Objective acceptance for the FIRST approved Linux attempt

These are newly authored operator checks. A developer runs and judges them
independently of the implementation authors; their presence here is not a claim
that the tooling itself has received independent validation.

Run the single command in WALKTHROUGH.txt on an untouched, sealed domain.
Exit 0 AND state/results/first-attempt-001/RESULT.json status PASS are required.
Any nonzero exit, missing final record, unresolved INDETERMINATE, unexpected
BLOCKED, timeout, resource stop, or failed assertion is FAIL/INCOMPLETE; preserve
it. Do not infer success from the service log, an exit status alone or old reports.

Required independently observed outcomes:
1. Frozen and package inventories pass before installation and after the attempt.
   Runtime version preflight passes. Five different OS UIDs, four 0600 sockets,
   service-created listeners authenticated by clients, protected-state isolation.
2. Wrong delegate, changed value and changed object: COMPLETE NOT_EXECUTED with
   protected_effect_count zero; no added grants/consumption/effects or object change.
3. Authorized submit and prepare/commit: SUCCEEDED and one effect; exact read
   return values and write parameters match the read-only state oracle.
4. Replay: no second protected effect/consumption. No false success from a saved
   receipt. Prepared bindings are used with exact request bytes.
5. Lost issuance reply: same intent recovered, same grant, same authoritative
   revision on retry, exactly one terminal record. No invented replacement ID.
6. Quiescent restart after eight workflows per principal: exact committed BLOB
   and witness hashes unchanged; old terminal outcomes inspectable; old replay denied.
7. Final protected counts: thirty terminal records, fifteen for each principal;
   X has twelve ISSUED/two REFUSED/one CLOSED_NO_ISSUANCE; Y has fifteen ISSUED;
   twenty-seven unique grants, consumed roots and effect records. Registry, grant
   bindings and effects agree. Client allocation 16 fails for both journals.
   Raw service capacity denial past 15 is not probed by bypassing the journal.
8. Four operator temporal cases: submit/commit expiry and elapsed/drift violations
   at the new check; zero witness publications; unchanged authoritative BLOB and
   witness; retained commit handle; later valid retry succeeds once. Successful
   mutations sample initial time plus all three checks. No clock origin reset.

Evidence location and independent checking:
  ROOT read: sudo cat "$EZA_STATE/results/first-attempt-001/RESULT.json"
  ROOT read: sudo cat "$EZA_STATE/results/first-attempt-001/FINAL-ORACLE.json"
The result tree contains numbered dispatch.json, exact stdin/stdout/stderr,
exit/duration records, oracle snapshots, launcher logs, resource samples, failure
traceback if any, and SHA256SUMS. State/service/temporal-first-attempt-001 contains
separate fixture inputs/results and domain state; export includes these too.

A second operator can inspect SQLite without using the enforcement evaluator:
  ROOT identity switch:
  sudo -u "$EZA_PREFIX-svc" "$EZA_PY" -I -B "$EZA_HOME/package/verification/inspect_v1.py" "$EZA_STATE/service/domain"
This oracle checks the raw BLOB hash against the committed witness, exact record
bindings and counts. It does not call host.Endpoint or permit a requester to read
protected state. Root/service are already trusted operator identities.

After the attempt, UNPRIVILEGED byte recheck:
  python3 -I -B "$EZA_HOME/package/verify_v1.py" --expected-inventory "$EZA_INVENTORY"

Scope limits: small synthetic values, finite lifetime test, one orderly restart,
scripted pre-publication clock faults and sampled resource observations only.
No fresh Linux PASS exists at packaging time. No maximum-byte workload, arbitrary
interruptions, disk exhaustion, power loss, concurrency races, clock authenticity,
physical commit-time expiry or complete Linux resource requalification is claimed.
Sampled RSS may miss peaks. The live late-check window is not measured by this
walkthrough; synthetic clock tests are not a timing guarantee. The sampler stops
before further dispatch at observed tree RSS >=768 MiB or disk free <=1 GiB;
service/kernel mutation admission separately guards 512 MiB headroom. An OOM,
process kill or storage failure may permanently close the domain; no retry repairs
it. An unpublished veto reported INDETERMINATE is not distinguishable to a client
from every post-publication uncertainty. Issuance reconciliation is distinct from
recovery of a lost action return value, which this candidate does not provide.
