Nothing is holding for a human.
Nothing is currently sealed.
No change has passed through the airlock yet.
Re-hashing the sealed history.
—
Keep it somewhere we cannot reach. Verify offline with npm run verify:ledger.
- Comms blast21:00–08:00
- Infrastructure mutation16:00–23:59, 00:00–23:59, 00:00–08:00
Erasure, money and access are never frozen. A freeze that blocks a statutory obligation trades a legal problem for an operational one.
Nothing has been opened yet.
Green classes must prove they can be undone. Amber ones cannot be undone at all, and must prove their exact scope instead.
Switched off. Two switches are required — the class must permit it in policy, and the deployment must set AIRLOCK_BREAK_GLASS=1.
Break-glass does not open the gate — it cannot mint a grant. It records that a named human went around a sealed door, permanently. People do this anyway; a control plane that pretends otherwise only ensures there is no record of it.