Trust boundaries

• AccountCore is the custody, account, permission, and product-route boundary.
• Verified Spot books are trusted to reconcile local liabilities against aggregate AccountCore reserves.
• Registered Perp Engines are trusted for margin, position, funding, health, and liquidation accounting.
• Owners and authority roles control upgrades, configuration, pauses, and recovery.
• Price, funding, keeper, intent, and indexer services supply assumptions the contracts cannot derive alone.
• An EIP-7702 trading EOA owns its signing key and wallet-local state. Its standalone keeper registry attests opaque trigger conditions but cannot alter signed order payloads.
• External multisig and change-management controls matter because the source does not enforce a general timelock.

A successful transaction establishes only that its implemented checks passed. It does not prove economic safety, correct off-chain inputs, secure role custody, audit completion, or deployed-bytecode identity.