@Soupstraw found the following bug in the current formal spec:

In lines 466--467 we define validVoteDelegs and this is used to replace validDelegs in the CERTBASE rule, but this shouldn't happen until after the CERT rule is applied to all the certs in the list.