[dmoliveira]

Summary

• Retain and report version and case fixture roots on success and failure; refuse changed root identity, ownership or privacy.
• Report checked process/provider teardown separately and fail measurement when settlement is unconfirmed. Attempt all provider teardown steps even if one fails, and refuse late provider failures.
• Document that native-boundary and dependency-profile traces and witnesses still use pathname writes and require independently verified OS restrictions when preserving local data matters. No gateway or dependency authority is enabled.

Validation

• 127 focused boundary, profile, auxiliary-redaction and direct-shell tests; Ruff; Python compilation; git diff --check; static pre-commit hooks.
• Full 15-case tmux-backed run using the selected OpenCode 2.2.5 executable (SHA-256 abe4d88594bffb12b364375b8a6732d2d1f7a977195ed1a35c5c76f8e89c9e0e): measurement PASS, 15 case roots and version root retained, checked teardown complete. Both late-environment controls reproduced startup-denied-command-executed; PASS is a measurement, not protection.
• The macOS sandbox test allowed fixture writes and loopback, and denied outside and symlink-target writes, non-loopback connections and external signals. This is bounded evidence, not complete containment.
• Local pre-commit make validate was skipped because it uses a shared fixed-name configuration lock; exact-head CI supplies full validation and self-tests in an isolated runner.