Known limits and non-goals (the honest register)

Platform limits (named, with the evidence)

• TLS certificate expiry cannot be probed from the ENGINE (the Workers side): the platform's fetch and connect() expose no peer-certificate API, and an external CT-log lookup would make the claim depend on a third party — against the self-measurement doctrine. The WATCH therefore lives in the off-platform heartbeat (TODO 81): GitHub Actions runs openssl per unique HTTPS host in the registry, a cert inside CERT_WARN_DAYS (default 14) or expired opens the canonical tracking issue, and an unmeasurable host is a NAMED note in the report — never an assumed expiry. The engine's surfaces never render a certificate claim.
• The control plane registers ONE identity issuer per plane (TODO 71): OP_ISSUER is a single var, so every page's admin SSO resolves against that OP. An estate running its own OP (the Conormis posture, id.conormis.com) runs its own plane. The OP advertises no RFC 7592 management endpoint, so a registered client is never deleted by the plane — retiring a page does not (cannot) retire its OP client.
• The probe leg log costs one KV write per service per round (TODO 74b): the honest price of a per-leg operator record. On the free plan's 1,000 writes/day the log is the first thing to turn off — site.probe_log_hours: 0 — before touching the probe cadence; the paid plans (the estate floor since the 2026-09-08 quota incident) carry it without noticing.
• The SMTP transport refuses no port in the engine, but the platform refuses outbound port 25 (TODO 72 tier B — the cloud's anti-spam rule; the engine's loader accepts any 1-65535 and the dialogue is the verdict either way). 465 (implicit TLS) and 587 (STARTTLS) are the supported postures, exercised without composing or delivering any message. The legs run against a scripted connection; the FIRST live SMTP row is the deploy-time verification act, and it lands in this register with the evidence when it runs.
• One shared deployment's probe fan-out is the sum of its pages' services × vantages per minute (the quota dial: docs/manual/07). The board's per-render KV read count scales with the page's service count; the known scaling path (not yet needed at estate scale) is read-packing the per-page rows into one bundle key.

The measured performance posture (2026-09-12)

Cache-busted board renders (the worker's full path: per-service KV reads, verdicts, render) answer in 90-216 ms from a cold edge; the 30-second public cache serves warm hits at ~100 ms. The numbers ride here so the next audit has a baseline, not a guess.

Non-goals (deliberate)

• Live page push (SSE/WebSockets): the product's cadence is the minute; a pushed board adds a Durable Object dependency for no honesty gain. The 30-second page cache is the contract.
• SMS/Teams/phone escalation: the notification surface is email
  • signed webhooks; a webhook receiver bridges to any pager.
• Billing: the control plane is a registry and an emitter; money is deliberately outside the engine.

The posture under all of them

Fail-closed surfaces, worst-of verdicts, truncated numbers, human prose for incidents. When a limit moves, the register moves with it.