Supported scope, tested behavior and limitations

Supported only within the stated trusted local boundary and finite fixture:
- Two authenticated principal UIDs, two separate delegate UIDs, one service UID,
  two synthetic protected local objects; fifteen lifetime terminal workflows
  per principal. Refusal and explicit closure consume lifetime allocations.
- Exact request/actor/resource binding; submit and prepare/commit rechecking;
  one effect for a successfully executed grant; replay denial in the tested cases.
- Durable issuance intent reconciliation using the same intent ID and bytes;
  terminal state continuity across the tested quiescent restart of the same domain.
- Fail-closed behavior on detected inconsistent/pending authority state. A refusal
  to operate is a safety outcome, not an availability or recoverability guarantee.

Evidence: one independent AI-operated reference-Linux installation and acceptance,
plus offline raw-evidence cross-checks. These observations are not a universal
proof of every execution path or a new independent audit of all integration code.

Critical availability disclosure:
An interruption after pending witness publication can leave the entire authority
domain permanently unavailable. OOM, process kill, storage failure or similar
interruption can have this consequence. There is no supported witness repair,
domain reconstruction, migration, replenishment or recovery. Preserve uncertainty;
do not edit the witness, replay setup or substitute a new domain as a repair.
The successful orderly restart is not crash recovery. The fresh-Linux trial did
not induce those failures and does not demonstrate their recovery.

Not established:
- Protection of real production objects, external/network effects, production
  credentials, broad integrations, unbounded use or production readiness.
- Availability/SLA, arbitrary concurrency, maximum-byte workloads, disk exhaustion,
  power-loss behavior, hostile root/service/OS, whole-host rollback defense.
- Trusted UTC attestation, clock authenticity, a measured live late-check window,
  or physical commit-time expiry. Four temporal cases used synthetic clocks.
- Recovery of a lost action return value. Issuance reconciliation is different.
- Raw-service capacity testing through a principal-journal bypass; only documented
  client allocation refusal beyond fifteen was exercised.
- Other OS/CPU/runtime/storage configurations. Sampled resource use is not a peak
  bound and not complete requalification of the Linux resource envelope.
- Independently human-operated installation, organizational adoption, production
  deployment, certification or endorsement. The evaluator was a Claude Code session.

A publisher signature binds bytes to a signing identity. It grants no runtime
authority and does not convert test results into guarantees beyond this scope.