Sworn seals · HMAC · SEC · no pasted JSON copy
D1 custody_chain · DO FROISession · on-device vault
Stays to its nature · no R2 cloud dep
Option 3 · all live paths · no deletes
NO_BEZOS NO_AWS NO_INTEL · Andon soft-halt on seal miss