Function compose_for_prompt_attested 

pub fn compose_for_prompt_attested<'a, I, S>(
    frames: I,
    global_budget: u32,
    strategy: &S,
    attestations: &AttestationLedger,
) -> ComposedPrompt
where
    I: IntoIterator<Item = (&'a str, &'a ContextFrame)>,
    S: RankingStrategy + ?Sized,

compose_for_prompt_with, plus the attestation state each frame earned during the fan-out (SPEC.md §6.5, ADR 0016).

This is the one implementation the other two entry points delegate to; they differ only in defaulting the strategy, the ledger, or both. Both parameters are explicit here rather than defaulted because a host that cares which evidence is signed certainly has an opinion about which evidence is packed.

The ledger changes nothing about which frames are chosen or where they land — it only fills in each AuditEntry::attestation. That separation is the point: acting on an attestation state is a host’s policy call, and making it here would be an F9 violation, since refusing an unverifiable attestation is exactly the denial-of-service primitive F9 forbids. The strategy decides selection; the ledger only describes.

A frame the ledger has nothing to say about is AttestationState::NotChecked, which is why the ledgerless entry points report that rather than claiming the frames were unsigned.