Require uv=0,up=0 for conditionalCreate

index.bs

@@ -1744,6 +1744,8 @@ By setting <code>|options|.{{CredentialCreationOptions/mediation}}</code> to {{C
 [=[RPS]=] can indicate that they would like to register a credential without prominent modal UI if user has already consented to create a credential. The [=[RP]=] SHOULD first check that {{ClientCapability/conditionalCreate}} is present
 in the result of {{PublicKeyCredential/getClientCapabilities()}} in order to avoid the possibility of causing a user-visible error to be returned if the user agent does
 not support {{CredentialMediationRequirement/conditional}} [=user mediation=] for {{CredentialsContainer/create()|navigator.credentials.create()}}.
+The authenticator SHOULD set BOTH |userPresence| and |userVerification| to |FALSE| when <code>|options|.{{CredentialCreationOptions/mediation}}</code> is set to {{CredentialMediationRequirement/conditional}}
+unless explicitly collected during the ceremony.
 
 Any {{CredentialsContainer/create()|navigator.credentials.create()}} operation can be aborted by leveraging the {{AbortController}};
 see [[dom#abortcontroller-api-integration]] for detailed instructions.
@@ -2023,7 +2025,14 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
                         <dl class="switch">
 
                             :   is set to {{UserVerificationRequirement/required}}
-                            ::  Let |userVerification| be [TRUE].
+                            ::  If <code>|options|.{{CredentialCreationOptions/mediation}}</code> is set to
+                                <dl class="switch">
+                                    :   {{CredentialMediationRequirement/conditional}}
+                                    ::  throw a {{NotAllowedError}} {{DOMException}} unless it can be explicitly collected during the ceremony.
+
+                                    :   empty or another value
+                                    ::  Let |userVerification| be [TRUE].
+                                </dl>
 
                             :   is set to {{UserVerificationRequirement/preferred}}
                             ::  If the |authenticator|