Two services, one flow. Service 1 — the creator already shows the AI label, so we add the missing digital signature and issue a receipt. Service 2 — they have neither, so we supply both the visible "AI-GENERATED" wording and the embedded provenance. Then we issue a signed certificate.