Evidence and limits

The September 23 verification addendum records the released artifact, public Windows/Linux CI and maintainer public-download trials. It supersedes the earlier pending Linux and public-download statements within those tested scopes. The versioned release snapshot remains unchanged. Eighty-four local tests, eighteen overlapping installed checks and seven challenge predicates describe different coverage.

Scope

The target is a synthetic local counter backed by SQLite. Local atomic transactions and unique occurrence keys are stronger primitives than many remote APIs provide. Results do not establish exactly-once behavior for arbitrary payment, email, deployment or physical systems. The opaque profile simulates unavailable outcome evidence; it does not contact an opaque provider.

The operating-system principal and workspace are trusted. This is not a hostile-worker sandbox, an access-control service or a hardware attestation system. Filesystem corruption, deletion, administrator edits and clock manipulation are not made impossible by a local ledger. SQLite FULL synchronization depends on the filesystem and hardware honoring their contracts.

Verification

Current tests include actual process termination after target commit, exclusive replacement, revocation, tenant scope, immutable exports, wrong-target evidence, independent progress during uncertainty, conditional compensation, fresh dependency checks and stdio MCP traffic. Tests exercise named cases, not every possible failure. Failed trials are retained in the release evaluation record rather than discarded.

The research snapshot contains 283 mechanisms, 25 families, 57 source records and 12 merged aliases. R, E and D describe research basis. None means this program reproduced a production incident or prevents the entire family. Runtime coverage is a separate, versioned record.

The coverage matrix binds 18 narrowly described local subcases to the matching test run and retained trial history. The other 265 mechanisms have explicit implementation boundaries and no runtime prevention claim. Even a passing mapped test does not verify the full research mechanism.

Unfinished capability qualification

Inert import, bounded foreground servicing, resource limits, cancellation accounting and local-inbox finalization have isolated tests. The addendum records later package and public-acquisition qualification; it does not turn every isolated test into production coverage. Runnable migration across unrelated targets and remote delivery adapters are outside this implementation.

Independent choice

Your existing durable workflow engine may already provide the primitives you need. Nondeterministic model calls can be recorded at appropriate durable boundaries; they do not inherently invalidate every workflow engine. Compare the actual version, target contract, state storage, effect semantics and recovery behavior before choosing an integration.

Reading the documentation or running a local test grants no authority over another account or system. Unknown outcomes stay unknown until appropriate evidence resolves them. A signature identifies a signer; a hash identifies bytes. Neither alone proves semantic correctness.

September 24 continuity research layer

The release and September 23 qualification remain historical anchors. The new evidence page adds a separately identified source-tree cold-process experiment and a burden specification. Neither changes the v0.1.0 wheel, installs a wake, demonstrates a remote effect adapter or proves private Camden capabilities. Source-only comparisons are not competitor runs.