Document CI API availability and historical mincrypt layouts

include/Domito.MinCrypt.h

@@ -322,12 +322,17 @@ typedef struct _MINCRYPT_CHAIN_INFO
     PMINCRYPT_CHAIN_ELEMENT ChainElements;
     UINT32          NumberOfChainElement;
 
-    // ASN.1 blob of authenticated attributes - spcSpOpusInfo, contentType, etc.
+    // REQUIRES a confirmed runtime layout (10586 and later sampled profiles).
+    // Sampled 10240 has only 56 header bytes: +0x38 begins variable payload.
+    // NTDDI_VERSION and allocation Size cannot establish field availability.
+    // See Domito.MinCrypt.Historical.h for distinct observed x64 prefix views.
     MINCRYPT_ATTR_BLOB AuthenticodeAttributes;
 
-    // Observed 26100 x64 adds RootId at +0x34 and a 32-byte platform-manifest
-    // binary ID at +0x48. These are exposed only by Domito.MinCrypt.26100.h.
-    // Do not infer their availability solely from NTDDI_VERSION or Size.
+    // RootId occupies padding at +0x34 in all six historical x64 samples and
+    // 26100. The historical views name it without extending this default layout.
+    // 26100's 32-byte platform-manifest binary ID at +0x48 is named only in its
+    // explicit version header. Earlier 104-byte views reserve that extension.
+    // Do not infer field availability solely from NTDDI_VERSION or Size.
 
 #endif // NTDDI_VERSION >= NTDDI_WIN10
 
@@ -518,7 +523,10 @@ MINCRYPT_ALLOCATE_ROUTINE(
 typedef MINCRYPT_ALLOCATE_ROUTINE* PMINCRYPT_ALLOCATE_ROUTINE;
 
 /**
-*  Parse the publisher name from the certificate
+*  Parse the publisher name from the certificate.
+*  Export absent from sampled Windows 10 x64 builds 10240–17134; observed present
+*  on 19041.1865, 22000.318 and 26100 x64; absent on sampled 19041.1 x64.
+*  The NTDDI guard does not establish runtime availability. See NOTES.md.
 *
 *  @param  Certificate - &PolicyInfo.ChainInfo->ChainElements[x].Certificate
 *
@@ -541,6 +549,8 @@ CiGetCertPublisherName(
 );
 
 
+// Export observed already in 15063.0 x64 (1703); absent from sampled
+// 10240/10586/14393 files. This writes CI-global state, not per-file policy.
 MINCRYPTAPI
 VOID
 NTAPI
@@ -550,7 +560,8 @@ CiSetTrustedOriginClaimId(
 
 // Domito descriptive name, not an official Microsoft flag name.
 // Observed on CI 10.0.26100.8328 x64: broadens the accepted-root mask in
-// CipGetAcceptedRootKeys. This is not a WinVerifyTrust-equivalent trust policy.
+// CipGetAcceptedRootKeys. Sampled 1709/1803 instead select 0x224FF; earlier helper
+// generations differ. This is not a WinVerifyTrust-equivalent trust policy.
 // See docs/ci-validate-file-object.md for evidence and version limitations.
 #define DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE 0x00000020UL