignedFile` consumes a caller-computed file digest. It does not reopen