Handshake is what each peer told us at version exchange — a one-time snapshot, doesn't update. Last seen tip is a running lower bound on the peer's current chain — we bump it every time we directly observe them have a block (BlockData receipt, or InvBlock for a hash we already know). When it says "no updates since handshake", we've heard no height-bearing traffic from this peer since they connected — they may be silent, stalled, or just idle. Cert hash is the first 8 bytes of SHA-512(ml_dsa_vk), the same value that appears in every block header that peer's certs sign.