# Clear limits

This candidate protects synthetic local objects through a trusted registry,
a SQLite transaction, and a separate protected witness. Process separation
alone is not an operating-system permission boundary.

- **Trusted host:** The requesting agent must not control the host, actor binding, manifest pin, registry, code approvals, clock policy, controller binding, ledger, witness, or database. Python attributes and function arguments do not enforce that separation.
- **Rollback:** Tests restore the database while retaining the current witness and lock. They do not restore the whole machine, a copied witness, or the operator's entire trust state. Whole-host rollback needs an independent durable anchor outside that rollback domain.
- **Clock:** Host mode uses the OS Unix clock plus monotonic samples. The operator must establish whether that clock is reliable. The code detects the stated uncertainty and reversal cases; it does not authenticate UTC or detect every plausible clock lie. Draft.6 checks elapsed nanoseconds and drift without duration rounding,
  using the exact formulas in BOUNDARY.md. Wall samples remain integer Unix
  milliseconds; this does not establish nanosecond UTC accuracy or constrain a
  pause after the final sample. Time offline can remain valid. An unavailable trusted time source cannot be assumed valid.
- **Delivery:** A failure after a pending transition may have begun is `INDETERMINATE`. These tests do not prove physical power-loss durability, distributed exactly-once execution, or recovery from every filesystem failure.
- **Controller reporting:** `DELIVERED` means a numbered dispatch result was returned. It does not prove the whole request is settled. Earlier admissions without a definitive receipt remain `INDETERMINATE`, even after a retry succeeds or is denied. An unverifiable ledger produces `UNVERIFIABLE`. This candidate does not recover an orphan worker result to resolve that uncertainty.
- **Scope:** Object identifiers are opaque. There are no paths, wildcards, callbacks, shell commands, network writes, automatic grant migration, automatic upgrades, or remote attestation in this profile.
- **Public API:** Requester access is only the closed submit/prepare/commit envelope and the configured controller inbox. The evidence verifier reads receipts and returns claims. Operator provisioning, code approval, test fault controls, and private state files are not requester endpoints.
- **Receipt trust:** A valid Ed25519 signature proves that the holder of the pinned key signed the exact claim. It does not establish current authority, fresh state, or the truth of an unobserved effect. Fixture keys used in tests are not Eziah signing keys.
- **Evidence consistency:** RESULTS.md names the checks that can be made from a result and available request context. A plausible claim from a compromised trusted host can still be false. Signatures and consistent fields do not prove unobserved effects or current authority.
- **Controller format:** This candidate creates only new binding/3 test controllers. It does not migrate or reset earlier binding/2 ledgers.
- **Schema limits:** JSON Schema is a structural check. Byte limits, strict parsing, key uniqueness, trust, state continuity, signature verification, and reason precedence also require executable checks.
- **Independence:** This candidate was revised with the author/evaluator's help. Earlier independent implementation results remain historical. A new independent review and acceptance run are still required.
- **Publication:** No owner signature or verified live Eziah.dev reporting intake is included. No private coaching, unpublished expected answers, or hidden test results may be described as publicly reproducible evidence.
- **Licensing:** The selected license allows reuse subject to its terms. It grants no operational authority and makes no production-conformance claim.

The completed old Mac deployment must remain preserved. Do not reset its
spent grant, replace its witness, or point this test constructor at it.

Copying the entire trusted database, witness, approvals, and host identity to
another machine is also outside the tested rollback boundary. A deployment
that permits that copy needs a separate external authority anchor before it
can claim that replication preserves a single shared budget.

Draft.7 preserves accepted wall history per domain using continuity/3. An
initial preflight reading is provisional until pending-witness admission; a
read alone is not durable acceptance. Pending or unverifiable history blocks
action. Monotonic origins remain transaction-local. This does not authenticate
UTC, coordinate domains or resist whole-host rollback. Earlier formats are
rejected without migration. A pending domain can remain permanently closed.