Known limits

Part of team up — the windows a process of the same user still has. The checks the bullets name are on the waiting page and the records page.

• The waiting proof is placement, and no more: the state file is in the project, and a process of the same user that writes its own pane, workspace and process identity into this seat's waiting record, renames the pane to this seat and relabels the workspace to match, passes every check above. What copying another seat's record cannot pass is that seat's own record: while the seat whose pane or workspace this was still has a record naming it, the pane is refused (the state names one pane for two seats), so the forger must also move that record — edit it or delete it — before the copy passes. The proof guards a mistaken or corrupted record, not a hostile process running as the same user; nothing here can tell the two apart, because nothing distinguishes them: the same user may do all of it by hand.
• The final read of the box and the pressing of Enter are two separate herdr calls. Something can change the pane in the gap between them; team reads the pane again right before the Enter, but it cannot make the two one action. Closing that needs a key herdr itself does not offer today.
• A row break may hide at most one space, and no read can prove what a pane folds into a break: the check requires every other visible character to match exactly, and refuses anything looser rather than guess.
• The file is read once more, without following a link, directly before the Enter — but a process of the same user can still replace the file between that check and the seat's read. The line carries the file's hash, so the seat, or the owner, can check what was read against what was meant.
• Every folder from team's state root down to rules/ is checked before it is used — but the check and the use are two calls, and a process of the same user can swap a checked folder for a link in the window between them, so a folder of the ladder, or the file itself, lands where the link points. The runtime this runs on offers no way to hold the checked folder open and create the next level through that handle, so the window stays open. What limits it: the write is the approved text and nothing else, through an exclusive no-follow temporary whose name no other process knows, the file is read back by its hash after the rename, and the line the seat receives carries the same hash — so whatever lands wherever it lands can always be checked against what was meant, and nothing but the approved text ever lands anywhere. The removal of a temporary seat's rules file walks the same checked chain as the writer, folder by folder and without following a link, before it unlinks anything — so its window is the writer's own and no wider.