Correct but Unauditable: Boundary Evidence in Distributed Hosts

A controlled timestamp-only projection of an ABD-style multiwriter quorum-register tag leaves completed reads current, exact, and linearizable while omitting the writer-identity component of the full protocol tag. Correctness therefore does not imply auditability at a distributed read boundary. A deterministic five-state host gives the protocol-independent companion: four sequential operations are totally ordered in real time, yet the read boundary exposes no source evidence.

For an external specification fixed before the realization is chosen, zero-error boundary recovery exists exactly when all co-encoding locations agree and native source evidence aligns with the specified source and derivation relation. Under edit-generated source semantics, boundary agreement is equivalent to temporal zero-delay synchronization. Disjoint audited systems compose, but two independently verified services can assign incompatible roles to one shared location. Value projection likewise fails to preserve auditability; a certified refinement law transports it.

A CAP partition carrier induces the corresponding read-boundary discriminator, but carrier data alone cannot supply the scheduler continuations required for an FLP transport. Finite DLS histories yield an exact stabilization-certificate bound and exclude one fixed evidence budget across all horizons. Protocol and replicated-storage rows illustrate the criterion across distributed boundaries. The substrate-independent ledger records the broader scope. Lean 4 verifies the finite models, reductions, abstraction maps, and internal bounds; the premises linking named systems to those models remain documentary.