Bounded synthetic walkthrough — do not execute before trial approval

RECOMMENDED: run the scripted walkthrough on the newly sealed, unused domain.
Review verification/acceptance_v1.py first. Invoking it explicitly approves its
fixed synthetic requests for both principals. The operator orchestrates distinct
Linux caller UIDs; no principal identity comes from requester-controlled JSON.

ROOT (launches children under their own UIDs, reads evidence, controls only the
new trial's processes, and creates an ephemeral cgroup scope):

  sudo systemd-run --scope --unit "$EZA_PREFIX-accept-001" \
    --property=MemoryMax=1G --property=MemorySwapMax=0 --property=TasksMax=64 \
    /usr/bin/python3 -I -B "$EZA_HOME/package/verification/acceptance_v1.py" \
    --config "$EZA_STATE/config.json" --run-id first-attempt-001

The scope name must also be new. Do not rerun on a used domain to chase a PASS.
A failure is evidence. The script stops on unexpected outcomes and preserves
state, requests, output, exit codes, independent snapshots and sampled resources.
Its launcher stops on completion/failure. A forced interruption can close the
domain; the script never repairs or replaces a witness or domain.

What the walkthrough does, in order:
- Checks revision zero and independent SQLite/witness agreement.
- Starts the four-lane service using service-created listening sockets, root
  ownership assignment, and inherited descriptors. No root-created listener.
- Proves callers cannot read the authority file or use another principal's lane;
  delegates cannot read principal contexts/journals.
- Principal X approves a journaled exact write request. Wrong delegate, changed
  value and changed object attempts fail without consumption/effects. The exact
  action executes once; its identical replay fails without a second effect.
- Both principals use submit and prepare/commit workflows, including reads whose
  returned synthetic values are compared to the independent state oracle.
- X workflow 5 deliberately discards its issuance reply. Inspect and issue-retry
  reuse the same durable intent ID and bytes. The same grant is recovered with
  no new terminal slot or authoritative revision. This is issuance reconciliation,
  not recovery of an action's lost return value.
- After eight terminal outcomes per principal, all requests are quiescent; the
  service stops and restarts over the SAME domain, witness and journals. Exact
  state hashes and old terminal facts survive, and an old action still refuses replay.
- Finishes fifteen terminal workflows per principal: X has 12 ISSUED, 2 REFUSED
  and 1 CLOSED_NO_ISSUANCE; Y has 15 ISSUED. Final oracle requires 30 terminal
  records, 27 unique grants, 27 consumed roots and 27 effects, with exact bindings.
- Both journals refuse a sixteenth allocation. The script never bypasses the
  principal journal to allocate a new intent through raw socket machinery.
- Stops the live service and runs four separate disposable operator-only temporal
  fixtures. They test pre-publication expiry on submit/commit, elapsed/drift
  violations, unchanged authoritative bytes/witness, retained prepared handle,
  and safe retry. Successful fixture mutations must take all four clock samples.

Alternative MANUAL ONE-WORKFLOW example (consumes a slot; cannot precede the full
acceptance on the same domain). Run from a NEW normal-user result directory,
never from inside the sealed package. All example values are synthetic.

ROOT, terminal A: foreground service under a transient bounded scope:
  sudo systemd-run --scope --unit "$EZA_PREFIX-manual-001" \
    --property=MemoryMax=1G --property=MemorySwapMax=0 --property=TasksMax=64 \
    /usr/bin/python3 -I -B "$EZA_HOME/package/integration/launcher_v1.py" \
    --config "$EZA_STATE/config.json"
Wait for LISTENERS_HANDED_OFF. A subsequent client exchange authenticates the
listener and confirms service operation; the marker alone is not a test verdict.

UNPRIVILEGED, terminal B: reuse explicitly chosen variables from INSTALL.txt.
  python3 -I -B "$EZA_HOME/package/integration/example_v1.py" issuance \
    --principal X --value synthetic-example > request.json

ROOT identity switch for each following sudo command (clients themselves non-root):
  sudo -u "$EZA_PREFIX-px" "$EZA_PY" -I -B \
    "$EZA_HOME/package/integration/principal_v1.py" \
    --client "$EZA_STATE/clients/px" new < request.json > intent.json

UNPRIVILEGED: retain this ID and request file; do not regenerate them after uncertainty.
  EZA_INTENT=$(python3 -c 'import json,sys; print(json.load(sys.stdin)["intent_id"])' < intent.json)

ROOT identity switches: deliberately lose the first issuance reply, then reconcile:
  sudo -u "$EZA_PREFIX-px" "$EZA_PY" -I -B "$EZA_HOME/package/integration/principal_v1.py" --client "$EZA_STATE/clients/px" lose-reply "$EZA_INTENT" > lost.json
  sudo -u "$EZA_PREFIX-px" "$EZA_PY" -I -B "$EZA_HOME/package/integration/principal_v1.py" --client "$EZA_STATE/clients/px" inspect "$EZA_INTENT" > inspected.json
  sudo -u "$EZA_PREFIX-px" "$EZA_PY" -I -B "$EZA_HOME/package/integration/principal_v1.py" --client "$EZA_STATE/clients/px" issue "$EZA_INTENT" > issued.json

Expected: lost.json says UNKNOWN, inspected/issued say COMPLETE/ISSUED and have
identical issuance/grant content. If not, stop and preserve; do not invent a new
intent. NOT_RECORDED does not prove an in-flight operation can never commit.
Resolve is an explicit durable closure decision, not a harmless inspection.

UNPRIVILEGED: derive exact action bytes from the bound grant:
  python3 -I -B "$EZA_HOME/package/integration/example_v1.py" action < issued.json > action.json

ROOT identity switches: execute and replay the SAME saved bytes:
  sudo -u "$EZA_PREFIX-dx" "$EZA_PY" -I -B "$EZA_HOME/package/integration/delegate_v1.py" --client "$EZA_STATE/clients/dx" submit < action.json > executed.json
  sudo -u "$EZA_PREFIX-dx" "$EZA_PY" -I -B "$EZA_HOME/package/integration/delegate_v1.py" --client "$EZA_STATE/clients/dx" submit < action.json > replay.json
Expected COMPLETE: first execution SUCCEEDED/protected_effect_count=1, replay
NOT_EXECUTED/protected_effect_count=0. Inspect protected evidence as the operator:
  sudo -u "$EZA_PREFIX-svc" "$EZA_PY" -I -B "$EZA_HOME/package/verification/inspect_v1.py" "$EZA_STATE/service/domain" > oracle.json
Expected one grant, consumed root and effect. This inspector reads only.

For restart, wait for all commands to finish; press Ctrl-C in terminal A. Restart
that same launcher command with a fresh transient unit name, without rerunning
setup/seal. Inspect the SAME intent and replay the SAME action again. Terminal
issuance remains historical; consumed is true; there is no new execution.
If the launcher refuses pending/mismatched state, preserve it and STOP.

For prepare/commit on a NEW approved workflow, replace submit with prepare, save
response.handle, then invoke commit --handle HANDLE with the same action bytes.
A handle is a binding to re-check, not authorization by itself. The scripted
walkthrough provides this complete case without consuming extra manual slots.
